Edit tour

Windows Analysis Report
setup.exe

Overview

General Information

Sample name:	setup.exe
Analysis ID:	1465692
MD5:	b0cfe4185035fc751ed0a62b1a95af98
SHA1:	dc90ec29c5da5414702e9163ae0133d207608960
SHA256:	ef5d295050a33cb9c2bd069a90855c74df58d0f7f6238885b48a6422eb6da137
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

setup.exe (PID: 5284 cmdline: "C:\Users\user\Desktop\setup.exe" MD5: B0CFE4185035FC751ED0A62B1A95AF98)

conhost.exe (PID: 5868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 3704 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 7040 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5284 -s 156 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "77.105.135.107:3445", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.1826335497.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.1827907274.0000000002BF3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: setup.exe PID: 5284	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 3704	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 3704	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.setup.exe.650000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Snort Signatures

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 77.105.135.107

Timestamp:	07/02/24-00:17:01.604285
SID:	2046045
Source Port:	49738
Destination Port:	3445
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 77.105.135.107

Timestamp:	07/02/24-00:17:12.934132
SID:	2043231
Source Port:	49738
Destination Port:	3445
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 77.105.135.107 - Destination IP: 192.168.2.4

Timestamp:	07/02/24-00:17:01.811299
SID:	2043234
Source Port:	3445
Destination Port:	49738
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 77.105.135.107 - Destination IP: 192.168.2.4

Timestamp:	07/02/24-00:17:07.057189
SID:	2046056
Source Port:	3445
Destination Port:	49738
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: setup.exe

Avira: detected

Found malware configuration

Source: 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "77.105.135.107:3445", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Multi AV Scanner detection for submitted file

Source: setup.exe

ReversingLabs: Detection: 83%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: setup.exe

Joe Sandbox ML: detected

Source: setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.4:49738 -> 77.105.135.107:3445
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49738 -> 77.105.135.107:3445
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 77.105.135.107:3445 -> 192.168.2.4:49738
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 77.105.135.107:3445 -> 192.168.2.4:49738

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 77.105.135.107:3445

Source: global traffic

TCP traffic: 192.168.2.4:49738 -> 77.105.135.107:3445

Source: Joe Sandbox View

ASN Name: PLUSTELECOM-ASRU PLUSTELECOM-ASRU

Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107

Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002BF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1827907274.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: RegAsm.exe, 00000002.00000002.1832420361.0000000003E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: setup.exe, 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000002.00000002.1826335497.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: RegAsm.exe, 00000002.00000002.1832420361.0000000003E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegAsm.exe, 00000002.00000002.1832420361.0000000003E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegAsm.exe, 00000002.00000002.1832420361.0000000003E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000002.00000002.1832420361.0000000003E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegAsm.exe, 00000002.00000002.1832420361.0000000003E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: RegAsm.exe, 00000002.00000002.1832420361.0000000003E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 00000002.00000002.1832420361.0000000003E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RegAsm.exe, 00000002.00000002.1832420361.0000000003E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00675940	0_2_00675940
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_006668A9	0_2_006668A9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0065E1B2	0_2_0065E1B2
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00665379	0_2_00665379
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0066F4EC	0_2_0066F4EC
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0065E4FA	0_2_0065E4FA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00653D50	0_2_00653D50
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00661610	0_2_00661610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00D9DC74	2_2_00D9DC74

Source: C:\Users\user\Desktop\setup.exe

Code function: String function: 00657F20 appears 51 times

Source: C:\Users\user\Desktop\setup.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5284 -s 156

Source: setup.exe, 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenamePunningly.exe8 vs setup.exe

Source: setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/6@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5284
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5868:120:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\be52fb3c-df2e-40ba-9969-75157a7950ec

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: setup.exe

ReversingLabs: Detection: 83%

Source: unknown	Process created: C:\Users\user\Desktop\setup.exe "C:\Users\user\Desktop\setup.exe"
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5284 -s 156
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: setup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0065661B push 8B006761h; iretd	0_2_00656620
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_006576DD push ecx; ret	0_2_006576F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_006567E0 push 8B006761h; iretd	0_2_006567E5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2900000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1635			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 7163			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6820	Thread sleep time: -26747778906878833s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6440	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\setup.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RegAsm.exe, 00000002.00000002.1826798165.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_0065BA33 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0065BA33

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_006676EC mov eax, dword ptr fs:[00000030h]	0_2_006676EC
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00662AD4 mov ecx, dword ptr fs:[00000030h]	0_2_00662AD4
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00667730 mov eax, dword ptr fs:[00000030h]	0_2_00667730

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_0066EC64 GetProcessHeap,

0_2_0066EC64

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_006579F6 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_006579F6
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0065BA33 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0065BA33
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00657CF9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00657CF9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00657E55 SetUnhandledExceptionFilter,	0_2_00657E55

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\setup.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_0127018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0127018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\setup.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44E000	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 916008	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_006577CC cpuid

0_2_006577CC

Source: C:\Users\user\Desktop\setup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0066E82D
Source: C:\Users\user\Desktop\setup.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0066E09E
Source: C:\Users\user\Desktop\setup.exe	Code function: GetLocaleInfoW,	0_2_0066E933
Source: C:\Users\user\Desktop\setup.exe	Code function: GetLocaleInfoW,	0_2_006661B9
Source: C:\Users\user\Desktop\setup.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0066EA02
Source: C:\Users\user\Desktop\setup.exe	Code function: GetLocaleInfoW,	0_2_0066E299
Source: C:\Users\user\Desktop\setup.exe	Code function: EnumSystemLocalesW,	0_2_0066E340
Source: C:\Users\user\Desktop\setup.exe	Code function: EnumSystemLocalesW,	0_2_0066E38B
Source: C:\Users\user\Desktop\setup.exe	Code function: EnumSystemLocalesW,	0_2_00665C53
Source: C:\Users\user\Desktop\setup.exe	Code function: EnumSystemLocalesW,	0_2_0066E426
Source: C:\Users\user\Desktop\setup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0066E4B1
Source: C:\Users\user\Desktop\setup.exe	Code function: GetLocaleInfoW,	0_2_0066E704

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00657BF3 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00657BF3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1826335497.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: setup.exe PID: 5284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3704, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002BF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002BF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $fq1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002BF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $fq-cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002BF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLRfq
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002BF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLRfq
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002BF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLRfq
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002BF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $fq%appdata%`,fqdC:\Users\user\AppData\Roaming`,fqdC:\Users\user\AppData\Roaming\Binance
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002BF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLRfq
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002BF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $fq&%localappdata%\Coinomi\Coinomi\walletsLRfq4
Source: RegAsm.exe, 00000002.00000002.1827907274.0000000002BF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $fq5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1827907274.0000000002BF3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3704, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1826335497.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: setup.exe PID: 5284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3704, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	261 Security Software Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	251 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	251 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	134 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
setup.exe	83%	ReversingLabs	Win32.Trojan.Convagent
setup.exe	100%	Avira	HEUR/AGEN.1317026
setup.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://tempuri.org/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Avira URL Cloud	safe
77.105.135.107:3445	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17ResponseD	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
77.105.135.107:3445	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	RegAsm.exe, 00000002.00000002.1832420361.0000000003E26000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14ResponseD	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	RegAsm.exe, 00000002.00000002.1827907274.0000000002DE0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21Response	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id4	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19Response	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13ResponseD	RegAsm.exe, 00000002.00000002.1827907274.0000000002DE0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id15Response	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6Response	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	setup.exe, 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000002.00000002.1826335497.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9Response	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegAsm.exe, 00000002.00000002.1832420361.0000000003E26000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1827907274.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24Response	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	RegAsm.exe, 00000002.00000002.1832420361.0000000003E26000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21ResponseD	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15ResponseD	RegAsm.exe, 00000002.00000002.1827907274.0000000002BF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11ResponseD	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17ResponseD	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	RegAsm.exe, 00000002.00000002.1827907274.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8ResponseD	RegAsm.exe, 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
77.105.135.107	unknown	Russian Federation		42031	PLUSTELECOM-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465692
Start date and time:	2024-07-02 00:16:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	setup.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/6@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 33 Number of non-executed functions: 55
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): WerFault.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21
Excluded domains from analysis (whitelisted): login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, umwatson.events.data.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: setup.exe

