Edit tour

Windows Analysis Report
msvcp110.dll

Overview

General Information

Sample name:	msvcp110.dll
Analysis ID:	1525239
MD5:	acefae89cedadf69124b8b5734d31824
SHA1:	1aaaba4f931740b6ff7731d7421f1550a1bf1464
SHA256:	c961841e5b16e000e3d063ac0df2a71f5fbdfcaa1d3d29e1e216094ec0e6ab3c
Tags:	dlluser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6760 cmdline: loaddll32.exe "C:\Users\user\Desktop\msvcp110.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 6788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6908 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\msvcp110.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 7004 cmdline: rundll32.exe "C:\Users\user\Desktop\msvcp110.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

aspnet_regiis.exe (PID: 7140 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe" MD5: 5D1D74198D75640E889F0A577BBF31FC)

rundll32.exe (PID: 6960 cmdline: rundll32.exe C:\Users\user\Desktop\msvcp110.dll,GetGameData MD5: 889B99C52A60DD49227C5E485A016679)

aspnet_regiis.exe (PID: 7080 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe" MD5: 5D1D74198D75640E889F0A577BBF31FC)

rundll32.exe (PID: 2736 cmdline: rundll32.exe "C:\Users\user\Desktop\msvcp110.dll",GetGameData MD5: 889B99C52A60DD49227C5E485A016679)

aspnet_regiis.exe (PID: 2124 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe" MD5: 5D1D74198D75640E889F0A577BBF31FC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["snarlypagowo.site", "explorationmsn.stor", "abnomalrkmu.site", "chorusarorp.site", "mysterisop.site", "absorptioniw.site", "soldiefieop.site", "treatynreit.site", "questionsmw.stor"], "Build id": "1AsNN2--7258599327"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T23:14:04.776299+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49732	172.67.214.93	443	TCP
2024-10-03T23:14:04.786485+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49733	172.67.214.93	443	TCP
2024-10-03T23:14:07.222040+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49735	172.67.214.93	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T23:14:04.776299+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49732	172.67.214.93	443	TCP
2024-10-03T23:14:04.786485+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49733	172.67.214.93	443	TCP
2024-10-03T23:14:07.222040+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49735	172.67.214.93	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (abnomalrkmu .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T23:14:00.883838+0200	2056392	1	Domain Observed Used for C2 Detected	192.168.2.4	58198	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (absorptioniw .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T23:14:00.951611+0200	2056394	1	Domain Observed Used for C2 Detected	192.168.2.4	50265	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (chorusarorp .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T23:14:00.899084+0200	2056396	1	Domain Observed Used for C2 Detected	192.168.2.4	65217	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mysterisop .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T23:14:00.940419+0200	2056400	1	Domain Observed Used for C2 Detected	192.168.2.4	53490	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (questionsmw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T23:14:00.860110+0200	2056402	1	Domain Observed Used for C2 Detected	192.168.2.4	50612	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (snarlypagowo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T23:14:00.928971+0200	2056406	1	Domain Observed Used for C2 Detected	192.168.2.4	53832	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (soldiefieop .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T23:14:00.873082+0200	2056408	1	Domain Observed Used for C2 Detected	192.168.2.4	57508	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (treatynreit .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T23:14:00.910551+0200	2056410	1	Domain Observed Used for C2 Detected	192.168.2.4	50248	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware

Found malware configuration

Source: 6.2.aspnet_regiis.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["snarlypagowo.site", "explorationmsn.stor", "abnomalrkmu.site", "chorusarorp.site", "mysterisop.site", "absorptioniw.site", "soldiefieop.site", "treatynreit.site", "questionsmw.stor"], "Build id": "1AsNN2--7258599327"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: msvcp110.dll

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000008.00000002.1768820875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: absorptioniw.site
Source: 00000008.00000002.1768820875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: mysterisop.site
Source: 00000008.00000002.1768820875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: snarlypagowo.site
Source: 00000008.00000002.1768820875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: treatynreit.site
Source: 00000008.00000002.1768820875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: chorusarorp.site
Source: 00000008.00000002.1768820875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: abnomalrkmu.site
Source: 00000008.00000002.1768820875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: soldiefieop.site
Source: 00000008.00000002.1768820875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: questionsmw.stor
Source: 00000008.00000002.1768820875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: explorationmsn.stor
Source: 00000008.00000002.1768820875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000008.00000002.1768820875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000008.00000002.1768820875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000008.00000002.1768820875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000008.00000002.1768820875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000008.00000002.1768820875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 1AsNN2--7258599327

Source: msvcp110.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.214.93:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.214.93:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.214.93:443 -> 192.168.2.4:49735 version: TLS 1.2

Source: msvcp110.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 64567875h	5_2_00444040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov dword ptr [esp+08h], ecx	5_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	5_2_0041B000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [eax], dx	5_2_004210D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	5_2_0041508C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov dword ptr [esp+50h], 00000000h	5_2_0041508C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	5_2_004480A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	5_2_004300B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp]	5_2_00429140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000688h]	5_2_0041D1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	5_2_0041F1D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	5_2_0044518B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov dword ptr [esp+18h], 3602043Ah	5_2_0042F1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [eax], cx	5_2_00427250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [eax], cx	5_2_00427250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx esi, byte ptr [edx+eax-01h]	5_2_0040C210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, word ptr [esp+eax*4+000000ACh]	5_2_0040C210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov dword ptr [esp+34h], edx	5_2_004012F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [edx], ax	5_2_0042A280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	5_2_00414294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp]	5_2_0042D295
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp+24h]	5_2_0042D295
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp+20h]	5_2_00416319
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	5_2_00433335
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], al	5_2_00433335
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then dec ebx	5_2_0043F3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, word ptr [edi]	5_2_0042A3A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp+14h]	5_2_0042A3A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [eax], dx	5_2_004214D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp]	5_2_0042D4D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp+24h]	5_2_0042D4D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], D518DBA1h	5_2_0043F4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], D1A85EEEh	5_2_0043F4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [eax], dx	5_2_004214EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	5_2_00416574
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp+24h]	5_2_0042C510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], al	5_2_00431670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], al	5_2_00431670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], al	5_2_00431670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], al	5_2_00431670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], al	5_2_00431670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	5_2_00431670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], al	5_2_00431670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000D0h]	5_2_0041D672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	5_2_00447630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp al, 2Eh	5_2_0042C6E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp]	5_2_0042C6E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ebx, eax	5_2_0040A680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ebp, eax	5_2_0040A680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	5_2_004416A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000D0h]	5_2_0041D733
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	5_2_00416866
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp+68h]	5_2_00447820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	5_2_0042B830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then xor eax, eax	5_2_0042B830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp eax	5_2_0042A8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [ebp-000000C0h]	5_2_0040F917
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esi+08h]	5_2_00412920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000080h]	5_2_00412920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	5_2_00412920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp dword ptr [00451A70h]	5_2_0042E927
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	5_2_0043B9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp+24h]	5_2_0042DA0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	5_2_00449A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp byte ptr [ebp+ebx+00h], 00000000h	5_2_0042DB4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	5_2_00404B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	5_2_00443B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp dword ptr [0045042Ch]	5_2_0041FB73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	5_2_00446BE5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov esi, ebx	5_2_00448BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	5_2_00433BFE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	5_2_00433BFE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	5_2_00449BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp+54h]	5_2_0041FBB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	5_2_00420C4C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	5_2_00446C5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	5_2_00405C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	5_2_0040FC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	5_2_00444C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 69F07BF2h	5_2_00427D03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp word ptr [ecx+edx+02h], 0000h	5_2_00449D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	5_2_00449D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp eax, C0000004h	5_2_0041DDFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp]	5_2_00443DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp]	5_2_0042EE40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp eax	5_2_00415E11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx eax, byte ptr [ebx+edx-06h]	5_2_00406E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx esi, byte ptr [edx+ebp]	5_2_00406E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov esi, ebx	5_2_00448F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp]	5_2_0040DFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	5_2_0040DFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	5_2_00426FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	5_2_00433F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	5_2_00433F92

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056394 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (absorptioniw .site) : 192.168.2.4:50265 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056406 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (snarlypagowo .site) : 192.168.2.4:53832 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056408 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (soldiefieop .site) : 192.168.2.4:57508 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056400 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mysterisop .site) : 192.168.2.4:53490 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056396 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (chorusarorp .site) : 192.168.2.4:65217 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056392 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (abnomalrkmu .site) : 192.168.2.4:58198 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056402 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (questionsmw .store) : 192.168.2.4:50612 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056410 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (treatynreit .site) : 192.168.2.4:50248 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49732 -> 172.67.214.93:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49735 -> 172.67.214.93:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49732 -> 172.67.214.93:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49735 -> 172.67.214.93:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49733 -> 172.67.214.93:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49733 -> 172.67.214.93:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: snarlypagowo.site
Source: Malware configuration extractor	URLs: explorationmsn.stor
Source: Malware configuration extractor	URLs: abnomalrkmu.site
Source: Malware configuration extractor	URLs: chorusarorp.site
Source: Malware configuration extractor	URLs: mysterisop.site
Source: Malware configuration extractor	URLs: absorptioniw.site
Source: Malware configuration extractor	URLs: soldiefieop.site
Source: Malware configuration extractor	URLs: treatynreit.site
Source: Malware configuration extractor	URLs: questionsmw.stor

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: beearvagueo.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: beearvagueo.site
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: beearvagueo.site

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: ed.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: explorationmsn.store
Source: global traffic	DNS traffic detected: DNS query: questionsmw.store
Source: global traffic	DNS traffic detected: DNS query: soldiefieop.site
Source: global traffic	DNS traffic detected: DNS query: abnomalrkmu.site
Source: global traffic	DNS traffic detected: DNS query: chorusarorp.site
Source: global traffic	DNS traffic detected: DNS query: treatynreit.site
Source: global traffic	DNS traffic detected: DNS query: snarlypagowo.site
Source: global traffic	DNS traffic detected: DNS query: mysterisop.site
Source: global traffic	DNS traffic detected: DNS query: absorptioniw.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: beearvagueo.site

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: beearvagueo.site

Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744302028.000000000310C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.0000000003098000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744302028.000000000310C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.0000000003098000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744302028.000000000310C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.0000000003098000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F36000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://absorptioniw.site:443/api
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.s
Source: aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.co
Source: aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.coA)NR
Source: aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000002.1745507556.000000000306D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769039583.000000000308D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.000000000308D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beearvagueo.site/
Source: aspnet_regiis.exe, 00000008.00000003.1768436001.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.00000000030D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beearvagueo.site/L
Source: aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1745953427.0000000002EFC000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744687596.0000000002EFC000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000002.1745815444.000000000309C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.000000000309C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.00000000030D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beearvagueo.site/api
Source: aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beearvagueo.site/api2
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beearvagueo.site/apiF
Source: aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beearvagueo.site/apiN
Source: aspnet_regiis.exe, 00000008.00000003.1768436001.000000000309D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.000000000309D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beearvagueo.site/apib
Source: aspnet_regiis.exe, 00000008.00000003.1768436001.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.00000000030D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beearvagueo.site/apic
Source: aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beearvagueo.site/apie
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beearvagueo.site/d:
Source: aspnet_regiis.exe, 00000008.00000002.1769039583.000000000308D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.000000000308D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beearvagueo.site:443/api
Source: aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F36000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beearvagueo.site:443/apiiP
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F36000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chorusarorp.site:443/api
Source: aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akama
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.ste
Source: aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steam
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamsA
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.0000000003098000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzS
Source: aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.0000000003098000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744302028.000000000310C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.0000000003098000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.0000000003098000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.0000000003098000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=2ZRoxzol
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.0000000003098000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=HLoW
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vW
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgr
Source: aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.j
Source: aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=24Mg
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=24Mgahw2gQy5&l=e
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sa
Source: aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascriD
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F36000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mysterisop.site:443/api
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F36000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://snarlypagowo.site:443/api
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.000000000309C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.000000000309C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/E
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: aspnet_regiis.exe, 00000008.00000003.1768436001.000000000309D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.000000000309D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/i
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744302028.000000000310C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.0000000003098000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: aspnet_regiis.exe, 00000008.00000003.1768436001.00000000030C3000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.00000000030C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/mBI
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: aspnet_regiis.exe, 00000008.00000003.1768436001.000000000309D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.000000000309D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/or
Source: aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F22000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F22000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000002.1745815444.000000000309C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.000000000309C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.00000000030C3000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.00000000030C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.0000000003098000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744302028.000000000310C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000002.1745677654.0000000003096000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744479499.0000000003096000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F36000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744302028.000000000310C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.0000000003098000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F36000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treatynreit.site:443/api
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20TeV
Source: aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.214.93:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.214.93:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.214.93:443 -> 192.168.2.4:49735 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 5_2_00438660 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

5_2_00438660

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 5_2_00438660 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

5_2_00438660

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_004101A0	5_2_004101A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_00446DCB	5_2_00446DCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_00401000	5_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_00407020	5_2_00407020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0041508C	5_2_0041508C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_004480A0	5_2_004480A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_004221A0	5_2_004221A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_00444240	5_2_00444240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0040B270	5_2_0040B270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0040C210	5_2_0040C210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_00438210	5_2_00438210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_004432E0	5_2_004432E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_004012F2	5_2_004012F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0042D295	5_2_0042D295
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0040937E	5_2_0040937E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_00405320	5_2_00405320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_004073D0	5_2_004073D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0040138D	5_2_0040138D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0042A3A8	5_2_0042A3A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_00428472	5_2_00428472
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0042D4D4	5_2_0042D4D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0042C510	5_2_0042C510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_004365E0	5_2_004365E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_00401589	5_2_00401589
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_00430590	5_2_00430590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_00431670	5_2_00431670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0042C6E1	5_2_0042C6E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_004486E0	5_2_004486E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0040A680	5_2_0040A680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0040B700	5_2_0040B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_00403780	5_2_00403780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_00436820	5_2_00436820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0042B830	5_2_0042B830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0043F8E0	5_2_0043F8E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0042E927	5_2_0042E927
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0042DB4B	5_2_0042DB4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_00411B50	5_2_00411B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0040ABD0	5_2_0040ABD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_00448BE0	5_2_00448BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_00447BE0	5_2_00447BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0043EC60	5_2_0043EC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_00407DD0	5_2_00407DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0041DDFF	5_2_0041DDFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0040CF10	5_2_0040CF10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: String function: 0040EBD0 appears 171 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: String function: 0040CCF0 appears 51 times

Source: msvcp110.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: classification engine

Classification label: mal100.troj.evad.winDLL@16/0@11/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 5_2_00437557 CoCreateInstance,

5_2_00437557

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6788:120:WilError_03

Source: msvcp110.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\msvcp110.dll,GetGameData

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\msvcp110.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\msvcp110.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\msvcp110.dll,GetGameData
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\msvcp110.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\msvcp110.dll",GetGameData
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\msvcp110.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\msvcp110.dll,GetGameData	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\msvcp110.dll",GetGameData	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\msvcp110.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dpapi.dll	Jump to behavior

Source: msvcp110.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: msvcp110.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0044D20E push esp; ret		5_2_0044D20F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 5_2_0044ED93 push edx; ret		5_2_0044ED9B