Simulations

Behavior and APIs

Time	Type	Description
18:17:05	API Interceptor	1x Sleep call for process: WerFault.exe modified
18:17:07	API Interceptor	45x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
77.105.135.107	1719859269.0326595_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, Xmrig	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PLUSTELECOM-ASRU	1719859269.0326595_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, Xmrig	Browse	77.105.135.107
	zyJWi2vy29.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer, Vidar, zgRAT	Browse	77.105.132.27
	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse	77.105.132.27
	1Cvd8TyYPm.exe	Get hash	malicious	LummaC, Mars Stealer, PureLog Stealer, Stealc, Vidar, Xmrig, zgRAT	Browse	77.105.133.27
	HXUYIDwIMY.exe	Get hash	malicious	Meduza Stealer	Browse	77.105.147.172
	lhZOo8vhuI.elf	Get hash	malicious	Unknown	Browse	77.105.138.202
	file.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse	77.105.147.130
	yqeO67O9gY.elf	Get hash	malicious	Mirai	Browse	77.105.140.109
	676767.exe	Get hash	malicious	Remcos	Browse	77.105.132.92
	setup.exe	Get hash	malicious	PureLog Stealer, RHADAMANTHYS	Browse	77.105.147.130

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_setup.exe_unknow_d795e61bb36a5b66a28bc5ab663876d6c3a884d6_99ceb0df_d18f51e4-4d2a-4fde-9e32-dff53f2c61f8\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9142851505283975
Encrypted:	false
SSDEEP:	96:H+FsQgUs1hqRouyDqPQXIDcQJc6rcEbcw3v+HbHg/1AnQECaVDPCoLnNfoU+jF9R:emQgUjO0nvh4jICBwzuiFSZ24IO83
MD5:	0F41BF53B48E069291CB5DAD44597FD5
SHA1:	17B4A4961F4643541CAC861D58B7A73A0A34CB06
SHA-256:	1E9763320CCEDF2FBEEA2E1339C3BC824DBF839E3C3B26590C7D2D4BB768CA86
SHA-512:	AA5DE2E13E61CE3D11419E3F710C94E47692A28A491198C9A5379294C19FE860A47C191BDE8D6F40ECCF40DC081D470E2DAA0DDCCB2AB05F9D2F5304E30F3120
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.4.3.4.5.8.2.1.2.0.5.8.3.3.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.4.3.4.5.8.2.1.5.4.9.5.8.2.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.1.8.f.5.1.e.4.-.4.d.2.a.-.4.f.d.e.-.9.e.3.2.-.d.f.f.5.3.f.2.c.6.1.f.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.c.e.5.4.a.f.4.-.6.f.6.c.-.4.d.1.1.-.b.0.f.d.-.0.0.0.d.2.8.8.c.c.1.5.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.e.t.u.p...e.x.e._.u.n.k.n.o.w.n.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.a.4.-.0.0.0.1.-.0.0.1.4.-.4.2.a.9.-.d.1.6.3.0.4.c.c.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.6.6.e.3.a.f.a.d.a.5.8.7.7.4.c.1.3.7.3.d.f.b.1.9.a.0.8.c.0.4.9.0.0.0.0.f.f.f.f.!.0.0.0.0.d.c.9.0.e.c.2.9.c.5.d.a.5.4.1.4.7.0.2.e.9.1.6.3.a.e.0.1.3.3.d.2.0.7.6.0.8.9.6.0.!.s.e.t.u.p...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5570.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Jul 1 22:17:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	45772
Entropy (8bit):	2.016482351138773
Encrypted:	false
SSDEEP:	192:/szefaYiXQvrYX5lMOYs3SadhZ8JPlWvyBOUXf+1hcpz4ZG:/TbfvriDL3SafGPlWwOUX21hcgG
MD5:	A7D0025C690507CDE4EB07DAF095E6A7
SHA1:	CFF18380F7DC22712529E62E9A51B4A12CEB2EF2
SHA-256:	E9BEE09F1CEACD3C1F0889D2D9A5531012723AA94AFB92092D8DE82C53BAE8D4
SHA-512:	1541EED3805FEC0A40158F69BB4EB32BAF81FC043B3CE70DEA5D336A98055A554A6ECADACE840573B7926DBDECFB9944A40BA159E0A2424FECE8F50791515533
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........f........................l................-..........T.......8...........T...............<.......................................................................................................eJ..............GenuineIntel............T.............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER564C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8358
Entropy (8bit):	3.6976837904810864
Encrypted:	false
SSDEEP:	192:R6l7wVeJ9a6qg6Y9JSU9zfgmf2JJD/Ppr+89bfdsfa1m:R6lXJA6d6YDSU9zfgmf2JJD/VfWfx
MD5:	A4CA2F45498B61A1F96C223668B9C5EA
SHA1:	E02095A0093B82FED4F30C03253E1DD6E74472CC
SHA-256:	0A385D2C0B3749BE288CED20B29CB6A86100CD94095F0729D3A25C528A898EBE
SHA-512:	F1138DE2F6BEF190C8AE3489EAF662C29B8FB254F7F8467C9779F3B589B3CC3AE9F3AD018FAD7CB0B99CFECD896317B3DBBC7BBE67EC7050B4B399D45DE274A4
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.2.8.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER566C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4634
Entropy (8bit):	4.491751117395461
Encrypted:	false
SSDEEP:	48:cvIwWl8zsQJg77aI9pi+yWpW8VYDYm8M4JSd+wFz+q8R+2qfydd:uIjfWI7Hi67VrJSdViFqfydd
MD5:	10C254C6A8F9F55ACDDE85BEFD749333
SHA1:	60BFC0BBB1E3490B92C50EAE5194C0006B9AC2EC
SHA-256:	D05E0B503AF1D54E566AA4F27662ED1D0C7D17054E580D5B9FEC741F945CF58D
SHA-512:	360A5B37A2EC0C823F79BAEA53DB07D45DC6883ED450951070A1776F49B5749EA42728AA2431356BF68C8AF5272B70A68AB2900C3F94B87E538956D19A94D3F1
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="392479" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	2A56468A7C0F324A42EA599BF0511FAF
SHA1:	404B343A86EDEDF5B908D7359EB8AA957D1D4333
SHA-256:	6398E0BD46082BBC30008BC72A2BA092E0A1269052153D343AA40F935C59957C
SHA-512:	19B79181C40AA51C7ECEFCD4C9ED42D5BA19EA493AE99654D3A763EA9B21B1ABE5B5739AAC425E461609E1165BCEA749CFB997DE0D35303B4CF2A29BDEF30B17
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465273110827348
Encrypted:	false
SSDEEP:	6144:yIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNHdwBCswSbu:3XD94+WlLZMM6YFH1+u
MD5:	F0BFE9E928956C3A7CD6237B98732EAF
SHA1:	9E25A7E61C73672A972ED3F0106BD2ED1A86BF4E
SHA-256:	1ED4DD1985E01DD2A8AB1148417075115D227CEB2A6EDF18A001646F7AEE74A0
SHA-512:	957D715B8E1CA13F060F283527F840258FBEDF2607BC03C1501CF0349E1C03CF112D5547E1EDE0E123490EB5FBBC3B7220CE64438AE0A323027EF1E49D50F5DF
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmz.;e.................................................................................................................................................................................................................................................................................................................................................W-Q........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.647344150799475
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	setup.exe
File size:	514'560 bytes
MD5:	b0cfe4185035fc751ed0a62b1a95af98
SHA1:	dc90ec29c5da5414702e9163ae0133d207608960
SHA256:	ef5d295050a33cb9c2bd069a90855c74df58d0f7f6238885b48a6422eb6da137
SHA512:	22d2dda36d5a7a1d29560db389b4811481c6ee39158903e5debc2a95a641929317a3d487cf138bc7e06c55dd05fdd92687159e81ed5fa5d9d18b5660e5c39c24
SSDEEP:	12288:R9Z5uG0VGH6CNq93+xYg1dSjBYSuBbT+g6:vlOGaCT7ZBBbq
TLSH:	4CB4F11574C08072D662113206F4D7B89E3DF9304F669ECF67D80B7E4F742D29936AAA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x...+...+...+z.....+z.....+z.....+k\....+k\....+z.....+...+(..+k\....+Z_....+Z_....+Z_....+Rich...+........PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x407482
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x668189BD [Sun Jun 30 16:37:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	bdd081110ce6691ddde6cfe79c51d26e

Entrypoint Preview

Instruction
call 00007F3C14C65B0Eh
jmp 00007F3C14C651C9h
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F3C14C6536Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F3C14C6535Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F3C14C6535Eh
add edx, 28h
cmp edx, esi
jne 00007F3C14C6533Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F3C14C6534Bh
push esi
call 00007F3C14C65DE4h
test eax, eax
je 00007F3C14C65372h
mov eax, dword ptr fs:[00000018h]
mov esi, 0047D1F0h
mov edx, dword ptr [eax+04h]
jmp 00007F3C14C65356h
cmp edx, eax
je 00007F3C14C65362h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F3C14C65342h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F3C14C65359h
mov byte ptr [0047D1F4h], 00000001h
call 00007F3C14C6560Ah
call 00007F3C14C68377h
test al, al
jne 00007F3C14C65356h
xor al, al
pop ebp
ret
call 00007F3C14C72624h
test al, al
jne 00007F3C14C6535Ch
push 00000000h
call 00007F3C14C6837Eh
pop ecx
jmp 00007F3C14C6533Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [0047D1F5h], 00000000h
je 00007F3C14C65356h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x306e0	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x30728	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7e000	0x1d50	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2e968	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2e8a8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x26000	0x168	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x23906	0x23a00	9cc9e69cc2b919f4e3f3891ad6c09974	False	0.5678042763157894	data	6.66321463190122	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.bss	0x25000	0xe2d	0x1000	b9555079f4058c9191f53fd081cbcf20	False	0.574951171875	data	6.000697093127323	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x26000	0xaf58	0xb000	2bd26ddbeffdb48edc2e50a044d14002	False	0.4250266335227273	data	5.052866112468185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x31000	0x4ccf4	0x4be00	d8c33e9ef3ef203725dc0a1620b4286a	False	0.9878726060543658	data	7.990013177731962	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x7e000	0x1d50	0x1e00	674489e8e66aae028e5dbee205e11986	False	0.7651041666666667	data	6.5116983386410325	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

USER32.dll

OffsetRect

KERNEL32.dll

CreateFileW, HeapSize, GetProcessHeap, SetStdHandle, WaitForSingleObject, Sleep, CreateThread, VirtualAlloc, GetModuleHandleA, GetProcAddress, GetConsoleWindow, CloseHandle, WaitForSingleObjectEx, GetCurrentThreadId, GetExitCodeThread, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, QueryPerformanceCounter, ReleaseSRWLockExclusive, WakeAllConditionVariable, EncodePointer, DecodePointer, MultiByteToWideChar, LCMapStringEx, GetSystemTimeAsFileTime, GetModuleHandleW, GetStringTypeW, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, SetEnvironmentVariableW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitThread, FreeLibraryAndExitThread, GetModuleHandleExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW