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe TID: 7152	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe TID: 7164	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe TID: 6164	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe TID: 1104	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F42000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW;
Source: aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F42000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F42000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000002.1745507556.000000000306D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769039583.000000000308D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.000000000308D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: aspnet_regiis.exe, 00000005.00000002.1745953427.0000000002EFC000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744687596.0000000002EFC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWhm

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 5_2_00446170 LdrInitializeThunk,

5_2_00446170

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 400000 protect: page execute and read and write	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 400000 value starts with: 4D5A	Jump to behavior

LummaC encrypted strings found

Source: aspnet_regiis.exe	String found in binary or memory: chorusarorp.site
Source: aspnet_regiis.exe	String found in binary or memory: abnomalrkmu.site
Source: aspnet_regiis.exe	String found in binary or memory: soldiefieop.site
Source: aspnet_regiis.exe	String found in binary or memory: questionsmw.stor
Source: aspnet_regiis.exe	String found in binary or memory: explorationmsn.stor
Source: aspnet_regiis.exe	String found in binary or memory: absorptioniw.site
Source: aspnet_regiis.exe	String found in binary or memory: mysterisop.site
Source: aspnet_regiis.exe	String found in binary or memory: snarlypagowo.site
Source: aspnet_regiis.exe	String found in binary or memory: treatynreit.site

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 401000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 44B000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 44E000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 45E000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2B42008	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 401000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 44B000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 44E000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 45E000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2C18008	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 401000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 44B000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 44E000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 45E000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2CF8008	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\msvcp110.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 PowerShell	1 DLL Side-Loading	311 Process Injection	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	2 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
msvcp110.dll	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	unknown
beearvagueo.site	172.67.214.93	true	true	unknown
chorusarorp.site	unknown	unknown	true	unknown
treatynreit.site	unknown	unknown	true	unknown
snarlypagowo.site	unknown	unknown	true	unknown
questionsmw.store	unknown	unknown	false	unknown
mysterisop.site	unknown	unknown	true	unknown
absorptioniw.site	unknown	unknown	true	unknown
abnomalrkmu.site	unknown	unknown	true	unknown
soldiefieop.site	unknown	unknown	true	unknown
explorationmsn.store	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
abnomalrkmu.site	true		unknown
absorptioniw.site	true		unknown
treatynreit.site	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
questionsmw.stor	true		unknown
snarlypagowo.site	true		unknown
chorusarorp.site	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/?subsection=broadcasts	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sa	aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=24Mg	aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/subscriber_agreement/	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.ste	aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.0000000003098000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.valvesoftware.com/legal.htm	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com	aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vW	aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mysterisop.site:443/api	aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F36000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascriD	aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=2ZRoxzol	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.0000000003098000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://s.ytimg.com;	aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://treatynreit.site:443/api	aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F36000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://avatars.akamai.steamstatic.coA)NR	aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/or	aspnet_regiis.exe, 00000008.00000003.1768436001.000000000309D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.000000000309D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamsA	aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744302028.000000000310C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.0000000003098000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com:443/profiles/76561199724331900	aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F36000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://beearvagueo.site/api2	aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/i	aspnet_regiis.exe, 00000008.00000003.1768436001.000000000309D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.000000000309D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/points/shop/	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sketchfab.com	aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744302028.000000000310C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000002.1745677654.0000000003096000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744479499.0000000003096000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://www.youtube.com/	aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.0000000003098000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://absorptioniw.site:443/api	aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F36000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.akamai.s	aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.j	aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://beearvagueo.site/L	aspnet_regiis.exe, 00000008.00000003.1768436001.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.00000000030D3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic	aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgr	aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/recaptcha/	aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://beearvagueo.site/d:	aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://beearvagueo.site/	aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000002.1745507556.000000000306D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769039583.000000000308D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.000000000308D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20TeV	aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chorusarorp.site:443/api	aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F36000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;	aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/my/wishlist/	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/en/	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/market/	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/	aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=24Mgahw2gQy5&l=e	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=HLoW	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.0000000003098000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/subscriber_agreement/	aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744302028.000000000310C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.0000000003098000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744302028.000000000310C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.0000000003098000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net/recaptcha/;	aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://beearvagueo.site/apie	aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F56000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://beearvagueo.site/apic	aspnet_regiis.exe, 00000008.00000003.1768436001.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.00000000030D3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/discussions/	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://beearvagueo.site/apib	aspnet_regiis.exe, 00000008.00000003.1768436001.000000000309D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.000000000309D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://beearvagueo.site:443/apiiP	aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F36000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F36000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://beearvagueo.site/apiN	aspnet_regiis.exe, 00000005.00000003.1744296630.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000002.1746161653.0000000002F56000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://medal.tv	aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	aspnet_regiis.exe, 00000006.00000002.1745815444.00000000030B8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.00000000030B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744302028.000000000310C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.0000000003098000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/E	aspnet_regiis.exe, 00000006.00000002.1745815444.000000000309C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1744365537.000000000309C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akama	aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://beearvagueo.site:443/api	aspnet_regiis.exe, 00000008.00000002.1769039583.000000000308D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.000000000308D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzS	aspnet_regiis.exe, 00000005.00000002.1746839338.0000000002F94000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	aspnet_regiis.exe, 00000005.00000003.1744655704.0000000002F8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000005.00000003.1744262020.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1743938920.0000000003104000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000006.00000003.1730675562.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768436001.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000002.1769094222.0000000003108000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000008.00000003.1768392982.0000000003123000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false
172.67.214.93	beearvagueo.site	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525239
Start date and time:	2024-10-03 23:13:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	msvcp110.dll
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@16/0@11/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 89% Number of executed functions: 9 Number of non-executed functions: 100
Cookbook Comments:	Found application associated with file extension: .dll Stop behavior analysis, all processes terminated

Warnings

Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: msvcp110.dll

Simulations

Behavior and APIs

Time	Type	Description
17:14:00	API Interceptor	7x Sleep call for process: aspnet_regiis.exe modified
17:14:03	API Interceptor	1x Sleep call for process: loaddll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
172.67.214.93	http://tebakbola.info	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	carrier_ratecon.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	c84f2f8df965727bcdcc4de6beecf70c960ef7c885e77.dll	Get hash	malicious	LummaC	Browse	104.102.49.254
	0a839761915d.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Activator by URKE v2.5.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	RD4ttmm3bO.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	v4yke52Xwu.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://www.google.se/url?q=xtcjw2geVaKWnfmdoGJR&rct=plPBlHNa5kwdhss6Wkqp&sa=t&esrc=513lj8JvP7Ittpg5uakw&source=&cd=HEdeaS5QG8iPRKWBvNC5&cad=v3vi70ntSK6fhpPYoZj8&ved=blJ54Mupbf2HcJbicYcQ&uact=&url=amp/s/link.mail.beehiiv.com/ss/c/u001.mtSAz3_WgZe6oQdiJX3I5Wky17Shk-m8xsMoltULMS3mzuBnL-QM9pVTUTxyWc1WyOovmb3Tk3NbIL2d2EAiLnALFxIwpw4Ea5BJnfNlGtrBBU_09OdOyxWIoH5OGk5krozZGyDG04GwV1A1i62V7ZHAsHD2HuXxLRbuTLwJ7nne5OoBikrWbP09wdmrU0Ux1PwQTxWW-4WqOLqDM-eOzn5OS5dc9AC-zsZGTpLU68lyIxLrcGUjprs01qDo_AF9kArbtDnZS59rgsqwPhVy55PUqH74R1QD9RQNSwa0QLjmNb6xFyDx4TkQQ9pmK-Sq/4a7/BVRt3igITgKfI8bq35Ml_w/h53/h001.yn5JRYzfVDjfbL0RFC-jVPp1XHK_GYk_K4Zr7dwWM3M	Get hash	malicious	Unknown	Browse	104.18.68.40
	Document-20-18-07.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	188.114.97.3
	COVID-19.pdf	Get hash	malicious	PDFPhish	Browse	162.159.61.3
	ORA _ Morningstar DBRS.html	Get hash	malicious	Unknown	Browse	104.18.86.42
	carrier_ratecon.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://www.ccjm.org/highwire_log/share/mendeley?link=https://onpro.info	Get hash	malicious	Unknown	Browse	104.18.39.115
	das.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	188.114.97.3
	vierm_soft_x64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	188.114.96.3
	Document-18-33-08.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	188.114.96.3
	tMREqVW0.exe	Get hash	malicious	XWorm	Browse	104.20.3.235
AKAMAI-ASUS	teracopy.exe	Get hash	malicious	Unknown	Browse	184.28.90.27
	COVID-19.pdf	Get hash	malicious	PDFPhish	Browse	23.217.172.185
	carrier_ratecon.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	c84f2f8df965727bcdcc4de6beecf70c960ef7c885e77.dll	Get hash	malicious	LummaC	Browse	104.102.49.254
	75c6a7ee973b556a2a3914a9e4b18bc019636e70fb6f4c2f8c6f7da0af050cbb.7z	Get hash	malicious	Unknown	Browse	23.201.253.231
	0a839761915d.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Activator by URKE v2.5.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Phisher	Browse	184.28.90.27
	http://arcor.cfd	Get hash	malicious	HTMLPhisher	Browse	104.78.188.188

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Document-20-18-07.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	104.102.49.254 172.67.214.93
	carrier_ratecon.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.214.93
	das.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	104.102.49.254 172.67.214.93
	vierm_soft_x64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	104.102.49.254 172.67.214.93
	Document-18-33-08.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	104.102.49.254 172.67.214.93
	c84f2f8df965727bcdcc4de6beecf70c960ef7c885e77.dll	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.214.93
	0a839761915d.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.214.93
	sqlite.dll	Get hash	malicious	Unknown	Browse	104.102.49.254 172.67.214.93
	Activator by URKE v2.5.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.214.93
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254 172.67.214.93

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.096338130873302
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	msvcp110.dll
File size:	592'896 bytes
MD5:	acefae89cedadf69124b8b5734d31824
SHA1:	1aaaba4f931740b6ff7731d7421f1550a1bf1464
SHA256:	c961841e5b16e000e3d063ac0df2a71f5fbdfcaa1d3d29e1e216094ec0e6ab3c
SHA512:	c7f922cd78a8c1c9b06c884415619e547c081eb51603bc4f1e69ae91b977c247ba4822df7e1fa78e70344af0fadba3637c59bf1cf2059b8eaf3917e2b63831e4
SSDEEP:	6144:EbU2u9ytJdpnyFs9aH/zVj4MNM3rBAFX7N1z/gPX7h//7cu58lBtwGRPuRo1hPyo:Eu9ytZnP9aW0MbSVYPXJ7xud0RoZB
TLSH:	ABC46CC47EE5CBA5F96DCA727C344787BD3E46302A48CD8F1D1AC8056E2A8E62413767
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................S....................s...............4.......4.......4...............4.......4......Rich...........

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x100230f4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x66FEC4DD [Thu Oct 3 16:22:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	e508a746a3946beda3b79173e8298687

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F2438803C57h
call 00007F2438803E2Bh
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F2438803B03h
add esp, 0Ch
pop ebp
retn 000Ch
push ebp
mov ebp, esp
push 00000000h
call dword ptr [10031058h]
push dword ptr [ebp+08h]
call dword ptr [10031054h]
push C0000409h
call dword ptr [10031008h]
push eax
call dword ptr [1003105Ch]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [10031060h]
test eax, eax
je 00007F2438803C57h
push 00000002h
pop ecx
int 29h
mov dword ptr [10090AA0h], eax
mov dword ptr [10090A9Ch], ecx
mov dword ptr [10090A98h], edx
mov dword ptr [10090A94h], ebx
mov dword ptr [10090A90h], esi
mov dword ptr [10090A8Ch], edi
mov word ptr [10090AB8h], ss
mov word ptr [10090AACh], cs
mov word ptr [10090A88h], ds
mov word ptr [10090A84h], es
mov word ptr [10090A80h], fs
mov word ptr [10090A7Ch], gs
pushfd
pop dword ptr [10090AB0h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [10090AA4h], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00090AA8h], eax

Rich Headers

Programming Language:

[IMP] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x37390	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x37408	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x92000	0x1c38	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x36740	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x36680	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x31000	0x150	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2f283	0x2f400	12c14864e49b51aebab8deba3fd779b8	False	0.42121879133597884	data	6.6542134731151545	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x31000	0x6ba6	0x6c00	2d67a8bba35ae9daa7e0f9f29021124a	False	0.44209346064814814	data	5.066799564694865	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x38000	0x59600	0x58a00	df432c4d107b146b15cd12b2993562c1	False	0.4759289051480959	data	6.666010476939313	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x92000	0x1c38	0x1e00	6f49c8b5e18e25c8ab81e75252eb4593	False	0.750390625	data	6.493575582335176	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

USER32.dll

ShowWindow

KERNEL32.dll

EncodePointer, WriteConsoleW, GetCurrentProcess, GetModuleHandleA, K32GetModuleInformation, GetModuleFileNameA, CreateFileA, CreateFileMappingA, CloseHandle, MapViewOfFile, VirtualProtect, GetModuleHandleW, GetConsoleWindow, VirtualAlloc, CreateProcessW, GetThreadContext, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, SetThreadContext, ResumeThread, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, CreateFileW, RaiseException, InterlockedFlushSList, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, DecodePointer, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, HeapAlloc, HeapFree, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, GetProcessHeap, GetStdHandle, GetFileType, GetStringTypeW, HeapSize, HeapReAlloc, SetStdHandle, FlushFileBuffers, WriteFile, GetConsoleOutputCP, GetConsoleMode, SetFilePointerEx

Exports

Name	Ordinal	Address
GetGameData	1	0x100106e0

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-03T23:14:00.860110+0200	2056402	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (questionsmw .store)	1	192.168.2.4	50612	1.1.1.1	53	UDP
2024-10-03T23:14:00.873082+0200	2056408	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (soldiefieop .site)	1	192.168.2.4	57508	1.1.1.1	53	UDP
2024-10-03T23:14:00.883838+0200	2056392	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (abnomalrkmu .site)	1	192.168.2.4	58198	1.1.1.1	53	UDP
2024-10-03T23:14:00.899084+0200	2056396	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (chorusarorp .site)	1	192.168.2.4	65217	1.1.1.1	53	UDP
2024-10-03T23:14:00.910551+0200	2056410	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (treatynreit .site)	1	192.168.2.4	50248	1.1.1.1	53	UDP
2024-10-03T23:14:00.928971+0200	2056406	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (snarlypagowo .site)	1	192.168.2.4	53832	1.1.1.1	53	UDP
2024-10-03T23:14:00.940419+0200	2056400	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mysterisop .site)	1	192.168.2.4	53490	1.1.1.1	53	UDP
2024-10-03T23:14:00.951611+0200	2056394	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (absorptioniw .site)	1	192.168.2.4	50265	1.1.1.1	53	UDP
2024-10-03T23:14:04.776299+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49732	172.67.214.93	443	TCP
2024-10-03T23:14:04.776299+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49732	172.67.214.93	443	TCP
2024-10-03T23:14:04.786485+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49733	172.67.214.93	443	TCP
2024-10-03T23:14:04.786485+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49733	172.67.214.93	443	TCP
2024-10-03T23:14:07.222040+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49735	172.67.214.93	443	TCP
2024-10-03T23:14:07.222040+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49735	172.67.214.93	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 23:14:00.987202883 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:00.987288952 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:00.987504005 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:00.993371010 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:00.993458986 CEST	443	49731	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:00.993709087 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:00.996989012 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:00.997068882 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:00.997117043 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:00.997194052 CEST	443	49731	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:02.567922115 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:02.567929029 CEST	443	49731	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:02.568162918 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:02.568268061 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:02.619668007 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:02.690821886 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:02.690906048 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:02.691375017 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:02.697072029 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:02.697127104 CEST	443	49731	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:02.698288918 CEST	443	49731	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:02.744611979 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:02.744645119 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:02.913192987 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:02.944588900 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:02.959500074 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:02.991489887 CEST	443	49731	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.318358898 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.318424940 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.318434000 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.318542957 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.318576097 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.318937063 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.319010019 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.319474936 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.422089100 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.422153950 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.422422886 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.422492981 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.422808886 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.427412987 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.427623987 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.427710056 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.427710056 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.436234951 CEST	443	49731	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.436300993 CEST	443	49731	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.436321974 CEST	443	49731	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.436394930 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.436441898 CEST	443	49731	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.436464071 CEST	443	49731	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.436489105 CEST	443	49731	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.436568975 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.436568975 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.436568975 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.439099073 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.448924065 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.448924065 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.448996067 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.449033976 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.480202913 CEST	49732	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:03.480293036 CEST	443	49732	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:03.480742931 CEST	49732	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:03.480855942 CEST	49732	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:03.480885983 CEST	443	49732	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:03.539108992 CEST	443	49731	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.539174080 CEST	443	49731	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.539275885 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.539275885 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.539340973 CEST	443	49731	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.539403915 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.544478893 CEST	443	49731	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.544639111 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.544699907 CEST	443	49731	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.544742107 CEST	443	49731	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.544774055 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.544809103 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.545221090 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.545221090 CEST	49731	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.545289040 CEST	443	49731	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.545324087 CEST	443	49731	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.548294067 CEST	49733	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:03.548343897 CEST	443	49733	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:03.548605919 CEST	49733	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:03.548814058 CEST	49733	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:03.548845053 CEST	443	49733	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:03.803921938 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.804003954 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:03.804085970 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.805704117 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:03.805738926 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:04.082155943 CEST	443	49733	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:04.082519054 CEST	49733	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:04.083426952 CEST	443	49732	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:04.083653927 CEST	49732	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:04.084556103 CEST	49733	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:04.084609985 CEST	443	49733	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:04.085027933 CEST	443	49733	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:04.086577892 CEST	49732	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:04.086606026 CEST	443	49732	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:04.087142944 CEST	443	49732	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:04.087966919 CEST	49733	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:04.088011026 CEST	49733	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:04.088069916 CEST	443	49733	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:04.089474916 CEST	49732	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:04.089509964 CEST	49732	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:04.089669943 CEST	443	49732	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:04.710589886 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:04.710810900 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:04.711992025 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:04.712013006 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:04.712935925 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:04.760061026 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:04.775054932 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:04.776429892 CEST	443	49732	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:04.776667118 CEST	443	49732	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:04.776747942 CEST	49732	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:04.776829004 CEST	49732	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:04.776829958 CEST	49732	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:04.776869059 CEST	443	49732	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:04.776896954 CEST	443	49732	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:04.786509991 CEST	443	49733	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:04.786686897 CEST	443	49733	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:04.786863089 CEST	49733	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:04.808706045 CEST	49733	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:04.808706045 CEST	49733	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:04.808777094 CEST	443	49733	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:04.808814049 CEST	443	49733	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:04.819407940 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:05.214128017 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:05.214196920 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:05.214243889 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:05.214248896 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:05.214271069 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:05.214298964 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:05.214298964 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:05.214344025 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:05.214370012 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:05.214401960 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:05.214401960 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:05.214427948 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:05.322155952 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:05.322206974 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:05.322268009 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:05.322297096 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:05.322330952 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:05.322349072 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:05.327065945 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:05.327153921 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:05.327167034 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:05.327224970 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:05.327234983 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:05.327287912 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:05.327346087 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:05.330589056 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:05.330624104 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:05.330648899 CEST	49734	443	192.168.2.4	104.102.49.254
Oct 3, 2024 23:14:05.330662966 CEST	443	49734	104.102.49.254	192.168.2.4
Oct 3, 2024 23:14:05.343756914 CEST	49735	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:05.343847036 CEST	443	49735	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:05.343961000 CEST	49735	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:05.348042011 CEST	49735	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:05.348076105 CEST	443	49735	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:05.837347031 CEST	443	49735	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:05.837538958 CEST	49735	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:05.839905977 CEST	49735	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:05.839936018 CEST	443	49735	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:05.840446949 CEST	443	49735	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:05.841682911 CEST	49735	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:05.841725111 CEST	49735	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:05.841835022 CEST	443	49735	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:07.222119093 CEST	443	49735	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:07.222358942 CEST	443	49735	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:07.222457886 CEST	49735	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:07.222552061 CEST	49735	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:07.222552061 CEST	49735	443	192.168.2.4	172.67.214.93
Oct 3, 2024 23:14:07.222615957 CEST	443	49735	172.67.214.93	192.168.2.4
Oct 3, 2024 23:14:07.222645998 CEST	443	49735	172.67.214.93	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 23:14:00.843691111 CEST	55042	53	192.168.2.4	1.1.1.1
Oct 3, 2024 23:14:00.854820013 CEST	53	55042	1.1.1.1	192.168.2.4
Oct 3, 2024 23:14:00.860110044 CEST	50612	53	192.168.2.4	1.1.1.1
Oct 3, 2024 23:14:00.868911028 CEST	53	50612	1.1.1.1	192.168.2.4
Oct 3, 2024 23:14:00.873081923 CEST	57508	53	192.168.2.4	1.1.1.1
Oct 3, 2024 23:14:00.881633997 CEST	53	57508	1.1.1.1	192.168.2.4
Oct 3, 2024 23:14:00.883837938 CEST	58198	53	192.168.2.4	1.1.1.1
Oct 3, 2024 23:14:00.896872044 CEST	53	58198	1.1.1.1	192.168.2.4
Oct 3, 2024 23:14:00.899084091 CEST	65217	53	192.168.2.4	1.1.1.1
Oct 3, 2024 23:14:00.908797979 CEST	53	65217	1.1.1.1	192.168.2.4
Oct 3, 2024 23:14:00.910551071 CEST	50248	53	192.168.2.4	1.1.1.1
Oct 3, 2024 23:14:00.926990032 CEST	53	50248	1.1.1.1	192.168.2.4
Oct 3, 2024 23:14:00.928971052 CEST	53832	53	192.168.2.4	1.1.1.1
Oct 3, 2024 23:14:00.938348055 CEST	53	53832	1.1.1.1	192.168.2.4
Oct 3, 2024 23:14:00.940418959 CEST	53490	53	192.168.2.4	1.1.1.1
Oct 3, 2024 23:14:00.949969053 CEST	53	53490	1.1.1.1	192.168.2.4
Oct 3, 2024 23:14:00.951611042 CEST	50265	53	192.168.2.4	1.1.1.1
Oct 3, 2024 23:14:00.960760117 CEST	53	50265	1.1.1.1	192.168.2.4
Oct 3, 2024 23:14:00.962630987 CEST	62217	53	192.168.2.4	1.1.1.1
Oct 3, 2024 23:14:00.980752945 CEST	53	62217	1.1.1.1	192.168.2.4
Oct 3, 2024 23:14:03.459517002 CEST	63935	53	192.168.2.4	1.1.1.1
Oct 3, 2024 23:14:03.479254961 CEST	53	63935	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2024 23:14:00.843691111 CEST	192.168.2.4	1.1.1.1	0x5b2c	Standard query (0)	explorationmsn.store	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:00.860110044 CEST	192.168.2.4	1.1.1.1	0xd61a	Standard query (0)	questionsmw.store	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:00.873081923 CEST	192.168.2.4	1.1.1.1	0xb539	Standard query (0)	soldiefieop.site	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:00.883837938 CEST	192.168.2.4	1.1.1.1	0x8d31	Standard query (0)	abnomalrkmu.site	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:00.899084091 CEST	192.168.2.4	1.1.1.1	0x347e	Standard query (0)	chorusarorp.site	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:00.910551071 CEST	192.168.2.4	1.1.1.1	0xbf84	Standard query (0)	treatynreit.site	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:00.928971052 CEST	192.168.2.4	1.1.1.1	0xda6	Standard query (0)	snarlypagowo.site	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:00.940418959 CEST	192.168.2.4	1.1.1.1	0xf29f	Standard query (0)	mysterisop.site	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:00.951611042 CEST	192.168.2.4	1.1.1.1	0xfdff	Standard query (0)	absorptioniw.site	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:00.962630987 CEST	192.168.2.4	1.1.1.1	0xdd74	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:03.459517002 CEST	192.168.2.4	1.1.1.1	0x2f16	Standard query (0)	beearvagueo.site	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 3, 2024 23:14:00.854820013 CEST	1.1.1.1	192.168.2.4	0x5b2c	Name error (3)	explorationmsn.store	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:00.868911028 CEST	1.1.1.1	192.168.2.4	0xd61a	Name error (3)	questionsmw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:00.881633997 CEST	1.1.1.1	192.168.2.4	0xb539	Name error (3)	soldiefieop.site	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:00.896872044 CEST	1.1.1.1	192.168.2.4	0x8d31	Name error (3)	abnomalrkmu.site	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:00.908797979 CEST	1.1.1.1	192.168.2.4	0x347e	Name error (3)	chorusarorp.site	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:00.926990032 CEST	1.1.1.1	192.168.2.4	0xbf84	Name error (3)	treatynreit.site	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:00.938348055 CEST	1.1.1.1	192.168.2.4	0xda6	Name error (3)	snarlypagowo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:00.949969053 CEST	1.1.1.1	192.168.2.4	0xf29f	Name error (3)	mysterisop.site	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:00.960760117 CEST	1.1.1.1	192.168.2.4	0xfdff	Name error (3)	absorptioniw.site	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:00.980752945 CEST	1.1.1.1	192.168.2.4	0xdd74	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:03.479254961 CEST	1.1.1.1	192.168.2.4	0x2f16	No error (0)	beearvagueo.site		172.67.214.93	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:14:03.479254961 CEST	1.1.1.1	192.168.2.4	0x2f16	No error (0)	beearvagueo.site		104.21.93.202	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

beearvagueo.site

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.102.49.254	443	7140	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 21:14:02 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-03 21:14:03 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 03 Oct 2024 21:14:03 GMT Content-Length: 34832 Connection: close Set-Cookie: sessionid=f802a489fba9dbcd5a9f1385; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-03 21:14:03 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-03 21:14:03 UTC	16384	IN	Data Raw: 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c Data Ascii: ript type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global
2024-10-03 21:14:03 UTC	3768	IN	Data Raw: 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 49 6e Data Ascii: div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function() { In
2024-10-03 21:14:03 UTC	166	IN	Data Raw: 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: n>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.102.49.254	443	7080	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 21:14:02 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-03 21:14:03 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 03 Oct 2024 21:14:03 GMT Content-Length: 34832 Connection: close Set-Cookie: sessionid=c7a247e5184889e55cd1cafc; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-03 21:14:03 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-03 21:14:03 UTC	16384	IN	Data Raw: 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c Data Ascii: ript type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global
2024-10-03 21:14:03 UTC	3768	IN	Data Raw: 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 49 6e Data Ascii: div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function() { In
2024-10-03 21:14:03 UTC	166	IN	Data Raw: 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: n>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49733	172.67.214.93	443	7080	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 21:14:04 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: beearvagueo.site
2024-10-03 21:14:04 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-03 21:14:04 UTC	787	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 21:14:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ff17i62ps7da75l5l5agognp9i; expires=Mon, 27 Jan 2025 15:00:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xGyQQgIZ6Q9avt8kvYBZ2fpGcMGPxSHygZk9dm%2FZUU5Y4A6Q7NaB8osUPSeHSC4eOGRF4A2rW%2FB3M4okDOVi8COk6qpaqnHPICyxiMQ78MHUqp9n7ChZ6Rro6L3j5oFwsUa2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ccff0900f8a4391-EWR
2024-10-03 21:14:04 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-03 21:14:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49732	172.67.214.93	443	7140	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 21:14:04 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: beearvagueo.site
2024-10-03 21:14:04 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-03 21:14:04 UTC	795	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 21:14:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0hgmj8540l6ca2auhh17ojtk06; expires=Mon, 27 Jan 2025 15:00:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z6XC%2By%2Fx0RO1tYGDGZJTz%2BIbqkMKEQLaiIqwl116sZAY5T3TUJ%2Bk25Eq8KqtN%2FuofvJ%2FNYt3chUgAwHmUPcwozpuzdfdDCaxYkQ0RubGAEj83ycqEcTsVyJUTQ9YqQgW7KLz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ccff090083672aa-EWR
2024-10-03 21:14:04 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-03 21:14:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	104.102.49.254	443	2124	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 21:14:04 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-03 21:14:05 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 03 Oct 2024 21:14:05 GMT Content-Length: 34832 Connection: close Set-Cookie: sessionid=3e589968fbfec392289c7016; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-03 21:14:05 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-03 21:14:05 UTC	16384	IN	Data Raw: 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c Data Ascii: ript type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global
2024-10-03 21:14:05 UTC	3768	IN	Data Raw: 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 49 6e Data Ascii: div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function() { In
2024-10-03 21:14:05 UTC	166	IN	Data Raw: 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: n>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	172.67.214.93	443	2124	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 21:14:05 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: beearvagueo.site
2024-10-03 21:14:05 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-03 21:14:07 UTC	819	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 21:14:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3f16ats9boqfpt4st8vhpr3cm4; expires=Mon, 27 Jan 2025 15:00:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ly0QMURDie4rBRDdNNZN5AgCQuyF9PewHtK68Wxiff7Q7GdKiIxyWe%2F%2F5XWDL6xl4KPc5sMEixH5RASjNrFa8fkH5vMduejWscB6dx7I2sZT6FWl00iQ9t%2FhF2GhynA0HEiE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ccff09b1c9915cb-EWR alt-svc: h3=":443"; ma=86400
2024-10-03 21:14:07 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-03 21:14:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	17:13:59
Start date:	03/10/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\msvcp110.dll"
Imagebase:	0x230000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:13:59
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:14:00
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\msvcp110.dll",#1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:14:00
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\msvcp110.dll,GetGameData
Imagebase:	0x3f0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:14:00
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\msvcp110.dll",#1
Imagebase:	0x3f0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:14:00
Start date:	03/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Imagebase:	0x220000
File size:	43'016 bytes
MD5 hash:	5D1D74198D75640E889F0A577BBF31FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:14:00
Start date:	03/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Imagebase:	0x220000
File size:	43'016 bytes
MD5 hash:	5D1D74198D75640E889F0A577BBF31FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:14:03
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\msvcp110.dll",GetGameData
Imagebase:	0x3f0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:14:03
Start date:	03/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Imagebase:	0xc0000
File size:	43'016 bytes
MD5 hash:	5D1D74198D75640E889F0A577BBF31FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.9%
Total number of Nodes:	42
Total number of Limit Nodes:	4

Executed Functions

Function 004101A0 Relevance: 1.7, Strings: 1, Instructions: 404
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5{1y, xrefs: 004105EC