Exports

Name	Ordinal	Address
AwakeSound	1	0x425d20

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/02/24-00:17:01.604285	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49738	3445	192.168.2.4	77.105.135.107
07/02/24-00:17:12.934132	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49738	3445	192.168.2.4	77.105.135.107
07/02/24-00:17:01.811299	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	3445	49738	77.105.135.107	192.168.2.4
07/02/24-00:17:07.057189	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	3445	49738	77.105.135.107	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 2, 2024 00:17:00.838109016 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:00.843267918 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:00.843349934 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:01.052797079 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:01.057750940 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:01.569092989 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:01.604285002 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:01.609064102 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:01.811299086 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:01.854051113 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:06.857810974 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:06.862693071 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:07.057188988 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:07.057213068 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:07.057224035 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:07.057235003 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:07.057246923 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:07.057265043 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:07.057305098 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:07.103959084 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:07.212430000 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:07.218878031 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:07.443856955 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:07.448075056 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:07.454642057 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:07.663541079 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:07.672015905 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:07.678582907 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:07.678595066 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:07.678605080 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:07.680237055 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:07.680247068 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:07.681916952 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:07.975444078 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:08.025706053 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:08.442112923 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:08.442146063 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:08.446959972 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:08.446975946 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:08.447052002 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:08.639066935 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:08.641696930 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:08.646445990 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:08.837197065 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:08.885078907 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:09.010349989 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:09.015310049 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:09.206284046 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:09.210994959 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:09.215781927 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:09.406528950 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:09.447581053 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:09.475181103 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:09.481986046 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:09.690736055 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:09.693005085 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:09.699201107 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:09.891371012 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:09.917754889 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:09.924108982 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.118889093 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.122035980 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.128609896 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.320873976 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.369455099 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.436168909 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.443479061 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.443490028 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.443525076 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.443530083 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.443536043 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.443574905 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.443618059 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.445616961 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.445621967 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.445683002 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.445770025 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.445796967 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.445944071 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.447340965 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.447359085 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.447390079 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.447395086 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.447432995 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.447443962 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.447480917 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.449146032 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.449151039 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.449295998 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.461766005 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.461905003 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.472291946 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.472634077 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.479325056 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479335070 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479341030 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479408979 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479413986 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479413986 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.479433060 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479454041 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479464054 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479480028 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479490995 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479510069 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479585886 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479590893 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479618073 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479655981 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479666948 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479672909 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479742050 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479746103 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479842901 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479846954 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479857922 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479898930 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.479995012 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.480000973 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.480011940 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.480026960 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.480053902 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.480072021 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.480082035 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.481117964 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.481193066 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.481715918 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.481723070 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.481759071 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.481784105 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.481795073 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.481827974 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.481832027 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.481842995 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.481884003 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.481889009 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.481934071 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.481937885 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.481988907 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.481992960 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.484040976 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.484055996 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.484219074 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.485825062 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.485829115 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.485856056 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.486252069 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.487483025 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487498999 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487521887 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487526894 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487551928 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.487565994 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487571001 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487584114 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.487620115 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487624884 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487624884 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.487634897 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487642050 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487713099 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487716913 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487729073 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487734079 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487776041 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487781048 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487807989 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487812042 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487822056 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487828970 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487855911 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487862110 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487885952 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487891912 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487910032 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487915039 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487956047 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487961054 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.487989902 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.488003969 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.488023043 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.488030910 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.488100052 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.488104105 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.488188982 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.489480019 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.489598036 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.489602089 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.489733934 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.489737988 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.489748001 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.489778996 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.489784956 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.489795923 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.489821911 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.489830017 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.489869118 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.489872932 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.490011930 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.490015984 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.490082026 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.490088940 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.490151882 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.490317106 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.490567923 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.490634918 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.493192911 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493197918 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493274927 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493280888 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493295908 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493311882 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493328094 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493350983 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493359089 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493370056 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493391037 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493396044 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493484020 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493505955 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493509054 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493520021 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493525982 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493551970 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493565083 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493582010 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493586063 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493597984 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493643045 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493647099 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493727922 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493783951 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493788004 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493808985 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493813992 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493850946 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493855953 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493865967 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493890047 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493894100 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.493908882 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.494043112 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.494050026 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.494107962 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.494167089 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.494172096 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.494189978 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.494236946 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.494242907 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.495403051 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.495408058 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.495448112 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.495474100 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.495480061 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.495537996 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.495543003 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.495549917 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.495630026 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.495635986 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.495893002 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.496114016 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.496195078 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.497792006 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.497797012 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.497843981 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.497859955 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.497927904 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.497932911 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498003960 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498008013 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498050928 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498054981 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498090982 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498095036 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498181105 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498184919 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498198986 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498214960 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498274088 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498287916 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498303890 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498323917 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498339891 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498361111 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498369932 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498440027 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498552084 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498560905 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498574972 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498579025 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498589039 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498617887 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498632908 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498655081 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498661995 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498708010 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.498713017 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.500967026 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.501111984 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.501116991 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.501220942 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.501226902 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.501351118 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.501390934 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.501395941 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.501405954 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.501471043 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.501475096 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.501523018 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.501528025 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.501584053 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.501588106 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.501627922 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.501754999 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.501811028 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.502502918 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.502676010 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.502706051 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.502711058 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.502720118 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.502799034 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.502830982 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.502881050 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.502924919 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.502931118 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.502993107 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.502996922 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503092051 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503096104 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503177881 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503181934 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503272057 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503276110 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503329039 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503333092 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503343105 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503349066 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503494024 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503499031 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503549099 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503582954 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503588915 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503726006 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503731966 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503741980 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503798962 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503803015 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.503927946 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.504007101 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.504046917 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.504051924 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.504157066 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.504169941 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.504184008 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.504194021 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.504349947 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.504354000 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.504467010 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.504477024 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.504560947 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.504566908 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.504654884 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.504658937 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.504698992 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.504762888 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.504951954 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.505114079 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.505394936 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.505477905 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.505481958 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.505503893 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.509027958 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.509260893 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.509345055 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.509439945 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.509447098 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.509475946 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.509480953 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.509557962 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.509565115 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.509649992 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.509654045 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.509702921 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.509785891 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.509789944 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.509800911 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.509840012 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.509844065 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.509999037 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510013103 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510015965 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510020971 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510026932 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510031939 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510044098 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510049105 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510071039 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510076046 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510093927 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510097980 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510107994 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510113955 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510214090 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510232925 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510236979 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510246992 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510252953 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510272026 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510276079 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510341883 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510391951 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510396004 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510519028 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510521889 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.510533094 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.511128902 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.511152029 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.511154890 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.511215925 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.511226892 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.511231899 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.511296034 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.511298895 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.511310101 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.511317015 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.511368990 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.515547991 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.515571117 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.515583992 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.515609026 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.515628099 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.515631914 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.515690088 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.515695095 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.515778065 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.515852928 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.516096115 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516136885 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516273022 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516294956 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516316891 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516345978 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516386986 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516401052 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516412020 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516474009 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516489029 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516490936 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516522884 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516527891 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516599894 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516623020 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516628027 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516638041 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516690969 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516700983 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516757965 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516762018 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516823053 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516827106 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516836882 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516948938 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516952991 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516963005 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516978025 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516982079 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516988039 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.516993046 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.517003059 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.517009020 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.517080069 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.517092943 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.517098904 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.517107964 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.517113924 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.517123938 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.517128944 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.517139912 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.517144918 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.517167091 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.517177105 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522393942 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522414923 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522419930 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522429943 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522455931 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522460938 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522485971 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522501945 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522516966 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522522926 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522557974 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522562027 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522564888 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.522629976 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.522634983 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522650957 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522661924 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522666931 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522682905 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522687912 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522797108 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522805929 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522815943 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522834063 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522838116 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522849083 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522875071 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522880077 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522897005 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522902012 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522922993 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522928953 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522957087 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.522993088 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523086071 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523093939 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523143053 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523241997 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523246050 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523256063 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523292065 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523294926 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523370981 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523397923 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523411036 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523431063 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523443937 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523453951 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523511887 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523515940 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523525953 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523533106 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523570061 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523574114 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.523626089 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529011011 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529028893 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529033899 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529046059 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529050112 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529238939 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:10.529480934 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529486895 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529582977 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529587984 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529597998 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529603958 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529685974 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529704094 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529706955 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529716969 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529731989 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529737949 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529798985 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529803991 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529808998 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529814005 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529843092 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529845953 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529869080 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529875040 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529953957 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529958963 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529977083 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.529980898 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.530010939 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.530015945 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.530101061 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.530105114 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.530404091 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.530409098 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.530467987 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.530477047 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.530482054 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.531060934 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.531064987 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.531126022 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.531132936 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.531163931 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.531184912 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.531189919 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.531199932 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.531225920 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.531253099 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.531256914 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.531266928 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.531280994 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.531296968 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.531307936 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535609961 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535614014 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535691977 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535696030 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535706043 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535727024 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535731077 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535756111 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535769939 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535789013 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535792112 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535801888 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535832882 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535836935 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535846949 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535852909 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535934925 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535938978 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535969973 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535981894 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535993099 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.535998106 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.536027908 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.536034107 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.536053896 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.536058903 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.536072016 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.536082983 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.536101103 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.536104918 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.536115885 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:10.582221985 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:11.333679914 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:11.341424942 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:11.346362114 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:11.537065983 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:11.539323092 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:11.544548988 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:11.735193014 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:11.736357927 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:11.741122961 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:11.932440996 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:11.978921890 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:12.046344042 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:12.051140070 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.242465019 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.291351080 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:12.308113098 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:12.313256025 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.313267946 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.313277006 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.313287973 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.313296080 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.313304901 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.313313007 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.313322067 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.313338041 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.313345909 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.313354969 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.317679882 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.317745924 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.317951918 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.317960978 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.514306068 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.520543098 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:12.527107000 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.734816074 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.735574007 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:12.742120028 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.933120966 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:12.934132099 CEST	49738	3445	192.168.2.4	77.105.135.107
Jul 2, 2024 00:17:12.941072941 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:13.132956028 CEST	3445	49738	77.105.135.107	192.168.2.4
Jul 2, 2024 00:17:13.173402071 CEST	49738	3445	192.168.2.4	77.105.135.107