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: 5{1y
API String ID: 0-1368497684
Opcode ID: e8ea5d1cda620284d3cca87f1e47a629425b054d3919e2718f6e2ab83fb85a4f
Instruction ID: 430970ba5aa758463fc1d266fd814e1e4b8d4bbd5d3e872d0ea25936ea341aea
Opcode Fuzzy Hash: e8ea5d1cda620284d3cca87f1e47a629425b054d3919e2718f6e2ab83fb85a4f
Instruction Fuzzy Hash: 19F124B1100B00DFE3208F26D984B97BBF5FB46708F108A2DE5AA8BAA1D774B455CF54

Function 00446DCB Relevance: 1.6, Strings: 1, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

BqD, xrefs: 00447103

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: BqD
API String ID: 0-3419032962
Opcode ID: ed37e71b918876b5dfba1bae4127bdfb8174ef4fb814a6e86e8dd199f863976a
Instruction ID: f376534f8a50dc1160a3c9b166cd37c026a650fa92a38d3e22a91c16b018f440
Opcode Fuzzy Hash: ed37e71b918876b5dfba1bae4127bdfb8174ef4fb814a6e86e8dd199f863976a
Instruction Fuzzy Hash: 1BD1F13260C351CFC715CF28D89052AB7E2FB89356F198A7EE89187392D734EA45CB85

Function 00446170 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00449900,005C003F,00000002,00000018,-0000002C), ref: 0044619E

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 0040D440 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 163
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 0040D451
GetCurrentThreadId.KERNEL32 ref: 0040D466
GetCurrentProcessId.KERNEL32 ref: 0040D46C
ExitProcess.KERNEL32 ref: 0040D630

Strings

=<?>, xrefs: 0040D5BE
1032, xrefs: 0040D5F3, 0040D5FB

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID: 1032$=<?>
API String ID: 1029096631-142149872
Opcode ID: 2038bd2d9c6b73b4e40e6721bc239594da0d4a758a92c2be858ddf17731f4e98
Instruction ID: 555f25744c8546db94be89d719047032197e0e4c17fd340f55623defcaf143b8
Opcode Fuzzy Hash: 2038bd2d9c6b73b4e40e6721bc239594da0d4a758a92c2be858ddf17731f4e98
Instruction Fuzzy Hash: B341497480C240ABD301BF99D544A1EFBE5EF52709F148C2EE5C497392C73AD8188B6B

Function 00445D00 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

123, xrefs: 00445D43, 00445D4B

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: 123
API String ID: 0-1549188022
Opcode ID: 3b7ffe2aac24cb1726d60088a50c21288039220aa40cb04d8e81f50c79dfa51c
Instruction ID: a2739fd40284dee98ce23fb6b7046590f6569b0d26867e028d520841740e6407
Opcode Fuzzy Hash: 3b7ffe2aac24cb1726d60088a50c21288039220aa40cb04d8e81f50c79dfa51c
Instruction Fuzzy Hash: 7301C4759082409BD701AF28EC0591FBBF4EF86B46F05882DF4C497212D339D911CBA7

Function 0040EBE0 Relevance: 1.6, APIs: 1, Instructions: 101
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(D7BFC9B3,00000000,F10E070C), ref: 0040ED26

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4dc88cb0df99b8d3a98c5cdb1ec670fef7d35882cd1cc8b0d4f236a3e63d11aa
Instruction ID: 4cd38cbd0c32a819dd0be2aab1182d7eadff182a12367131b0f4107e1301bfc1
Opcode Fuzzy Hash: 4dc88cb0df99b8d3a98c5cdb1ec670fef7d35882cd1cc8b0d4f236a3e63d11aa
Instruction Fuzzy Hash: 39318BB0D012589BEB10DF69DC45BAEBBB5BB45304F1046AAE444B7381D3385D45CFA5

Function 0044505A Relevance: 1.6, APIs: 1, Instructions: 70
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800), ref: 004450CC

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1401677f78b509c29d26488211ab75afea7a33a3747d27f15bf2e2205be3d739
Instruction ID: 83e9078ad7175dbac619403ff4e3d92812a4052d2d9051f59a847d15e64dbb14
Opcode Fuzzy Hash: 1401677f78b509c29d26488211ab75afea7a33a3747d27f15bf2e2205be3d739
Instruction Fuzzy Hash: D621D274900396DFDB05CFA8D5906ADFBB0BF1A302F58445DD441B7382C334AA12CBA9

Function 004434C0 Relevance: 1.5, APIs: 1, Instructions: 45
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00443533

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: f2361dc6212d74a21cb31e294bd24aa35daa0bd91e01053351e2e50b4d0e9618
Instruction ID: fc2577b4e93f0db1609ff2d77d0976e1a143cc53a5c5a00cb9e7c077c0dd0e2b
Opcode Fuzzy Hash: f2361dc6212d74a21cb31e294bd24aa35daa0bd91e01053351e2e50b4d0e9618
Instruction Fuzzy Hash: E1F01974508240ABD301AF18E954B0EBBE5EF56705F054C2CE4C49B262D239DC64CB96

Function 00443498 Relevance: 1.5, APIs: 1, Instructions: 9
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,00000000), ref: 004434A2

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cbad0095acf85e61a526637b6e979c92ebeb1ba137fe47122b9aa8f39d59db8e
Instruction ID: ce2431340337354b508a90f7e092094382eca2a811d93d9dc87149ba3909bbc2
Opcode Fuzzy Hash: cbad0095acf85e61a526637b6e979c92ebeb1ba137fe47122b9aa8f39d59db8e
Instruction Fuzzy Hash: 57B00230245215B9E17317115CD5F7F1D6CDF43ED6F100454B204150D14664A541D57D

Non-executed Functions

Function 0041DDFF Relevance: 23.7, Strings: 18, Instructions: 1225COMMON

Download Yara Rule

Strings

hkje, xrefs: 0041E5E0
`cb}, xrefs: 0041E5F6
L, xrefs: 0041E71F
IK, xrefs: 0041DF5D
%*+(, xrefs: 0041E047, 0041E056
\_^Y, xrefs: 0041E767
%*+(, xrefs: 0041EB17, 0041EB23
@C, xrefs: 0041ED1F
twvq, xrefs: 0041E617
x{zu, xrefs: 0041E60C
YZ[D, xrefs: 0041E64E
X[ZU, xrefs: 0041E5B4
efg`, xrefs: 0041E727
defg, xrefs: 0041E7C3
OA, xrefs: 0041ED17
Nz{, xrefs: 0041E805
TWVQX[ZU\_^Y, xrefs: 0041EA73, 0041EA7A
pqrs, xrefs: 0041E81B

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: %*+($%*+($@C$L$TWVQX[ZU\_^Y$X[ZU$YZ[D$\_^Y$`cb}$defg$efg`$hkje$pqrs$twvq$x{zu$IK$Nz{$OA
API String ID: 0-1295941102
Opcode ID: 48e835f5be9040a48b08e8b35f7b5511272b6288aa07e1c1f157d3cc9bcb95d1
Instruction ID: 068315d960757206ca91bfe4b5e0174fc538cc8ee9f9319a078fc8026ce8db79
Opcode Fuzzy Hash: 48e835f5be9040a48b08e8b35f7b5511272b6288aa07e1c1f157d3cc9bcb95d1
Instruction Fuzzy Hash: 55A2BCB55083809BD730CF15C841BEFBBE2BFC4304F54492EE9899B281DB799985CB5A

Function 00438660 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 101clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00438670
GetWindowLongW.USER32 ref: 00438695
GetClipboardData.USER32 ref: 004386A5
GlobalLock.KERNEL32 ref: 004386C4
GlobalUnlock.KERNEL32 ref: 004387B0
CloseClipboard.USER32 ref: 004387B9

Strings

9, xrefs: 00438714
6, xrefs: 0043870F
9, xrefs: 00438705
6, xrefs: 0043870A
8, xrefs: 0043871E
=, xrefs: 00438700
?, xrefs: 004386FB

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: 6$6$8$9$9$=$?
API String ID: 2832541153-2499364611
Opcode ID: 4ecb5cea78e22550e51f1c0766650d3c625aa133cf73940c3d24e28092cbc1b9
Instruction ID: 7394c3911a48552e0d11dc9b34c2007da1fa56957142a7b7922b5d5dbbba1851
Opcode Fuzzy Hash: 4ecb5cea78e22550e51f1c0766650d3c625aa133cf73940c3d24e28092cbc1b9
Instruction Fuzzy Hash: 42416A7450C3818ED301AF78958832EBFE0AB96314F14492EF4D986382D7798549CBA7

Function 00431670 Relevance: 21.6, APIs: 2, Strings: 9, Instructions: 2329COMMON

Download Yara Rule

Strings

53C, xrefs: 00432C41, 00432EAC, 00432EB5
*&- , xrefs: 00431C11
*XJe, xrefs: 00432947
JX`b, xrefs: 00432ACE
w[Nc, xrefs: 0043169A
]h>l, xrefs: 004334AF
:\Bz, xrefs: 00431FF4
avqy, xrefs: 00431E1A
WXM,, xrefs: 00431861

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: *&- $*XJe$53C$:\Bz$JX`b$WXM,$]h>l$avqy$w[Nc
API String ID: 0-2470705936
Opcode ID: 0fdc167ce9c2e05a2bafd4b6b83f0d338f32d447e1db1341dbb0ee312911c54d
Instruction ID: 6b52d3f67adb24664c3a91c36719e14c9fa1994e195d47c860f543d90ad0f600
Opcode Fuzzy Hash: 0fdc167ce9c2e05a2bafd4b6b83f0d338f32d447e1db1341dbb0ee312911c54d
Instruction Fuzzy Hash: 0E039C70404B808AE7618F35C4907E7BBE1AF1A305F44989ED4EA8B392DB79B549CF64

Function 0043F8E0 Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 588memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0043F93C
SysAllocString.OLEAUT32 ref: 0043F9F3
VariantInit.OLEAUT32(?), ref: 0043FA6A
SysStringLen.OLEAUT32(00000000), ref: 0043FB2B

Strings

%*+(, xrefs: 0043FF34
%*+(, xrefs: 0043FFF2
XY, xrefs: 0043F9A5

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID: String$Alloc$InitVariant
String ID: %*+($%*+($XY
API String ID: 3520221836-3681054843
Opcode ID: 360088e75a0bfdc16e152703c8ceb466edd7a1128cd954dfb99185e274686783
Instruction ID: 873cf424640911aa45cd168c27eba4822a74ad18274f36e812021d333af19f67
Opcode Fuzzy Hash: 360088e75a0bfdc16e152703c8ceb466edd7a1128cd954dfb99185e274686783
Instruction Fuzzy Hash: D422DD75A08301DFEB00CF24D881B6EBBE2FB89356F14892DE485973A1D738D905CB5A

Function 00412920 Relevance: 18.6, APIs: 4, Strings: 6, Instructions: 1104COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 004129F2
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00412A14
GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 00412DC0

Strings

US, xrefs: 00412C18
YW, xrefs: 00412C0E
C@rH, xrefs: 00413255
}O{, xrefs: 00413454
Nyvw, xrefs: 0041345B
E|IH, xrefs: 0041325C

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID: Initialize$DirectorySecuritySystem
String ID: C@rH$E|IH$Nyvw$US$YW$}O{
API String ID: 1379780170-2937083641
Opcode ID: 601a931b4932948a2403d0c7624d7db1059ed815bf0903b108b5d2d569a19989
Instruction ID: 38e0f33ada8cfcad5abcb3afe9dd52bce474a6cad6ff29d136f25e6762998c79
Opcode Fuzzy Hash: 601a931b4932948a2403d0c7624d7db1059ed815bf0903b108b5d2d569a19989
Instruction Fuzzy Hash: 0682FFB0500B409FD7209F25C881767BBF0BF46308F14896EE4EA8B792D738B459CB99

Function 0042C510 Relevance: 14.6, APIs: 1, Strings: 7, Instructions: 565COMMON

Download Yara Rule

Strings

W\T_, xrefs: 0042D3AF
S~Dw, xrefs: 0042D3D3, 0042D3DB
sDtB, xrefs: 0042D387
DE, xrefs: 0042CDCF
DtsN, xrefs: 0042D39F
H-X#, xrefs: 0042D1FD
!, xrefs: 0042D205

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: !$DE$DtsN$H-X#$S~Dw$W\T_$sDtB
API String ID: 0-425027836
Opcode ID: 7e1da9aa85fd5b99e25369d9935cc3627feeb4c8913f5c2c6ef13a2c1dcba7a0
Instruction ID: e1b66d668db3eaf284a4465e3d0956aa058187ba537616815b15f550d3aba65b
Opcode Fuzzy Hash: 7e1da9aa85fd5b99e25369d9935cc3627feeb4c8913f5c2c6ef13a2c1dcba7a0
Instruction Fuzzy Hash: 5612BDB0908340DBD720AF25E881A2FBBF1FB8A749F54492DF5C497262D739D910CB5A

Function 00401000 Relevance: 10.7, Strings: 7, Instructions: 1903COMMON

Download Yara Rule

Strings

gfff, xrefs: 004020C3
gfff, xrefs: 0040217F
gfff, xrefs: 00402132
0123456789abcdefxp, xrefs: 004014C4, 00401536
0123456789ABCDEFXP, xrefs: 004014BA, 00401529
-, xrefs: 00402083
A, xrefs: 0040204B

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$A$gfff$gfff$gfff
API String ID: 0-947532036
Opcode ID: 996ba5dc3168681fd38e148dabe03815a128900909ee63cb8306b0a2ad223509
Instruction ID: 24bb21e3c4691d0f802f2e4d9f0ac50f3d80cbbb945afd05861994f8d06a46a0
Opcode Fuzzy Hash: 996ba5dc3168681fd38e148dabe03815a128900909ee63cb8306b0a2ad223509
Instruction Fuzzy Hash: ECD2D2716083518FD714CE29C48476BBBE2AF89314F188A3EE895EB3D1D778D905CB86

Function 00401589 Relevance: 7.9, Strings: 6, Instructions: 419COMMON

Download Yara Rule

Strings

gfff, xrefs: 00402320
+, xrefs: 004022E2
0123456789abcdefxp, xrefs: 00401593
0123456789ABCDEFXP, xrefs: 00401589
gfff, xrefs: 00402386
gfff, xrefs: 00402335

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: +$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff$gfff
API String ID: 0-925659942
Opcode ID: 199267cbc64dd1aff0fa29f7712c1943bdcd0e8d47f77a3fba5e71398c634568
Instruction ID: b3b00cec798cd1528e2ee9d4f337dfc5343f57f5716b313ecf57be9c9f94580f
Opcode Fuzzy Hash: 199267cbc64dd1aff0fa29f7712c1943bdcd0e8d47f77a3fba5e71398c634568
Instruction Fuzzy Hash: 49E1A071A083518FD718CE28C59436FBBE2ABC5314F18893EE989A73D1D778D8458B86

Function 0040138D Relevance: 7.9, Strings: 6, Instructions: 375COMMON

Download Yara Rule

Strings

gfff, xrefs: 00402320
0123456789abcdefxp, xrefs: 00401397
0123456789ABCDEFXP, xrefs: 0040138D
-, xrefs: 004022EB
gfff, xrefs: 00402386
gfff, xrefs: 00402335

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff$gfff
API String ID: 0-854689426
Opcode ID: 969c0f03edb96067ab8def27398de18479f8ad2823b5aa3408d4fb50fcc3226b
Instruction ID: 2696d8f97c251a1de466447bacde96e6948098190633bd25ae01061a9d8bcc11
Opcode Fuzzy Hash: 969c0f03edb96067ab8def27398de18479f8ad2823b5aa3408d4fb50fcc3226b
Instruction Fuzzy Hash: FCD1B171A087518FC315CE28C58426BFBE1AFD5304F088A7EE9D9A73D2D278D945CB86

Function 0040DFC0 Relevance: 7.8, Strings: 6, Instructions: 312COMMON

Download Yara Rule

Strings

Xf, xrefs: 0040E28A
_V, xrefs: 0040E292
[l, xrefs: 0040E29A
#e, xrefs: 0040E282
, xrefs: 0040E213, 0040E21B
D, xrefs: 0040E1EC

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: #e$D$Xf$[l$_V$
API String ID: 0-3536235331
Opcode ID: 67262b1051dd673af7e239b98ac4f8c439d4e2c351219076c9ca7b849ba843ec
Instruction ID: 1761856c2a82565d78c4bf05444e2d9e5f9ae0245f81a3f62c8a9502a39ae87c
Opcode Fuzzy Hash: 67262b1051dd673af7e239b98ac4f8c439d4e2c351219076c9ca7b849ba843ec
Instruction Fuzzy Hash: D6C113B450C3809BD311EF55D584A2FBBF8AB96704F140D2DE1C4AB292C779D918CBAB

Function 004012F2 Relevance: 7.2, Strings: 5, Instructions: 925COMMON

Download Yara Rule

Strings

0, xrefs: 00401EC3
0, xrefs: 00402595
@, xrefs: 0040276D
i, xrefs: 00402A16
0, xrefs: 00401E91

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 4edeaa5b93483764b9d6a388038abc3ace40cc9d88d1d2ffe131e48266618e72
Instruction ID: c1b2f36e857e21a3adf8d70cb624002cf2f3473e490e7fe7e2f4c6f4f87173b2
Opcode Fuzzy Hash: 4edeaa5b93483764b9d6a388038abc3ace40cc9d88d1d2ffe131e48266618e72
Instruction Fuzzy Hash: C062E271A083518FD318CE28C68476BBBE1AF85704F14893EE8D9A73D1D678DD45CB8A

Function 0042D295 Relevance: 5.7, Strings: 4, Instructions: 727COMMON

Download Yara Rule

Strings

['r!, xrefs: 0042D6C3, 0042D6CB
rB, xrefs: 0042E065
hk, xrefs: 0042D6A4
", xrefs: 0042DF71

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: "$['r!$hk$rB
API String ID: 0-1682562665
Opcode ID: 0e6463dd2a01415b111909c7c3e1d0977b6b7ce78372913de24c2d6c2f1a41c6
Instruction ID: b4c2d6d6ba26f63a79bf277c57a7f133fb0ab336795b84b6f6cd2d81b95e67fd
Opcode Fuzzy Hash: 0e6463dd2a01415b111909c7c3e1d0977b6b7ce78372913de24c2d6c2f1a41c6
Instruction Fuzzy Hash: 5D42E2B1A08350CFD310DF29D89072BBBE2BF86314F544A2DE4959B3A2C779D905CB4A

Function 0042D4D4 Relevance: 5.7, Strings: 4, Instructions: 675COMMON

Download Yara Rule

Strings

['r!, xrefs: 0042D6C3, 0042D6CB
rB, xrefs: 0042E065
hk, xrefs: 0042D6A4
", xrefs: 0042DF71

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: "$['r!$hk$rB
API String ID: 0-1682562665
Opcode ID: 88f762bedf9fafaee3b9f48913d9a44c016105b9b4fbf06ee61f083eaedf4a66
Instruction ID: 9856a21ac58daef009a3e972bb09b36dda588f2d14b9a74063aefb32263dd0cb
Opcode Fuzzy Hash: 88f762bedf9fafaee3b9f48913d9a44c016105b9b4fbf06ee61f083eaedf4a66
Instruction Fuzzy Hash: 8E32F2B1A08390CFD310CF29D89072ABBE2BF86314F544A6DE4D59B3A2C779D905CB46

Function 0042C6E1 Relevance: 5.4, Strings: 4, Instructions: 430COMMON

Download Yara Rule

Strings

,[, xrefs: 0042CC08
KVQA, xrefs: 0042CBD8
OFH<, xrefs: 0042CBE0
1>%;, xrefs: 0042CBF8

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: ,[$1>%;$KVQA$OFH<
API String ID: 0-4269818227
Opcode ID: b71b651a47b6dfb0c3d8f82ff67fd01b2d929465fec70549e1dde3b3852a2f98
Instruction ID: b8f894667c65b4dd157318e3c21b91de949b37a2d4b7c1362151cae01adca53f
Opcode Fuzzy Hash: b71b651a47b6dfb0c3d8f82ff67fd01b2d929465fec70549e1dde3b3852a2f98
Instruction Fuzzy Hash: BFE10FB16083918BC710DF29E88072FBBE1AF96345F58496EF4C19B352C339D905CB9A

Function 0042E927 Relevance: 5.4, Strings: 4, Instructions: 426COMMON

Download Yara Rule

Strings

|8, xrefs: 0042EC1E
db, xrefs: 0042EC26
h, xrefs: 0042EC2E
bB, xrefs: 0042ED51

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: bB$db$h$|8
API String ID: 0-91127411
Opcode ID: deab92c9cbc9d9de2b1c1fe956664459c393dca9077f61ac2a7ba1243478d82d
Instruction ID: 896ada1ff1f034f350e592ef9e933001ddcc8871c35886f94cb3d41f898676cf
Opcode Fuzzy Hash: deab92c9cbc9d9de2b1c1fe956664459c393dca9077f61ac2a7ba1243478d82d
Instruction Fuzzy Hash: A1D199B0608341CFD7109F69E89166BBBF1BF96345F44492EE486873A2D339D805CB5A

Function 0040FC00 Relevance: 5.4, Strings: 4, Instructions: 384COMMON

Download Yara Rule

Strings

]Z, xrefs: 0040FF65
:;:9, xrefs: 0040FD5F
2, xrefs: 00410025
tw, xrefs: 0040FDD2

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: 2$:;:9$]Z$tw
API String ID: 0-793706539
Opcode ID: 6188e216cbeb179f24fc8e628abda167621527b7d1e0a154056f1a40f7c32dea
Instruction ID: 036747dbfc9a0d8c62192e74824560da54d6a4c1e3741b43f6b35547dc194d56
Opcode Fuzzy Hash: 6188e216cbeb179f24fc8e628abda167621527b7d1e0a154056f1a40f7c32dea
Instruction Fuzzy Hash: 53E177705083809BD311DF148590A5FBBE1AB96748F28482EF4C89B352D37AD989DB9B

Function 00427D03 Relevance: 5.3, Strings: 4, Instructions: 295COMMON

Download Yara Rule

Strings

~Cuq, xrefs: 00427E3C
'60, xrefs: 00427DDE
%*+(, xrefs: 00427D56
:04<, xrefs: 00427DD4

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: %*+($'60$:04<$~Cuq
API String ID: 0-2643050054
Opcode ID: 237d7b2a6b96ba4955b6a9243a7696b6daf2c5d7641eb66b414ab9290ffdf30c
Instruction ID: 49a9679fff2f7aff9eeb0649bb44144b187cb137392283ddcdfcdf80b45c828b
Opcode Fuzzy Hash: 237d7b2a6b96ba4955b6a9243a7696b6daf2c5d7641eb66b414ab9290ffdf30c
Instruction Fuzzy Hash: 0C91CE71E04268CBDB24CF99E840BAEBBB1FF45301F6484A9E855AB391DB349941CF64

Function 0042EE40 Relevance: 5.3, Strings: 4, Instructions: 256COMMON

Download Yara Rule

Strings

tk, xrefs: 0042EFF5
X[, xrefs: 0042EF03
sq, xrefs: 0042EFE5
U{y, xrefs: 0042EFFC

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: U{y$X[$tk$sq
API String ID: 0-2103365980
Opcode ID: 4b7a5d6ba5c3288a9d1afa90a90d86f5313d1c8d5784ef9a449c9005a09ef170
Instruction ID: 479a2e777bba1b133546996b6cbb3bc05e0ea32c95f0f30833b425fb4052de07
Opcode Fuzzy Hash: 4b7a5d6ba5c3288a9d1afa90a90d86f5313d1c8d5784ef9a449c9005a09ef170
Instruction Fuzzy Hash: A37199B45083908BD710DF15D890B2BBBF0FFA6744F94495DE4C89B3A2E3798944CB9A

Function 00444240 Relevance: 4.3, Strings: 3, Instructions: 596COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00444444, 0044444D
%*+(, xrefs: 004442A4, 004442AD
f, xrefs: 004443F8

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: %*+($%*+($f
API String ID: 0-498254078
Opcode ID: cbc4eced61f62f119027366424f1f7bb3403b554a8958e8fefac7d47202699e3
Instruction ID: 1a6dac30fe805108a966faffdc33822bf40150380eef598f7c6b625c5c123cfc
Opcode Fuzzy Hash: cbc4eced61f62f119027366424f1f7bb3403b554a8958e8fefac7d47202699e3
Instruction Fuzzy Hash: EF129B756083419BE714CF18C890B2BBBE1BBC9714F188A2EF99597392D339DC05CB96

Function 00420C4C Relevance: 4.1, Strings: 3, Instructions: 353COMMON

Download Yara Rule

Strings

)E4G, xrefs: 00420F3D
G9I;, xrefs: 00420F36
N=I?, xrefs: 00420F2F

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: )E4G$G9I;$N=I?
API String ID: 0-3615135358
Opcode ID: 128d32527ceb8ce6df3ee2bb62cf3c0f97c754dda77e12158d28d93f7bed1f7f
Instruction ID: 24387466f040e05a76eb43b91bc72ee0861cf682cad13a710ff6240ba0847933
Opcode Fuzzy Hash: 128d32527ceb8ce6df3ee2bb62cf3c0f97c754dda77e12158d28d93f7bed1f7f
Instruction Fuzzy Hash: E0B11475E00224CBCF208F54E8416AEB7F1FF59314F554529E885BB392E339E951CBA8

Function 0041D1D0 Relevance: 4.1, Strings: 3, Instructions: 332COMMON

Download Yara Rule

Strings

Ow, xrefs: 0041D467
%*+(, xrefs: 0041D5D7, 0041D5E6
rw, xrefs: 0041D45C

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: %*+($Ow$rw
API String ID: 0-1519177400
Opcode ID: fd96287aa3d4a93aa976985ac179b5453aeecac61c8dcf1c2ff8a14e243eabd3
Instruction ID: f23b6244d73a815b963dfababe9a6b12f4ce0309d7f7885e65b13b10d315b4cb
Opcode Fuzzy Hash: fd96287aa3d4a93aa976985ac179b5453aeecac61c8dcf1c2ff8a14e243eabd3
Instruction Fuzzy Hash: 4EB1C1B4508340DBD730DF54D881BABB7E5FF85314F044A2EF8899B292E7399890CB66

Function 00443DA0 Relevance: 4.0, Strings: 3, Instructions: 202COMMON

Download Yara Rule

Strings

%*(6, xrefs: 00443E60
0, xrefs: 00443F06
%*+(, xrefs: 00443F83, 00443F8B

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID: %*(6$%*+($0
API String ID: 2994545307-3473288163
Opcode ID: 0077517d808b134969c0a61bd93b8cb893cfed0329f65ac13bc8b8bfc8004041
Instruction ID: e9680ad2f9f8eb96964dc97cff5cf50a58ca1cd9ebcea699be840100c7839991
Opcode Fuzzy Hash: 0077517d808b134969c0a61bd93b8cb893cfed0329f65ac13bc8b8bfc8004041
Instruction Fuzzy Hash: 667153B4609340ABE714DF09D890B2BBBF5FB89705F64481EF88587381C739E914CB96

Function 00446BE5 Relevance: 3.9, Strings: 3, Instructions: 138COMMON

Download Yara Rule

Strings

&I, xrefs: 00446C44
wq, xrefs: 00446C74
[I, xrefs: 00446BCE

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: &I$[I$wq
API String ID: 0-4053064096
Opcode ID: ab1c5bca56f4b8d29862dd938c2cf0be91c4f3d54f419d971872d4bb5286f9f8
Instruction ID: 1fe5a67717864987b5b56f276fa3c3ec5c9c3a98a5f823a3a65e190a468f704a
Opcode Fuzzy Hash: ab1c5bca56f4b8d29862dd938c2cf0be91c4f3d54f419d971872d4bb5286f9f8
Instruction Fuzzy Hash: 6441D1B49042859FEB05CF54D5C046EBBB1FB07316B25485EE882EB257C338DE12CB6A

Function 00433F92 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 258libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(C15BC75B,00000000,00000800), ref: 00433F6E

Strings

u}|, xrefs: 004340BC

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID: LibraryLoad
String ID: u}|
API String ID: 1029625771-2851992303
Opcode ID: ce68ba67ca8f733b544a0100011ff25e7e27cf4692d08a45cf3ce3330b8fdfd1
Instruction ID: f9190f88e36dfb6965098df4861525961f7f17c5ea778a06d28252cdd58d4410
Opcode Fuzzy Hash: ce68ba67ca8f733b544a0100011ff25e7e27cf4692d08a45cf3ce3330b8fdfd1
Instruction Fuzzy Hash: 42818370104B408AD7B18B358494BE3BBE4BF1A704F44985DE4EF9B282DF39B449CB55

Function 00433BFE Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 248libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(C15BC75B,00000000,00000800), ref: 00433F39

Strings

u}|, xrefs: 00433D2C

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID: LibraryLoad
String ID: u}|
API String ID: 1029625771-2851992303
Opcode ID: 78bc8ec8a3cdcad72556845b164331c21d5f2c6ee381d91a938ff75e3227c4fc
Instruction ID: 2bae18b7b44f6fec5e9c5cbfeb64c4ebb28a725739c8ed80fc195fa07bb6389e
Opcode Fuzzy Hash: 78bc8ec8a3cdcad72556845b164331c21d5f2c6ee381d91a938ff75e3227c4fc
Instruction Fuzzy Hash: 45818070404B808AD7B18F358490BE3BBE4BF1A705F84985DE4EF9B282CF39A549CB55

Function 0041508C Relevance: 3.4, Strings: 2, Instructions: 940COMMON

Download Yara Rule

Strings

{q, xrefs: 004159E4
}[A, xrefs: 004156AB

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: {q$}[A
API String ID: 0-1064870701
Opcode ID: 2f2515f5c2b7ffa030d83e9c0e28046b561606187bb51ab8c29fd2ab7d8c9eed
Instruction ID: 03a1573f7b603ce9b1292b23f8fedd44f9dc0fc8fe92b0099f73fd474fbc992e
Opcode Fuzzy Hash: 2f2515f5c2b7ffa030d83e9c0e28046b561606187bb51ab8c29fd2ab7d8c9eed
Instruction Fuzzy Hash: F252AE75908780DBD705DF64D880AAFFBE5AFC6348F08492EF48993251E778D884CB5A