Target ID:	0
Start time:	18:16:58
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\setup.exe"
Imagebase:	0x650000
File size:	514'560 bytes
MD5 hash:	B0CFE4185035FC751ED0A62B1A95AF98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	18:16:58
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:16:59
Start date:	01/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x690000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.1826335497.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.1827907274.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1827907274.0000000002BF3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:17:01
Start date:	01/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5284 -s 156
Imagebase:	0xce0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	53

Executed Functions

Function 0127018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,012700FF,012700EF), ref: 012702FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0127030F
Wow64GetThreadContext.KERNEL32(0000008C,00000000), ref: 0127032D
ReadProcessMemory.KERNELBASE(00000088,?,01270143,00000004,00000000), ref: 01270351
VirtualAllocEx.KERNELBASE(00000088,?,?,00003000,00000040), ref: 0127037C
WriteProcessMemory.KERNELBASE(00000088,00000000,?,?,00000000,?), ref: 012703D4
WriteProcessMemory.KERNELBASE(00000088,00400000,?,?,00000000,?,00000028), ref: 0127041F
WriteProcessMemory.KERNELBASE(00000088,-00000008,?,00000004,00000000), ref: 0127045D
Wow64SetThreadContext.KERNEL32(0000008C,02C20000), ref: 01270499
ResumeThread.KERNELBASE(0000008C), ref: 012704A8

Strings

ress, xrefs: 01270217
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 012702FB
WriteProcessMemory, xrefs: 012702A0
ResumeThread, xrefs: 012702C9
VirtualAlloc, xrefs: 01270254
GetP, xrefs: 0127020F
CreateProcessA, xrefs: 01270241
GetThreadContext, xrefs: 01270267
SetThreadContext, xrefs: 012702B3
aryA, xrefs: 012701D3
Load, xrefs: 012701CB
VirtualAllocEx, xrefs: 0127028D
TerminateProcess, xrefs: 0127038B
ReadProcessMemory, xrefs: 0127027A

Memory Dump Source

Source File: 00000000.00000002.1761589453.0000000001270000.00000040.00001000.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1270000_setup.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: 75ffed4ba5a25485f23c58fd16edf77980e42bd15f316e3eb309cd21cd5ad752
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: 0FB1E57664028AAFDB60CF68CC80BDA77A5FF88714F158524FA0CAB341D774FA418B94

Function 00675940 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 214
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,00675BF0,00000000,00000000,00000000), ref: 00675BDF
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,00000000,?,?,?,?,?,?,?,?,00675C96), ref: 00675BE8

Strings

Own head, xrefs: 00675ACD
Earth, xrefs: 00675AF3
C, xrefs: 00675975

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleThreadWait
String ID: C$Earth$Own head
API String ID: 1891408510-3365287836
Opcode ID: 1fed2da07729174c916fcdcf5bdfc273e3d9645c2db646ae3547f48b4fb01cb4
Instruction ID: 6c25970eb795aa3652870dc016af62d24efe5498512128a62976b43fa0930aaf
Opcode Fuzzy Hash: 1fed2da07729174c916fcdcf5bdfc273e3d9645c2db646ae3547f48b4fb01cb4
Instruction Fuzzy Hash: D2715871904B459FC710EF34CCC1B6FB7DAAF45340F188A6DF89A47282E7A0A6488B55

Function 006676EC Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf5fdfae591733c3582f13f8f85d654677cd7171e315ed3219ee0695846118de
Instruction ID: 5d1ef5c48e1bbd99eeec82018de2ca6e5a46cb69521c91436199f0f2ec4eed50
Opcode Fuzzy Hash: cf5fdfae591733c3582f13f8f85d654677cd7171e315ed3219ee0695846118de
Instruction Fuzzy Hash: 04F0E532614220DFCB12CB4CC805F9873ADEB44B54F12006AF111D7250C2B0DD00C7C0

Function 00675D30 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShowWindow,226D7AA9), ref: 00675D65
GetProcAddress.KERNEL32(00000000), ref: 00675D6C
GetConsoleWindow.KERNELBASE(?,00000000), ref: 00675D7B
GetModuleHandleA.KERNEL32(kernel32.dll,FreeConsole), ref: 00675D8F
GetProcAddress.KERNEL32(00000000), ref: 00675D96
FreeConsole.KERNELBASE ref: 00675DA2

Part of subcall function 00675000: GetCurrentThreadId.KERNEL32 ref: 00675079

Strings

kernel32.dll, xrefs: 00675D8A
ShowWindow, xrefs: 00675D5B
FreeConsole, xrefs: 00675D85
user32.dll, xrefs: 00675D60

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: AddressConsoleHandleModuleProc$CurrentFreeThreadWindow
String ID: FreeConsole$ShowWindow$kernel32.dll$user32.dll
API String ID: 245968307-4003964729
Opcode ID: 2d09d4b09a2e3d494013ef521b378ffab5efb47bddc1b4313f16c62aafc52821
Instruction ID: d1ab6ee5c991f22260864c1a2a269a702abb7213696e4ffd6b67854d68267979
Opcode Fuzzy Hash: 2d09d4b09a2e3d494013ef521b378ffab5efb47bddc1b4313f16c62aafc52821
Instruction Fuzzy Hash: D0119871E40B04AFD710EBB4DD09B6EBBFAEF48711F108569F50AD32D0D77599008665

Function 00675000 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00675079
std::_Throw_Cpp_error.LIBCPMT ref: 006750B4
std::_Throw_Cpp_error.LIBCPMT ref: 006750BB
std::_Throw_Cpp_error.LIBCPMT ref: 006750C2
std::_Throw_Cpp_error.LIBCPMT ref: 006750C9

Strings

Success created., xrefs: 00675003, 00675014

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID: Success created.
API String ID: 2261580123-2637490038
Opcode ID: 5cbdc90b74c98710642ed7c4f2017b23d5202d45ac6dbf4036e6af4ce2498cb7
Instruction ID: 4470ef0ddaa07f64956303ceb4507842c2b8992236ea8f4e27344dc16bc69e8b
Opcode Fuzzy Hash: 5cbdc90b74c98710642ed7c4f2017b23d5202d45ac6dbf4036e6af4ce2498cb7
Instruction Fuzzy Hash: 2311EE71741F0067E27037B44C17F5B75879F01B52F15887CBE4EAA1C2EAE1944887E9

Function 00665E1C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,226D7AA9,?,00665F29,?,?,?,00000000), ref: 00665EDD

Strings

ext-ms-, xrefs: 00665E87
api-ms-, xrefs: 00665E73

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 9a043cf116eae74158761ac05f2c2ebd3fd041a55e96df916a14e54d2a63d564
Instruction ID: ac7bfbf3b808ace50b8e7c6881ff516c88f84f5da30876841d1c1a55515fe0b5
Opcode Fuzzy Hash: 9a043cf116eae74158761ac05f2c2ebd3fd041a55e96df916a14e54d2a63d564
Instruction Fuzzy Hash: C821E432A41A11ABCF219B20DC42AAB776BDF41761F251221F91BA73D0D731EE01CAE0

Function 0065F06A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00680168,0000000C), ref: 0065F07D
ExitThread.KERNEL32 ref: 0065F084