Function 00403780 Relevance: 2.9, Strings: 2, Instructions: 417COMMON

Download Yara Rule

Strings

NaN, xrefs: 004037DE
Inf, xrefs: 004037D7

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: 6767733b9d464330a70aefdc8cfb6ac49b1bf2eade0196f6ebfe0eff0bc5d5a4
Instruction ID: 5750af31710b7be396716ece945ac45430cfc578f763f0feedc63731ac078348
Opcode Fuzzy Hash: 6767733b9d464330a70aefdc8cfb6ac49b1bf2eade0196f6ebfe0eff0bc5d5a4
Instruction Fuzzy Hash: B0D1C472A083019BC704DF28C88061BBBE9EBC4755F158A3EF899A73D1E775DD058B86

Function 004480A0 Relevance: 2.9, Strings: 2, Instructions: 402COMMON

Download Yara Rule

Strings

P, xrefs: 00448246
=:;8, xrefs: 004483B3, 004483BB

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: =:;8$P
API String ID: 0-1969647149
Opcode ID: 28344b5c60bda21f0bdc4bc70e267d48a748ae1c3a8308a950d15832200931b9
Instruction ID: 1e8b8bdf2a542f3e92cbfeb44d373b524065b8f6be8065c92f9e99662059e54e
Opcode Fuzzy Hash: 28344b5c60bda21f0bdc4bc70e267d48a748ae1c3a8308a950d15832200931b9
Instruction Fuzzy Hash: D5D137729083604FD725CE18989071FB6E1EB85718F15863DE8B6AB380DB79DC06C7C6

Function 00447820 Relevance: 2.8, Strings: 2, Instructions: 294COMMON

Download Yara Rule

Strings

=:;8, xrefs: 004479F4, 004479FD
=:;8, xrefs: 00447864, 00447870

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID: =:;8$=:;8
API String ID: 2994545307-1685821102
Opcode ID: a35135be9c919232384bd6e671b4d0dbb1517dda334c2e6cc566ffdaaec23ecd
Instruction ID: a91d2e0b5a23a234b07f9e31dec56dce6f6508cc96fc8eb6b4ab80176d214a42
Opcode Fuzzy Hash: a35135be9c919232384bd6e671b4d0dbb1517dda334c2e6cc566ffdaaec23ecd
Instruction Fuzzy Hash: 30A1AD71608340ABF720DB15CC80B6BB7E6EB85354F544C2EF98597392E734E942CB9A

Function 00429140 Relevance: 2.6, Strings: 2, Instructions: 141COMMON

Download Yara Rule

Strings

hk, xrefs: 004291C5
['e!, xrefs: 004291E3, 004291EB

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: ['e!$hk
API String ID: 0-2806763672
Opcode ID: 821deb910ea2da8005630f1794a8280b095369fb597dab505a02391f5c0c19bc
Instruction ID: c1309e704af3fc6eb13b08a1d19bf67029931396b96b62dd5e576af40f11d1b1
Opcode Fuzzy Hash: 821deb910ea2da8005630f1794a8280b095369fb597dab505a02391f5c0c19bc
Instruction Fuzzy Hash: 9A5111B450C384AFD300EF15D984A1EBBF8AB96748F94890DF1D59B251C37999088BA7

Function 00444040 Relevance: 2.6, Strings: 2, Instructions: 136COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00444133, 0044413B
uxVd, xrefs: 00444170

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: %*+($uxVd
API String ID: 0-4108384496
Opcode ID: d571fb84001a311b27c760ae5d4fc1bc14b38e726fca36176443eb68829bf1b9
Instruction ID: 05da06c2397de99a335579e432a13c5a0717f8861c3235bd1ab541de5fa57fe6
Opcode Fuzzy Hash: d571fb84001a311b27c760ae5d4fc1bc14b38e726fca36176443eb68829bf1b9
Instruction Fuzzy Hash: E341EF71508204EBEB20DF54DC45B2BBBA6EFD5301F14842EEA8593351D73AEC60DB5A

Function 00449D20 Relevance: 2.6, Strings: 2, Instructions: 102COMMON

Download Yara Rule

Strings

@, xrefs: 00449D88
=:;8, xrefs: 00449DD3, 00449DDB

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID: =:;8$@
API String ID: 2994545307-1758559817
Opcode ID: 3708f71c43ed80b5337cd89b4e6d032253459fb3c81ad0b230c899547dae0e26
Instruction ID: 7748d085d769de4df17560be8deaa0b9b868d3d977420cebb3d28721fc94e744
Opcode Fuzzy Hash: 3708f71c43ed80b5337cd89b4e6d032253459fb3c81ad0b230c899547dae0e26
Instruction Fuzzy Hash: 9C319C719083048BD314DF54D881A2BFBF5EF89305F14892DE59897391D379D904CB9A

Function 00446C5A Relevance: 2.6, Strings: 2, Instructions: 91COMMON

Download Yara Rule

Strings

&I, xrefs: 00446C44
wq, xrefs: 00446C74

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: &I$wq
API String ID: 0-356460525
Opcode ID: d293ce42fe70478f230bdb60bfccd220a3009f50ea123d14ca5dee4218630023
Instruction ID: c606a23a42dd016db69cca957979e520dbc8919df0b1a6e5504e9e4409553baa
Opcode Fuzzy Hash: d293ce42fe70478f230bdb60bfccd220a3009f50ea123d14ca5dee4218630023
Instruction Fuzzy Hash: D6318D749012458BDF04CF95C5C45AEBB71FB12326B644489D841AF35BC3389A12CB7A

Function 0042A280 Relevance: 2.6, Strings: 2, Instructions: 78COMMON

Download Yara Rule

Strings

<>, xrefs: 0042A290
8:, xrefs: 0042A298

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: 8:$<>
API String ID: 0-2607517028
Opcode ID: f191b6225047ce9ac79211f89af6dbe54f23a12f9d7d45ec6ab146bc94458933
Instruction ID: 0e3f2d000814e27ebf642ea3fc307db00a563544b109cb512792b31d20cb6d2e
Opcode Fuzzy Hash: f191b6225047ce9ac79211f89af6dbe54f23a12f9d7d45ec6ab146bc94458933
Instruction Fuzzy Hash: 8C2147785093918AC7308F20E5007ABB7F1FF82745FA4595EE8C89B254EB38C951CB9B

Function 00405320 Relevance: 1.8, Strings: 1, Instructions: 565COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 004056E0

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: dd6a7eb2d0d7bbb63a615d1e3754048cbe5650e35b3cbbf375799f2681c3fbff
Instruction ID: 9e7591791ad0f454e87cde0222c78f12d4fd32dc9f84a582a68d41016156be40
Opcode Fuzzy Hash: dd6a7eb2d0d7bbb63a615d1e3754048cbe5650e35b3cbbf375799f2681c3fbff
Instruction Fuzzy Hash: EB1206B5A04B418BD7248E14D480327BBA2EFA1314F19857FD8996B3D1E379DC05CF4A

Function 00426FF0 Relevance: 1.7, APIs: 1, Instructions: 242comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0044CB80,00000000,00000001,0044CB70), ref: 00427019

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: ec27573f70f5e747fdf06321336757e1522e122a1f082b3c8c64d933f0084cb7
Instruction ID: 1dd9ba42d1134c331707e76eb789f7df9472961eee14d6a098fc4a49939699d2
Opcode Fuzzy Hash: ec27573f70f5e747fdf06321336757e1522e122a1f082b3c8c64d933f0084cb7
Instruction Fuzzy Hash: C551E0B17083209BDB209B24EC86B7733B4EF86758F444559F985CB391E379E805C76A

Function 0042B830 Relevance: 1.7, Strings: 1, Instructions: 457COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0042BB44, 0042BB4D

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 887bcb71e6d876f3e014cf56117bb170a8e51405aadb3a0b295df84bfe238741
Instruction ID: f9febf01f33fa36a7d1ddb789204e0492b300cd01202f1c206ecb09263a886c3
Opcode Fuzzy Hash: 887bcb71e6d876f3e014cf56117bb170a8e51405aadb3a0b295df84bfe238741
Instruction Fuzzy Hash: E7F188B4518344DFE3209F19E841B2BBBF5FB8A705F94882DF58887262D735D814CB9A

Function 00430590 Relevance: 1.7, Strings: 1, Instructions: 426COMMON

Download Yara Rule

Strings

", xrefs: 0043088E

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 8a10a5681b2d5c1321d14bc6849af6036fd86266613414d189da376854f8adda
Instruction ID: a7ce59651d0f1017d8e90d6f75074ff501fb05f5f21ec41f2c7a0edceb7c194d
Opcode Fuzzy Hash: 8a10a5681b2d5c1321d14bc6849af6036fd86266613414d189da376854f8adda
Instruction Fuzzy Hash: 11D116B2A043045BD724DE25D4A176FB7D5AF98310F19972FE89A87382D73CDC048B96

Function 0042A3A8 Relevance: 1.7, Strings: 1, Instructions: 413COMMON

Download Yara Rule

Strings

01, xrefs: 0042A56F

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: 01
API String ID: 0-3477152822
Opcode ID: 674cb8e8adf0315d6a6fffb6ac0f4a13a69d8baabf21808da83b8701c7c45dbe
Instruction ID: 7e134364cd7e184ee4634b8f381546ae3e067e8cf23b76fa9936b622e07eefea
Opcode Fuzzy Hash: 674cb8e8adf0315d6a6fffb6ac0f4a13a69d8baabf21808da83b8701c7c45dbe
Instruction Fuzzy Hash: 4FD1BD71A083228BC314DF24E58062BB3F2FF85B45F948D1DE8C597251E738D965CB9A

Function 0042F1B0 Relevance: 1.6, Strings: 1, Instructions: 337COMMON

Download Yara Rule

Strings

c5V3, xrefs: 0042F2FD

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: c5V3
API String ID: 0-2034645838
Opcode ID: 41b5bee89015c9d7273252287537bd235302f0ec3de3bbfb0e4c2616ac2d136d
Instruction ID: 53da8b907d0e7fd06adce62e70ed86e252d15535f9b3330e2a1b3c94f45f4202
Opcode Fuzzy Hash: 41b5bee89015c9d7273252287537bd235302f0ec3de3bbfb0e4c2616ac2d136d
Instruction Fuzzy Hash: B5C1A9B0508351EBD310DF25E88062BBBF4EF8A745F940D2DE5D09B262D339D849CB9A

Function 00433335 Relevance: 1.5, Strings: 1, Instructions: 298COMMON

Download Yara Rule

Strings

53C, xrefs: 00432C41, 00432EAC, 00432EB5
*&- , xrefs: 00431C11
*XJe, xrefs: 00432947
JX`b, xrefs: 00432ACE
w[Nc, xrefs: 0043169A
]h>l, xrefs: 004334AF
:\Bz, xrefs: 00431FF4
avqy, xrefs: 00431E1A
WXM,, xrefs: 00431861

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: *&- $*XJe$53C$:\Bz$JX`b$WXM,$]h>l$avqy$w[Nc
API String ID: 0-2470705936
Opcode ID: 24524302bc7e1c2d4906d3de34d7e6b3f5bcfbafb4094b9b0bee2a8fe50574e8
Instruction ID: 06cb31238f2708f74529d9e64c999bfe1108be11ab1fcac4888e2b6564f48832
Opcode Fuzzy Hash: 24524302bc7e1c2d4906d3de34d7e6b3f5bcfbafb4094b9b0bee2a8fe50574e8
Instruction Fuzzy Hash: 79A18C70508B908ED7B6CF3984907E3BBE0AF1A705F44985ED4EB87382DB39A549CB54

Function 004486E0 Relevance: 1.5, Strings: 1, Instructions: 282COMMON

Download Yara Rule

Strings

;:9, xrefs: 00448703, 0044870B

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: ;:9
API String ID: 0-2043501942
Opcode ID: d97c8967657955cd276d75c2220febe862feceba931881bd9131a1eb9477a50b
Instruction ID: 166ecc30c5c5a5a7167127fa5737624ab005f046829d42ae61d4228b8a6f3c35
Opcode Fuzzy Hash: d97c8967657955cd276d75c2220febe862feceba931881bd9131a1eb9477a50b
Instruction Fuzzy Hash: 8B91DE35608301CFD704DF68E89462AB3F1FB9931AF1A887DD5C58B262D735E8A0DB85

Function 0040ABD0 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 0040AD06

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 131505312b1bb27240f6dfea1676a2032a3f3cfce7b42a5a030031ec475c37fa
Instruction ID: 0d3a0fd5714317418c3eb196ea8662ca4d558a8104d2ea2566d1d9a8add1c3b8
Opcode Fuzzy Hash: 131505312b1bb27240f6dfea1676a2032a3f3cfce7b42a5a030031ec475c37fa
Instruction Fuzzy Hash: 23B128711093819FD321CF28C88461BBBE0AFA9704F484A6DE5D997782D635E918CBA7

Function 00436820 Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

u, xrefs: 00436968

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: u
API String ID: 0-4067256894
Opcode ID: 94b029f3c60ce75e62be44490500d877d2167121d91c2291b73e7ba48a2c5e0e
Instruction ID: 68ec843625a05ae49eae94000774ad56e911688258ea5f3b4ebefd13b221d55d
Opcode Fuzzy Hash: 94b029f3c60ce75e62be44490500d877d2167121d91c2291b73e7ba48a2c5e0e
Instruction Fuzzy Hash: E0813B3660A6825BD3186A3C8C5236BBA934FDB334F2ED76FD4F1873E1D56988028355

Function 00438210 Relevance: 1.5, Strings: 1, Instructions: 211COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 004383AF

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: f98e4125642b6f7303aa62eec2f0332706fb531fa66a8e9c4ef2ae392f571223
Instruction ID: afe642b493d438ff6f411e546c264eb9921c7e99f8502b6c9c7e09c9db7d701f
Opcode Fuzzy Hash: f98e4125642b6f7303aa62eec2f0332706fb531fa66a8e9c4ef2ae392f571223
Instruction Fuzzy Hash: AB617E37A097A147C7144A3C5C902A6EA421B9B330F3D93BFFCB19B3D1C9598C06439A

Function 00444C90 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00444CC3, 00444CCB

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 07c16a6ef3fe6f820211a56e88c2e791172652be10c3ec7f67f1fdbf28740199
Instruction ID: 11df42af5caca9a72f970213e677b6119b7b450c67af953d7501706f7e9fc4bc
Opcode Fuzzy Hash: 07c16a6ef3fe6f820211a56e88c2e791172652be10c3ec7f67f1fdbf28740199
Instruction Fuzzy Hash: 7261D070A083419BF715DF14C880B2BBBE6FBC5305F28892EE58587392C739E811CB1A

Function 0043F4E0 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

%*+( C, xrefs: 0043F503, 0043F50B

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+( C
API String ID: 2994545307-954077416
Opcode ID: be922c0c939adc15175b50bb0660fc841a115826d8249c1c4825361db5d4de66
Instruction ID: 7d8234139b4eac5119e5410618e58e09199086dd3060237d38e04b2fd45e5bbf
Opcode Fuzzy Hash: be922c0c939adc15175b50bb0660fc841a115826d8249c1c4825361db5d4de66
Instruction Fuzzy Hash: A751F774A09300ABD715AF14C990A3FF7E6EB49301F58982DE4C583362D334DC15CB5A

Function 00447630 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

=:;8, xrefs: 004476D3, 004476DB

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: =:;8
API String ID: 0-508151936
Opcode ID: 54dd48c072afd03b892454620e1bfa117142463bc0d3358ed4961d22c0e2c537
Instruction ID: f53b1cf1d2d43ff6166c1cf3a92ff21f60dfaf417fc550a19b6e158e7f211dc2
Opcode Fuzzy Hash: 54dd48c072afd03b892454620e1bfa117142463bc0d3358ed4961d22c0e2c537
Instruction Fuzzy Hash: 6551387160C3009BE714AA18CC90B2FB7E2FB85355F688A2DE9D557392D335EC12C75A

Function 00428472 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

%*+(, xrefs: 004284E6

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: c229e05f35e7c4b4cdeb9b76f30375a976e6b8e08d527192388afd39e4f33a85
Instruction ID: 6c7052a7ca44585b34384a6096d7f96d95edd8748b8cce9ea63459a4869a42d4
Opcode Fuzzy Hash: c229e05f35e7c4b4cdeb9b76f30375a976e6b8e08d527192388afd39e4f33a85
Instruction Fuzzy Hash: 6A51B039A01226CFDB04CF58DC91BADB7B2FF88301F1884B9D905AB282C775E951CB54

Function 00443B60 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00443C13, 00443C1B

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 281d42262116a6846f27f4ac80bfbbe8ec96dc12998bac32fe8126af14675107
Instruction ID: f12b6d9916bf27ae298f80edd43f87298b307b2ef20082737f3276c392ad6ab7
Opcode Fuzzy Hash: 281d42262116a6846f27f4ac80bfbbe8ec96dc12998bac32fe8126af14675107
Instruction Fuzzy Hash: 4A41A1756083409BEB249F15D990A2BB7E5EF85B06F14882EE4C597352C339EE10CB16

Function 00415E11 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

R_A, xrefs: 00415F43

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: R_A
API String ID: 0-2894140241
Opcode ID: 855d8a104527a6a22150e8fec24d1a556a90c03b99cb0bcb1a08bb1d239c8c8d
Instruction ID: ec5b3addcea719a6fcf74cd29254c95d7c148a3c106f125ae26d6e5b54084fb4
Opcode Fuzzy Hash: 855d8a104527a6a22150e8fec24d1a556a90c03b99cb0bcb1a08bb1d239c8c8d
Instruction Fuzzy Hash: 90411676908310DFDB109F20DC417AA77E5AFC6314F04493DF49AA7391E739D945878A

Function 00449A10 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

=:;8, xrefs: 00449A44, 00449A4D

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: =:;8
API String ID: 0-508151936
Opcode ID: 252199f6b865f99cd35cc75fed087e4e72d4e37f0220f0a6ac4012d7f4c8ead0
Instruction ID: 05a97aee27dffb00dbd51095f055f4dfe11aa80a2f7f1c92f31228a217469a40
Opcode Fuzzy Hash: 252199f6b865f99cd35cc75fed087e4e72d4e37f0220f0a6ac4012d7f4c8ead0
Instruction Fuzzy Hash: 0741AD34608340ABE7149F15ED90B2FB7A6FB85714F24882EF48997352D338EC10EB5A

Function 00449BA0 Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

=:;8, xrefs: 00449BD4, 00449BDD

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: =:;8
API String ID: 0-508151936
Opcode ID: 885c6c10047bc4ed0b570366a3fb4b3bebb2772f983fa8e19c40e832167c6665
Instruction ID: 759e4d3430cde1113ce86e8a34bb78e59f8996fcf463a934eed28b76126d2c1c
Opcode Fuzzy Hash: 885c6c10047bc4ed0b570366a3fb4b3bebb2772f983fa8e19c40e832167c6665
Instruction Fuzzy Hash: 5F41AE74608300ABE7149F15D9D0B2BB7E6EB85715F24882DF4899B392D339EC10DB5A

Function 0041D672 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0041D777, 0041D786

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 733a2dbd1cf4672a115e637de9dafb62a3098bf24dbbcf4e5888588c2816f7c5
Instruction ID: d6c46c66ae9e6c5d1d19b663e2ea9136945d175d09991c158c64094f61309ff6
Opcode Fuzzy Hash: 733a2dbd1cf4672a115e637de9dafb62a3098bf24dbbcf4e5888588c2816f7c5
Instruction Fuzzy Hash: 2041CEB5908340DFE7209F14DC00BABB3E1FB85705F45482EE888D7292E739D8A0CB46

Function 0041F1D6 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0041F217, 0041F226

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 4ecaa68750894424e067e98bf0d20a1b22babd46e09aa345b509e8e24610b141
Instruction ID: a6c9ce00cba962c7c3dada17f7fdb58dfd8cba5fbe56f3e409aa767892d6adfc
Opcode Fuzzy Hash: 4ecaa68750894424e067e98bf0d20a1b22babd46e09aa345b509e8e24610b141
Instruction Fuzzy Hash: DF21A1756087418FC724DF50D8407ABB3A3FBC5342F998A2DE0889B241EB35E995CB5A

Function 0041D733 Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0041D777, 0041D786

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: b48c7630343390b3a8e9737404bf7ddddcf45d4d8cc301cdf950801ecadfe327
Instruction ID: 467a029f645a2142064093daf3857129aa1f7519d3d2f2b5e9473d916f879c2c
Opcode Fuzzy Hash: b48c7630343390b3a8e9737404bf7ddddcf45d4d8cc301cdf950801ecadfe327
Instruction Fuzzy Hash: EF115BB49093908BD7208F5494407ABB7E2BB85305F59492EE48DA7281D739D890CB5A

Function 00416319 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

*:, xrefs: 00416319

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: *:
API String ID: 0-3904767845
Opcode ID: 317a3e2dbef9a5b92eb774d5d7bc237b065a66ea56b3334d113ad8a41e243999
Instruction ID: b7f778086449c3eb0137174c245c1d9e42db36ab03648f51802886adca72a67a
Opcode Fuzzy Hash: 317a3e2dbef9a5b92eb774d5d7bc237b065a66ea56b3334d113ad8a41e243999
Instruction Fuzzy Hash: 7C0162314083808BD3109B54D455B6BF7F4FF8A308F080A2EE5C9B7292D338D6048B2B

Function 0040C210 Relevance: .8, Instructions: 831COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd26393617856e3c2acf54515b9dd5ddd27122736f2a2b69c35036bece5926b
Instruction ID: 179032f12f22df4b8eb37ecbda361d27a15dad5cbb10d81a9cca6dc2c1375ba5
Opcode Fuzzy Hash: 5fd26393617856e3c2acf54515b9dd5ddd27122736f2a2b69c35036bece5926b
Instruction Fuzzy Hash: E842D532A04725CBC7249F18D8C026BB3E1FFD4315F158B3ED996A72C1D738A9558B8A

Function 0040B700 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f92698deaff8939c339fccb0f6a3cc66705d472c08b73d3bd7e991e7649a8ee
Instruction ID: 2f79066177d34c8e895ea1b2e84f5c690b05b2b1254f0cdf5d6c225214919f47
Opcode Fuzzy Hash: 8f92698deaff8939c339fccb0f6a3cc66705d472c08b73d3bd7e991e7649a8ee
Instruction Fuzzy Hash: 2F529070A087848FEB358B24C4847A7BBE1EB91314F14493ED5E656BC6C37DA885CB8D

Function 004073D0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37804d0beffa80cf22a95da8fb3c7ddbc735901a0654d68907e0afcfec5e073f
Instruction ID: 7e7a3d20024d16f2f1ec0159e87d0553ddb1ba7e41c287eb9bd16d3c1bf9a147
Opcode Fuzzy Hash: 37804d0beffa80cf22a95da8fb3c7ddbc735901a0654d68907e0afcfec5e073f
Instruction Fuzzy Hash: 1A52C27190C3458FCB15CF18C0906AABBE1FF89314F18897EE89967381D778E949CB86

Function 00407DD0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45b6ecd5fba9f7a55768fb7de1a0358b410302586bb6fd790ad3ec88ecfc0687
Instruction ID: 38d2d3b7ba493b0d29d8285af648369fe573881a89b1f301cef14c62c1dcf11c
Opcode Fuzzy Hash: 45b6ecd5fba9f7a55768fb7de1a0358b410302586bb6fd790ad3ec88ecfc0687
Instruction Fuzzy Hash: 84321370914B118FC368CF29C69052ABBF1BF85710B604A2ED6D797B90DB3AB845CB18

Function 00448BE0 Relevance: .5, Instructions: 541COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fe54cdf1ecdaec582b565a461110b8162f9ddcb61d1fb0a2152f14216461e9a
Instruction ID: a40ff6c43f9f244f78c5a82676b7b6b98954f686d4d278fac8d9b223ff6f4173
Opcode Fuzzy Hash: 8fe54cdf1ecdaec582b565a461110b8162f9ddcb61d1fb0a2152f14216461e9a
Instruction Fuzzy Hash: C8F1BE3560D340DFD708DF28D89062EB7E2FB8A305F19896DE9898B392C739D854CB56

Function 0040A680 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5399b1bb572af801badaa37716df09e2c6aff5af66002a532ad583c85112ac44
Instruction ID: 7990fb29706556707dde4fd5fad898feee0c51d8f3dfd2d56199bf50cbec7d80
Opcode Fuzzy Hash: 5399b1bb572af801badaa37716df09e2c6aff5af66002a532ad583c85112ac44
Instruction Fuzzy Hash: F4F1D0356083418FC724CF29C88166BFBE2EFD9304F08892EE5D587791E679E854CB96

Function 00427250 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11636e97cc9e1b13f5c9c812d885e02fcaf38fb5c399c1e31036fbb801fa8f76
Instruction ID: 0cdddc02200e710996c9f464b2c0e16f8fae38d8edd5e86623daa92770803a83
Opcode Fuzzy Hash: 11636e97cc9e1b13f5c9c812d885e02fcaf38fb5c399c1e31036fbb801fa8f76
Instruction Fuzzy Hash: 33C1C07160C2209BD711EF15E841A2BB7F1EF96314F48481EF8C59B352E339D954CBAA

Function 0040CF10 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a16511359572a211e44db4d017724f983ed57499440677c537153cc7e8df251
Instruction ID: d1dc7cc3517d3da3b7596efd16a34da9a0b9da04abc1e7c3f9beb679c80cb8db
Opcode Fuzzy Hash: 6a16511359572a211e44db4d017724f983ed57499440677c537153cc7e8df251
Instruction Fuzzy Hash: B9D11A71E083454BC3148E69D8D025BB7E3EBC1324F19C63EE8A55B3D5D67C9D0A8B86

Function 00447BE0 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f218593850381a6470916a938c8b175638f7679d89ee5ca95996b180ea1f7b8
Instruction ID: c9e57fddc4b5059fee863ebfc4717d9e4b53c487b5aa1af8129d73eb291600a5
Opcode Fuzzy Hash: 9f218593850381a6470916a938c8b175638f7679d89ee5ca95996b180ea1f7b8
Instruction Fuzzy Hash: 46A105B1A0C3505BF7209F29CC84B2BB7E5EF85314F18492EE99897352E739DC068796

Function 00416866 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d113d7714e9cf4a71358f343ff61d6d616e238023072c940eb22c9515d8f64a4
Instruction ID: 198fbd16f1d85bd402acf33399e9c59ac2efad4e2ff8bddcaaed117cf40b1fea
Opcode Fuzzy Hash: d113d7714e9cf4a71358f343ff61d6d616e238023072c940eb22c9515d8f64a4
Instruction Fuzzy Hash: 5AB136754183809BD310DB54D880B6FFBE4BF86308F55492EF48997292E779D888CB6B

Function 0040B270 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c48c829b0cf2cbc4580a6ff7763ab4075973b40cc397e4fccb5515b17566094a
Instruction ID: 0234ceb963d8a02704c1e57bcfff9fe46afb523a25e9fe19499d52599f9026f9
Opcode Fuzzy Hash: c48c829b0cf2cbc4580a6ff7763ab4075973b40cc397e4fccb5515b17566094a
Instruction Fuzzy Hash: CDC14AB29487418FC360CF28DC96BABB7E1EF85318F08492DD1D9D6342E778A155CB4A

Function 00448F50 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a94fd9aed8d6464f93a3c7e3c01e75f9f85fb14a496f472ed7380c30d0412349
Instruction ID: d1856f2df7b17df036322d035787986b50e5d5ead949585b24561e3f96d87a88
Opcode Fuzzy Hash: a94fd9aed8d6464f93a3c7e3c01e75f9f85fb14a496f472ed7380c30d0412349
Instruction Fuzzy Hash: 00718C346083409FD704DF28D99062EB7E6EF8A715F08886DE9C98B352D339DC54DB56

Function 0040937E Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0ef1785d72f85255e1e48e5b08f02b99cae4b70ce7c4ddbeaeeac40e331766d
Instruction ID: da4701f7a8a59232985f5eb7826d161c8a40ede4280be22fc3981c3486a237f8
Opcode Fuzzy Hash: b0ef1785d72f85255e1e48e5b08f02b99cae4b70ce7c4ddbeaeeac40e331766d
Instruction Fuzzy Hash: AEB1AB79208201CFD708CF25D86076A7BE1FB89355F18897DE84687391D738D986CF85

Function 004214D3 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 784783a52b8a3d62a329717329e0ca1320d973b9daf5a27f063a18c6152c18b4
Instruction ID: af15282fea1b0d4e313f27ad5009ceaba83f809070ec496722640b7832397f3c
Opcode Fuzzy Hash: 784783a52b8a3d62a329717329e0ca1320d973b9daf5a27f063a18c6152c18b4
Instruction Fuzzy Hash: 29619AB0508350DBD311AF19E891A2BB7F0EFA2745F48495EF4C59B262E33AC911CB5B

Function 004214EA Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d99b82aa8ddc21967d82e361e1d2274e7ac84d13d086154e7058d46dc646937
Instruction ID: 7111a839e9d3c91cfaf48d60914ca5a6afb26961dd233a537396bda51b9bc6b6
Opcode Fuzzy Hash: 6d99b82aa8ddc21967d82e361e1d2274e7ac84d13d086154e7058d46dc646937
Instruction Fuzzy Hash: F461AAB0608350DBC311AF19E891A2BB7F0EFA2755F48495EF4C59B262D33AC911CB5B

Function 00416574 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e72aa7a498b2b9b2dfecdd60ee23e0f4f9d1c2478f50c3c5e971454d0b5e0c81
Instruction ID: ab1f1018790031ee9c7c10a6f7340843e4bf55e4f70f010004c05f7dbce76356
Opcode Fuzzy Hash: e72aa7a498b2b9b2dfecdd60ee23e0f4f9d1c2478f50c3c5e971454d0b5e0c81
Instruction Fuzzy Hash: F58148755083809BD310DB54D880BAFFBE4AF86308F154D1EE4D897291E7B9D888CB6A

Function 0042DB4B Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 270b97007977c48ba5376386b21794ec2fcb6a5a0464c1c1fc117d1d76f24f76
Instruction ID: 673c6b3bbbd53f9c22ccfe51b5a6f695aa7f56030b97dac0bd30af74e8f096ee
Opcode Fuzzy Hash: 270b97007977c48ba5376386b21794ec2fcb6a5a0464c1c1fc117d1d76f24f76
Instruction Fuzzy Hash: AD5119B3F047194FD714DE29DC9022AF7D2ABC4210F5A863DD9699B382EA78EC0587C1