Strings

`e, xrefs: 0065F0BA

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: ErrorExitLastThread
String ID: `e
API String ID: 1611280651-3155454700
Opcode ID: 420f2d6d59af3edf98b4c74485413874945be44c635c4e73cf9a86334fbf4b85
Instruction ID: 5d1f1e778af18fb6c62537e06295508a8b75f5c020acca2f2d69793bdac875cd
Opcode Fuzzy Hash: 420f2d6d59af3edf98b4c74485413874945be44c635c4e73cf9a86334fbf4b85
Instruction Fuzzy Hash: 46F04971900605AFDB54ABB0D80AA6E3B76FF44712F20025DF806973A2DB749945CBA5

Function 0065F1C6 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_0000F06A,00000000,?,?), ref: 0065F20F
GetLastError.KERNEL32 ref: 0065F21B
__dosmaperr.LIBCMT ref: 0065F222

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 87ae41c189c163532b30d43087c65651f8869f8ee0956bf74f619f88f70b62a3
Instruction ID: d734ebb4a5b82bd121fa304d8edc696999064a06cad9b9e255363f803e0aaee1
Opcode Fuzzy Hash: 87ae41c189c163532b30d43087c65651f8869f8ee0956bf74f619f88f70b62a3
Instruction Fuzzy Hash: F3015EB6910219AFDF259FA0DC05AEF7BA6EF00366F104068FD0596290EB71CE58DB94

Function 0065628D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`e, xrefs: 00656325

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: `e
API String ID: 0-3155454700
Opcode ID: 8deee69c71bf476e1d38c56b94c08a10682bbf06ea4ca8a033e5f853f7f524b2
Instruction ID: 614fcc0886a0c460d5d6275e6b1bdd095a6e632f4e1ba70dfb8fd320f91c6c5d
Opcode Fuzzy Hash: 8deee69c71bf476e1d38c56b94c08a10682bbf06ea4ca8a033e5f853f7f524b2
Instruction Fuzzy Hash: 6E31953290011AEFCB15CFA8D5908EDB7BABF19311F54126AF901E3790D731EA48CB90

Function 00669572 Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00668CBC: GetConsoleOutputCP.KERNEL32(226D7AA9,00000000,00000000,?), ref: 00668D1F

WriteFile.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000,?,00000001,?,?,?,?,?,?), ref: 006696DB
GetLastError.KERNEL32 ref: 006696E5

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: b66c3c5b8247c339c7bf6c8ae479bf92115cd92896659be53e2d075d0f164979
Instruction ID: 03d8c15e736d81745b1537d885df64e68ec2b70f9f5a13d41963712f3a9d5f79
Opcode Fuzzy Hash: b66c3c5b8247c339c7bf6c8ae479bf92115cd92896659be53e2d075d0f164979
Instruction Fuzzy Hash: 1E618071D04249AEEF119FA8C884EEEBFBEAF09714F144159EC01AB252D371DA46CB74

Function 00669174 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,006696C1,00000001,00000000,00000000,?,?,00000000), ref: 00669210
GetLastError.KERNEL32(?,006696C1,00000001,00000000,00000000,?,?,00000000,00000000,?,00000001,?,?,?,?,?), ref: 00669236

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 409f106a62036d8efd93a253ee66beb1caa2b4d91d0cb9d7a8cffe25f8293ed5
Instruction ID: ab920b8044191157e625d5076ab0919dea5fc613ad1bcf28f91a33d964f84a35
Opcode Fuzzy Hash: 409f106a62036d8efd93a253ee66beb1caa2b4d91d0cb9d7a8cffe25f8293ed5
Instruction Fuzzy Hash: BD218D35A002199BCB19CF29DC909E9B7BAEB49305F2440AAED06D7311D630DE46CB60

Function 0066661A Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00666666
GetFileType.KERNELBASE(00000000), ref: 00666678

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 448e192c6c9b88b165bd7845a9c91a86523c9192d59163697e221bd04cc44cc4
Instruction ID: 743696f6668c35173dc22c2b6129ddc29f9a89ed1c6049deff521b210347ab7c
Opcode Fuzzy Hash: 448e192c6c9b88b165bd7845a9c91a86523c9192d59163697e221bd04cc44cc4
Instruction Fuzzy Hash: D111E1712047418AC7304F3EFC88662BA9BAB52334B38072EF4B6C63F1C631D9929647

Function 00665A1C Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0066D082,?,00000000,?,?,0066D323,?,00000007,?,?,0066D81C,?,?), ref: 00665A32
GetLastError.KERNEL32(?,?,0066D082,?,00000000,?,?,0066D323,?,00000007,?,?,0066D81C,?,?), ref: 00665A3D

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8a2d81672ba4e0887b727b65f6ffd7d99feee1326e00cc0642f387816f8cc446
Instruction ID: 6b9bc72f92e5ad4d75f8efd405f190413d101553a20c219601b3dabac2dd8332
Opcode Fuzzy Hash: 8a2d81672ba4e0887b727b65f6ffd7d99feee1326e00cc0642f387816f8cc446
Instruction Fuzzy Hash: FFE08C32100A04ABEB252BE0EC4AFDA3BAA9B40395F115074F60C9A260DB758890CB98

Function 00675BF0 Relevance: 2.6, APIs: 2, Instructions: 98
sleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040), ref: 00675C86
Sleep.KERNELBASE(000003E8), ref: 00675CD0

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: AllocSleepVirtual
String ID:
API String ID: 503295252-0
Opcode ID: 0125007b2fe1dd2670e179575cda0a1bf03facff859b62b61ba93d94e399e958
Instruction ID: 3021376caabca60fed7db81fc6c58abbd45c99f13c169fa181aae5a4bdf09a2e
Opcode Fuzzy Hash: 0125007b2fe1dd2670e179575cda0a1bf03facff859b62b61ba93d94e399e958
Instruction Fuzzy Hash: 7631D870E007489BDB44DFA4DC85BED77B6EF09300F105159F909BB282EB749A848768

Function 00665EE7 Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b2b432f9b627c3c1d8d8031c60d0e6b59b4702c5fd87fc3939e81e229da4f7
Instruction ID: b7caf3ea7c9b8f212c43b4df5c3f58f0a9aab28e9ee59c8fd52a66f5a8a770a2
Opcode Fuzzy Hash: f6b2b432f9b627c3c1d8d8031c60d0e6b59b4702c5fd87fc3939e81e229da4f7
Instruction Fuzzy Hash: 5701D837714A156F9B259F69EC429AB37DBAB85320F185124F906CB155DB30D8018B50

Non-executed Functions

Function 0066F4EC Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0066F6D0

Strings

1#IND, xrefs: 0066F5F1
1#SNAN, xrefs: 0066F5F8
1#INF, xrefs: 0066F622
1#QNAN, xrefs: 0066F5FF

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 20c50e1c69df1e8e35c2583f1fb4f30d1e654cb1aa7ec64c9dd6b100c1d69f39
Instruction ID: d3f45bb7663de5a031b90280c6b06145ce83e6014e27c69d198f9b4baec7fd2c
Opcode Fuzzy Hash: 20c50e1c69df1e8e35c2583f1fb4f30d1e654cb1aa7ec64c9dd6b100c1d69f39
Instruction Fuzzy Hash: 6BD20771E082298FEB65CF28DD507EAB7B6EB44305F1481EAD40DE7240EB74AE858F51

Function 0066E82D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0066EB4B,00000002,00000000,?,?,?,0066EB4B,?,00000000), ref: 0066E8C6
GetLocaleInfoW.KERNEL32(?,20001004,0066EB4B,00000002,00000000,?,?,?,0066EB4B,?,00000000), ref: 0066E8EF
GetACP.KERNEL32(?,?,0066EB4B,?,00000000), ref: 0066E904

Strings

OCP, xrefs: 0066E881
ACP, xrefs: 0066E84B

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 50c8849ab92b888ace26a3a65797f6989510ad5f19471c538a3fadf655e38612
Instruction ID: 87305d886f6ccac0b94d1ffa894c5ab7f3a71227afa1b0924a2dcbbda8017fe9
Opcode Fuzzy Hash: 50c8849ab92b888ace26a3a65797f6989510ad5f19471c538a3fadf655e38612
Instruction Fuzzy Hash: 2A21AF3AB00104AAEB348F18C904BDB73A7EF50B61B56812CE90EDB214E733DD41C390

Function 0066EA02 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00664CF0: GetLastError.KERNEL32(?,00000008,00667C7C), ref: 00664CF4
Part of subcall function 00664CF0: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 00664D96

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0066EB0E
IsValidCodePage.KERNEL32(00000000), ref: 0066EB57
IsValidLocale.KERNEL32(?,00000001), ref: 0066EB66
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0066EBAE
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0066EBCD

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 90b466a00594e2f26cd81fc3abf938ede25696af03dc303f6e48e11a476c6ea3
Instruction ID: fdf5d4f5deb48526640201c44b7ad4583b2db1599aa17268ea48e37b6a0a487f
Opcode Fuzzy Hash: 90b466a00594e2f26cd81fc3abf938ede25696af03dc303f6e48e11a476c6ea3
Instruction Fuzzy Hash: 1951AE75A00205AFDF20DFA5DC45AFA73BAFF58700F044029F905E7290E772AA44CB61

Function 0066E09E Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00664CF0: GetLastError.KERNEL32(?,00000008,00667C7C), ref: 00664CF4
Part of subcall function 00664CF0: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 00664D96

GetACP.KERNEL32(?,?,?,?,?,?,00663413,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0066E15F
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00663413,?,?,?,00000055,?,-00000050,?,?), ref: 0066E18A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0066E2ED

Strings

utf8, xrefs: 0066E25C

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 563a107cb8eaa1eb9015e57b323dae345d4c266e16e8ad005aadd6f9d987f4cf
Instruction ID: e41d1e8ff00ef2e21708f32cd2504f6deb888be6b0d664c31c880c9d9649a6f2
Opcode Fuzzy Hash: 563a107cb8eaa1eb9015e57b323dae345d4c266e16e8ad005aadd6f9d987f4cf
Instruction Fuzzy Hash: 70712775A00202AAEB64AB75CC56BB773AFEF45700F14402EF905D7281FB72EE458794

Function 006668A9 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00666936

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: bd2da47a312efedecd144210908754662d1f4f2356db7d473d454eab076e7448
Instruction ID: 07f72ce07133cb925f2b97e1bec7e2e127c46e91145f715b860455dacb3809fd
Opcode Fuzzy Hash: bd2da47a312efedecd144210908754662d1f4f2356db7d473d454eab076e7448
Instruction Fuzzy Hash: BFB12572904296DFDB15CF68D881BFEBBA6EF55310F14826AF845EB341D2359D01CBA0

Function 00657CF9 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00657D05
IsDebuggerPresent.KERNEL32 ref: 00657DD1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00657DEA
UnhandledExceptionFilter.KERNEL32(?), ref: 00657DF4

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 7e27b2662fc767402c49c31f315510f9019aa356b236e5426459b729e9ae17a9
Instruction ID: 21e671499ab8102815886f22b1c2bdc092aa648de8f1b9f968385359feea6e05
Opcode Fuzzy Hash: 7e27b2662fc767402c49c31f315510f9019aa356b236e5426459b729e9ae17a9
Instruction Fuzzy Hash: A431F4B5D053199BDF21DFA4D9497CDBBB8BF08301F1041EAE80DAB250EB719A888F45

Function 0066E4B1 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00664CF0: GetLastError.KERNEL32(?,00000008,00667C7C), ref: 00664CF4
Part of subcall function 00664CF0: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 00664D96

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0066E505
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0066E54F
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0066E615

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 2b553e2c87efd7b273c96149dbcc3416274dc6b62c2926314f0bd898f9963f34
Instruction ID: afda1db84c3fb6bc78cf9a33c69bd4e03062704be8773dedcd750ec027d83e62
Opcode Fuzzy Hash: 2b553e2c87efd7b273c96149dbcc3416274dc6b62c2926314f0bd898f9963f34
Instruction Fuzzy Hash: 3D61C0759146079FEB689F28CD82BBA77AAFF14304F14417AF906C6281FB36D981CB50

Function 0065BA33 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000001), ref: 0065BB2B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 0065BB35
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000001), ref: 0065BB42

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 54fd3e70f3504766c82372593caa8483cd14c64941b424af58bc3f45549856ab
Instruction ID: dd5987bc7a6e59f172aaa4035d8787deb0da1e7ab6c2d2592238fd74cc37b2ca
Opcode Fuzzy Hash: 54fd3e70f3504766c82372593caa8483cd14c64941b424af58bc3f45549856ab
Instruction Fuzzy Hash: FE31F4709012189BCB21DF28D989BCCBBB9BF08311F5051DAE81CA7290EB709F858F49

Function 006661B9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00663F79,?,20001004,00000000,00000002,?,?,0066357B), ref: 006661ED

Strings

`e, xrefs: 006661D8

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: `e
API String ID: 2299586839-3155454700
Opcode ID: 0d735395fc299196246d7745ce985846090e83edb44ff1ca26b49f5fa63eb5fe
Instruction ID: e06fd9ec0d35ef0b2cf0a6c3f1a5fb2d65931a738daa8571a55c3dc3fb9767e3
Opcode Fuzzy Hash: 0d735395fc299196246d7745ce985846090e83edb44ff1ca26b49f5fa63eb5fe
Instruction Fuzzy Hash: 4AE04F36500618BBCF122F65EC09A9E7F17EF45750F044024FD0566262CB318E62AAD5

Function 00661610 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e77ca6b40ea3d647f5f3c1f769e10ded7ec5cf0c925bf278261e39e08d96d96
Instruction ID: daaf4cc949c014f818f96f8c2675d61e7a2273dc833f871fef9c247ac8a87c41
Opcode Fuzzy Hash: 7e77ca6b40ea3d647f5f3c1f769e10ded7ec5cf0c925bf278261e39e08d96d96
Instruction Fuzzy Hash: 8CF13D75E012199FDF14CFA9C8906EDB7B2FF89314F198269E819AB381D7309E05CB94

Function 00665379 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00665374,?,?,00000008,?,?,00672CF2,00000000), ref: 006655A6

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: c94143eb21b1da95d88d9347ee8a3045d47ac81bf341b2f61c333dbaa749a6f6
Instruction ID: 8a074d1aa3a9ca02897382ab0a0c1fef95d60d9445ca44f994db9033d3fe8f1c
Opcode Fuzzy Hash: c94143eb21b1da95d88d9347ee8a3045d47ac81bf341b2f61c333dbaa749a6f6
Instruction Fuzzy Hash: 80B14E31610A05DFD714CF28C48ABA57BE2FF45365F658698E89ACF3A1C735E982CB40

Function 006577CC Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 006577E2

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 616acd295656652ff676d7fe509f57111115180b16144e4b3303db227ebd3004
Instruction ID: 9f7921fab7be61f3f86af4fb8e28983bc58745eb506a788471b7d3743baa9dbb
Opcode Fuzzy Hash: 616acd295656652ff676d7fe509f57111115180b16144e4b3303db227ebd3004
Instruction Fuzzy Hash: 245184B190421A8FEB14CF54E985BAABBF6FB44311F14953AD906EB350D375DE04CBA0