Function 004365E0 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab142ebe5769f5d5514a8bc349562a83129f8e9972c3143ae3e22d1548ba5ff3
Instruction ID: b52e754ff7f7bdcd96bdcc20424ae0671895b43bfbd965ceef7946b1b7f15a2a
Opcode Fuzzy Hash: ab142ebe5769f5d5514a8bc349562a83129f8e9972c3143ae3e22d1548ba5ff3
Instruction Fuzzy Hash: D4516C2620E58257D7289A3C4C623B96A834FDB374F3ED72FD5B2873D1C61D4402431A

Function 0043EC60 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d531771b5ac3b43f583770d02df8f3e1e7f618f6241c98f58e7b1b724ce75ce4
Instruction ID: 855ce3d2ff55087a3fe446360c4d7d2d80b6ecc8f2b3d94c0b0b5af49f22110f
Opcode Fuzzy Hash: d531771b5ac3b43f583770d02df8f3e1e7f618f6241c98f58e7b1b724ce75ce4
Instruction Fuzzy Hash: 8E515CB15087548FE314DF29D49535BBBE1BBC8318F044E2EE4E987391E379DA088B86

Function 00406E30 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0173b49a01aa6f585f93fec65d7f76c73ce0402e069515b85d07bbe0d6abbdfc
Instruction ID: 3141c5b1859c4b1ed9a37be143eb06df05074a468c29e561fd46d3f232faac6f
Opcode Fuzzy Hash: 0173b49a01aa6f585f93fec65d7f76c73ce0402e069515b85d07bbe0d6abbdfc
Instruction Fuzzy Hash: 6A41E922B0C2764BC7149A7DCC5027ABAD64FC5214F1E837AE8CAEB7C6E5789C1053D9

Function 004210D0 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c978601841f293907c565e382e04f250fbca0c5c93ea7255ffc38724c8199d3e
Instruction ID: 5ce560d5a09dffc801b9713141ef514529169b63506e356245f8ffced50adb6c
Opcode Fuzzy Hash: c978601841f293907c565e382e04f250fbca0c5c93ea7255ffc38724c8199d3e
Instruction Fuzzy Hash: 9C418B70508350CBD310DF18D49192BB7F0FFA6398F548A4DE9959B3A1E779D900CBAA

Function 00405C00 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4845bcb268fc2781b429f43bf46a0691f6b833da9af978e253253a235040799
Instruction ID: b2cf4deca0400fd5fea032b1cbf3451fc825e2a6972d5773cf43d1f0e4f9a6e1
Opcode Fuzzy Hash: f4845bcb268fc2781b429f43bf46a0691f6b833da9af978e253253a235040799
Instruction Fuzzy Hash: E651F474A047019FC714EF14C884927B7A1FF85364F19867EE895AB392D634EC82CF9A

Function 00414294 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97271d1b3f9190eeeb81f7ee7b3d25e7ad10b551802a9f6f7667fd231b71bad1
Instruction ID: 1fa9bda1476f87c2b7c2d742166c8c66e8e3bde244159149de2697868e56f644
Opcode Fuzzy Hash: 97271d1b3f9190eeeb81f7ee7b3d25e7ad10b551802a9f6f7667fd231b71bad1
Instruction Fuzzy Hash: 734159B4519340AFD340AB54E895B2FFBF8AF86304F84982EF89493262D378D4448B5B

Function 00411B50 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3796caac5fdd386676789e274ac0dc37df04228f9ce286bec626a323ee5dadd6
Instruction ID: d2e36970f1c892e70df14f182262214d86bd21f705211d9b07ff0bfecf973f0c
Opcode Fuzzy Hash: 3796caac5fdd386676789e274ac0dc37df04228f9ce286bec626a323ee5dadd6
Instruction Fuzzy Hash: 514148767183A50BD31C8E398C9027ABAD19BC5210F1C873EF5A9C73E1E278C9469755

Function 0043F3F0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eacd6d1bf5d751a5555680712c2f55212fa993ee3a8942bad22234f372755002
Instruction ID: 06d10a4b4de30274cb44548cded22ac272b0d694c1138d0b659082ff5fb3f4d6
Opcode Fuzzy Hash: eacd6d1bf5d751a5555680712c2f55212fa993ee3a8942bad22234f372755002
Instruction Fuzzy Hash: 2421DA32D0812447C724DB5D8481437F7E8EBAE709F46A63FD98497354E3399C1487E5

Function 00404B50 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1df307a01abbd9b5bc72b41129330a4f31f536fd3ccda6bd26083d42a983f49
Instruction ID: a5158b58b2244923fb86fafe67f782213786cc440b683b09a74ffbffb31bf152
Opcode Fuzzy Hash: a1df307a01abbd9b5bc72b41129330a4f31f536fd3ccda6bd26083d42a983f49
Instruction Fuzzy Hash: 033186B16042009BD7149E19C880B27B7F5EBC4358F14497EE995A73C1D239ED52CB8A

Function 0041FBB1 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70600c00407f57af6e7643053d55f44008fab0a7a73b61f8498b268a0a0cf229
Instruction ID: 91403ada59c80af92606582a27bfd04c79c960a9323eabaa12cec6cf06ffbbe3
Opcode Fuzzy Hash: 70600c00407f57af6e7643053d55f44008fab0a7a73b61f8498b268a0a0cf229
Instruction Fuzzy Hash: 24210531408340CBD720CF94C451BABB7F0FF96754F04892EE8899B391E3788949DBAA

Function 00407020 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aeaf61510b2e2fb7d1f4a18c956008caba3bd124f0fc2ccdfa8a74b8507fd34
Instruction ID: 6e7d0bf59782c8caebc80d2b72e0ad35498567dc67d674abe8dec8484ce65258
Opcode Fuzzy Hash: 4aeaf61510b2e2fb7d1f4a18c956008caba3bd124f0fc2ccdfa8a74b8507fd34
Instruction Fuzzy Hash: EC11D337B186214BE758CF62D8E053B6352EB8A21170A423EDA47A73C2CE35F801D296

Function 0043B9F0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: c5baf626a9f3c5b1a7c090f6d1c513c9a0ee97e091346a677967a88c05ec2ffc
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 91115933A085D40EC3129D3C8400765BFA34A97234F28939AF4B99B3D2C7268D8B9398

Function 004300B0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78472cdc561be1de6c15c3ac03a752c4fe24ca9b76bcca51e62a2e1d5f513d67
Instruction ID: 53c5724289730483ebc0c5bc93c1b4bf7b37334cb8c9fa6a51b5d5afab51a243
Opcode Fuzzy Hash: 78472cdc561be1de6c15c3ac03a752c4fe24ca9b76bcca51e62a2e1d5f513d67
Instruction Fuzzy Hash: D401B5F160030147EB24AF15E5E172BB2B85F48B08F08563ED80967342DB7EEC05D2A9

Function 0040F917 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1bcba0e93c530db99497d0dd31ec127801fcab15647f511495840a2536ecd7a
Instruction ID: 2a81a8060df05c4008c8e77e79816bfc4091818ee5787bfc9394ef3a1bc5ed3c
Opcode Fuzzy Hash: c1bcba0e93c530db99497d0dd31ec127801fcab15647f511495840a2536ecd7a
Instruction Fuzzy Hash: 2511C471B16151DBEB258B299C50B7AB7B2BB87200F1C41BAD486F37D1D2388D4ACF18

Function 004432E0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35ebd33b0a868ece5fa81ca9ba613642357e870ac6f59d1c087c9d52aadc636
Instruction ID: 7d8a3e583e3a390d0d73e3dbf99091ecfc1539457756a91f7df3a6d319445fe4
Opcode Fuzzy Hash: c35ebd33b0a868ece5fa81ca9ba613642357e870ac6f59d1c087c9d52aadc636
Instruction Fuzzy Hash: 15014F72A295214B8B4CDD3D9C2116BBBD19B89730F1A8B3DBDFAD72E0D234C8454685

Function 0042DA0A Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a961ee417b28871150b9e187044014ce4bd566ab8900ee7e0e85f2a66936b54c
Instruction ID: 2b9d54a66263602e410f43730ca31820d9c094fe8c03107b6883f3cc5ab60285
Opcode Fuzzy Hash: a961ee417b28871150b9e187044014ce4bd566ab8900ee7e0e85f2a66936b54c
Instruction Fuzzy Hash: 5A013570A0C3108BD7049F16E940A2AF7F2FB8A709F545A6AE4C9A3311D334ED01CB4A

Function 0044518B Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc43853c1bb009c1c5ba99451afc509ed8dc5713007873379a3f344642e5803e
Instruction ID: bda9b97f036035324769e7dd4b14887e049c85eb035dd92431c513c92175563b
Opcode Fuzzy Hash: fc43853c1bb009c1c5ba99451afc509ed8dc5713007873379a3f344642e5803e
Instruction Fuzzy Hash: 9B01C0B09102418FEF00DFA8D98062F7BB1AB06305F584458D846BF347D334DA15CBBA

Function 004221A0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aee55f74cf63f0bcf27f2a94c64ef40f74351bc2f3e3d73a2157603e7e4e9e0
Instruction ID: 83bc2a0f4c6610ad6eb8d3716051e8fa586fbabdba77dfa71d291bffbc2af4af
Opcode Fuzzy Hash: 1aee55f74cf63f0bcf27f2a94c64ef40f74351bc2f3e3d73a2157603e7e4e9e0
Instruction Fuzzy Hash: 42014B72A195210B8748DE3C992212BBEE15B85330F168B2EBCFAD73E0D628CD144696

Function 00437557 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1dc1e08b16fd630728bc2975af4581e433f40acbf6d4bba23a0daa4976a0907
Instruction ID: 29d1843231586ffc13bd66906b31da83c21bf2e90f2034cb1871587f6d3e83ef
Opcode Fuzzy Hash: b1dc1e08b16fd630728bc2975af4581e433f40acbf6d4bba23a0daa4976a0907
Instruction Fuzzy Hash: B9F014F09142006EE704BA3CCE4AB377AECEB45218F00464CFCA9D72C5E37068188BE6

Function 0041B000 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b609d3f0c2804ff5dd618c8a20769add822df850d467d4e998f7a2218d14df
Instruction ID: 0639dadb1130b3f9d39aa2721587f05209e2ba5714bb3806ceb2dc41eb5cf330
Opcode Fuzzy Hash: 87b609d3f0c2804ff5dd618c8a20769add822df850d467d4e998f7a2218d14df
Instruction Fuzzy Hash: F3F0ECB170421057DB32CA55ECD0FB7BF9CCB8F354F191456E84557203E2695884C3E9

Function 004416A0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: f2014a84591d8b1651eb51c9cf32dc204f6f011b2e75e78e2ce1e1e92b8acb02
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 37D05B21508261476B64CD199400977F7F0EA87711B49555FF581D3258D634DC41C1AD

Function 0042A8A0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75bf4765cd6369d1d929975b4d005ae94e359678522ed3bc452efbf5d0c47e48
Instruction ID: d7331c652808e980a9ab1d83da08e8e6816827808003e54eab1ea1083092252d
Opcode Fuzzy Hash: 75bf4765cd6369d1d929975b4d005ae94e359678522ed3bc452efbf5d0c47e48
Instruction Fuzzy Hash: 90B002749482C0DBD504CF45D550575F375A74B615F14781CD146B7552D660E450C61D

Function 0041FB73 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8ce62699d77cf6fc485452aab23bc0d2f06dc97fb250f0cdf8bb77fec48897e
Instruction ID: 10fcdf0d7778afe5cfa01efcbfe7145de207d28205f498bccebed74cc4f07649
Opcode Fuzzy Hash: f8ce62699d77cf6fc485452aab23bc0d2f06dc97fb250f0cdf8bb77fec48897e
Instruction Fuzzy Hash: 56A001A9D49201C6E9006F21AC8647AA13C561B60AF047575990B32153A539D119955E

Function 00437E6C Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 95COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00437EB1

Strings

|, xrefs: 00437F06
u, xrefs: 00437EE6
o, xrefs: 00437ED6
p, xrefs: 00437EF6
w, xrefs: 00437F1E
h, xrefs: 00437ECE
x, xrefs: 00437F16

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID: InitVariant
String ID: h$o$p$u$w$x$|
API String ID: 1927566239-4240480344
Opcode ID: cde7acc4cee73d9f3ad6b51b58eba3b6d1e0ed05a24c7d8988c59abd281807a9
Instruction ID: 9d6958b47ad856ebde4cbe1dfb74169830e054e6d7501ee8f713b10cbfeadee3
Opcode Fuzzy Hash: cde7acc4cee73d9f3ad6b51b58eba3b6d1e0ed05a24c7d8988c59abd281807a9
Instruction Fuzzy Hash: F941F3705087818ED726CF2CC59871ABFE1AB56324F08869CD8EA4F397C779E415CB62

Function 0043760A Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 81COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00437633

Strings

u, xrefs: 00437668
h, xrefs: 00437650
p, xrefs: 00437678
o, xrefs: 00437658
x, xrefs: 00437698
|, xrefs: 00437688
w, xrefs: 004376A0

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID: InitVariant
String ID: h$o$p$u$w$x$|
API String ID: 1927566239-4240480344
Opcode ID: b92fb920b183803341b6a49ae8c15ec2c06aa1b04362e43098b3f3f3dc9228c7
Instruction ID: aae88484b20a0b16339dad471568bb0d05582c718af79cc38c7e699e218f90ee
Opcode Fuzzy Hash: b92fb920b183803341b6a49ae8c15ec2c06aa1b04362e43098b3f3f3dc9228c7
Instruction Fuzzy Hash: DC41D4604087C18ED721DF2CC49870ABFE16B56224F088A9DD8EA4F3EBC775E515CB62

Function 00428CF6 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 316COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00428E66

Strings

M5M3, xrefs: 00428D3F
9A,_, xrefs: 00428D62
{u, xrefs: 00428EFF
])[, xrefs: 00428D69
ke, xrefs: 00428F1B
E)C, xrefs: 00428D5B

Memory Dump Source

Source File: 00000005.00000002.1745014372.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_aspnet_regiis.jbxd

Similarity

API ID: DrivesLogical
String ID: E)C$ ])[$9A,_$M5M3$ke${u
API String ID: 999431828-2464183539
Opcode ID: 8e946b173a2b0638e8986dccd9bdd53224a04dabdfdf3614ca645997601eb116
Instruction ID: 521e53e9a01874bd80e11f3ac1d6111864371d013e5fd0349dafb285c374cbb8
Opcode Fuzzy Hash: 8e946b173a2b0638e8986dccd9bdd53224a04dabdfdf3614ca645997601eb116
Instruction Fuzzy Hash: D6C1BAB490121ADFCB00CF55E8816AEBB70FF05309F60455DE415AB792D33AE962CFA9

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report msvcp110.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Exports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
msvcp110.dll

Function 004101A0 Relevance: 1.7, Strings: 1, Instructions: 404
COMMON

Function 00446DCB Relevance: 1.6, Strings: 1, Instructions: 342
COMMON

Function 00446170 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 0040D440 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 163
threadCOMMON

Function 00445D00 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50
COMMON

Function 0040EBE0 Relevance: 1.6, APIs: 1, Instructions: 101
libraryCOMMON

Function 0044505A Relevance: 1.6, APIs: 1, Instructions: 70
libraryCOMMON

Function 004434C0 Relevance: 1.5, APIs: 1, Instructions: 45
memoryCOMMON

Function 00443498 Relevance: 1.5, APIs: 1, Instructions: 9
memoryCOMMON