Function 00653D50 Relevance: 1.6, Strings: 1, Instructions: 379COMMON

Download Yara Rule

Strings

ddg, xrefs: 00654183, 0065418B

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: ddg
API String ID: 0-1658380470
Opcode ID: be2a48b1db288d49fe1c08414fd3a78b4bf14ac2908d1b6c36fb6952353ec9c9
Instruction ID: f52442fb987181edcf96afa6e43104e71616a86a4966cd7c5af30b68f5d11a9d
Opcode Fuzzy Hash: be2a48b1db288d49fe1c08414fd3a78b4bf14ac2908d1b6c36fb6952353ec9c9
Instruction Fuzzy Hash: 0FD1BC729087509FC715DF28C841A6FBBF6BFC8745F044A1DF989A7211E730EA488B92

Function 0065E4FA Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

0, xrefs: 0065E688

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 524f2e42b8964f15a8f6d0ef55bc93c579cbd825beb4abc80a2c0f2abb25b09b
Instruction ID: 2869ef85be4b69e5b9b3878f9e62e443582914c1e7e4a0e13d79aafa773ec2eb
Opcode Fuzzy Hash: 524f2e42b8964f15a8f6d0ef55bc93c579cbd825beb4abc80a2c0f2abb25b09b
Instruction Fuzzy Hash: 1FC1AF70A006468FCF2CCF68C494AAAB7B3AF15306F24461DDC9697391E723AE4DCB51

Function 0066E704 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00664CF0: GetLastError.KERNEL32(?,00000008,00667C7C), ref: 00664CF4
Part of subcall function 00664CF0: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 00664D96

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0066E758

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: d2c533d2bedbd60a7c9400c7674030c780dc6b36300398e5a2110c009d25e195
Instruction ID: 5930e12c25ab27bffd5f681fc328ca4a0b3398003dd093dda0292b727a274308
Opcode Fuzzy Hash: d2c533d2bedbd60a7c9400c7674030c780dc6b36300398e5a2110c009d25e195
Instruction Fuzzy Hash: E321A476A1520AABEB289F25DC42EBA77AEEF44714F10007EFD05D6281EB35ED40CB54

Function 0066E38B Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00664CF0: GetLastError.KERNEL32(?,00000008,00667C7C), ref: 00664CF4
Part of subcall function 00664CF0: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 00664D96

EnumSystemLocalesW.KERNEL32(0066E4B1,00000001,00000000,?,-00000050,?,0066EAE2,00000000,?,?,?,00000055,?), ref: 0066E3FD

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a784912a67231f208df3562ff9d64dcb2bdf9c75a8847f5c49f2d440ba6a7a3a
Instruction ID: 2448d0d0e3408c936356b9fd278fed9362cfb0028d690001fbb99f52b5077d0d
Opcode Fuzzy Hash: a784912a67231f208df3562ff9d64dcb2bdf9c75a8847f5c49f2d440ba6a7a3a
Instruction Fuzzy Hash: B911E53A6007015FDB189F39D8915BAB792FF80759B15442CE98687B40DB76B942C740

Function 0066E933 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00664CF0: GetLastError.KERNEL32(?,00000008,00667C7C), ref: 00664CF4
Part of subcall function 00664CF0: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 00664D96

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0066E7AE,00000000,00000000,?), ref: 0066E95F

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 42db8f513bb03c218d8773010e91a24207ea986a394b9c21be43075561e7c915
Instruction ID: 6d2ac373bdb1864ec770ccd39696293cb7adbf146e822c5f2081aa6072d7b34d
Opcode Fuzzy Hash: 42db8f513bb03c218d8773010e91a24207ea986a394b9c21be43075561e7c915
Instruction Fuzzy Hash: 36F0A93A610111BFDF685B25C8457FA7B6AEF40754F194528EC06A3244EA75FD41C5D0

Function 0066E299 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00664CF0: GetLastError.KERNEL32(?,00000008,00667C7C), ref: 00664CF4
Part of subcall function 00664CF0: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 00664D96

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0066E2ED

Strings

utf8, xrefs: 0066E25C

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 15871a54e9a1290223f98e1737a6e975721f0f6336295a83ba45566fdac4bd4a
Instruction ID: 4483a83a6a2298656b38971477175b931deab20d075ae58d06e6826ede4e56ec
Opcode Fuzzy Hash: 15871a54e9a1290223f98e1737a6e975721f0f6336295a83ba45566fdac4bd4a
Instruction Fuzzy Hash: 52F0C836651105ABC714AB38EC56EBA33AEDF59710F10007DBA06D7241EE78AD058794

Function 0066E426 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00664CF0: GetLastError.KERNEL32(?,00000008,00667C7C), ref: 00664CF4
Part of subcall function 00664CF0: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 00664D96

EnumSystemLocalesW.KERNEL32(0066E704,00000001,?,?,-00000050,?,0066EAA6,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0066E470

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a92f0f00dd3651971a58466246e1f60ccb54e0923215fcc75265d844ba4c88b3
Instruction ID: 40e8198db56d532ccc1e124368a5d5fea0930ce92c0e37781b6f1e204ae0d495
Opcode Fuzzy Hash: a92f0f00dd3651971a58466246e1f60ccb54e0923215fcc75265d844ba4c88b3
Instruction Fuzzy Hash: DCF0F67A3003046FDB249F39D885ABB7BD6EF80768F15842DF9054B680DA729C42C690

Function 00665C53 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0065F659: EnterCriticalSection.KERNEL32(?,?,00662041,00000000,00680308,0000000C,00662008,?,?,006659F2,?,?,00664E8E,00000001,00000364,?), ref: 0065F668

EnumSystemLocalesW.KERNEL32(00665C46,00000001,006804D8,0000000C,006660B5,00000000), ref: 00665C8B

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 61e132c5d671d824e9820beb11676206945b7a8e4f4ecda2ea43bdaebffadf7e
Instruction ID: ef27f170836e320d8a91a356d553cb06cc9eae1bcad8efeffe092d3c98b0e1dc
Opcode Fuzzy Hash: 61e132c5d671d824e9820beb11676206945b7a8e4f4ecda2ea43bdaebffadf7e
Instruction Fuzzy Hash: 1AF03776A04704EFD744EF98E842BA877A2FB05721F10412AF915AB2A1CB7559048F54

Function 0066E340 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00664CF0: GetLastError.KERNEL32(?,00000008,00667C7C), ref: 00664CF4
Part of subcall function 00664CF0: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 00664D96

EnumSystemLocalesW.KERNEL32(0066E299,00000001,?,?,?,0066EB04,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0066E377

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 05c8fe6d7749093dfbb9a8e994768124617da43e511f15b33b272fa541bb8bf3
Instruction ID: b726b6c203c3f93c16103e55c632fcbf8725c8b699bdcef3771ee0e6582d03ce
Opcode Fuzzy Hash: 05c8fe6d7749093dfbb9a8e994768124617da43e511f15b33b272fa541bb8bf3
Instruction Fuzzy Hash: 01F0AB3A30020597CB089F3AD809AABBF96EFC1720B0B005CFE09CB781C632D942C790

Function 00657E55 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007E61,006572F3), ref: 00657E5A

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a3669498a42d9e5220e0fe876274c9a079c96da65c89ff277f2e5e43477907be
Instruction ID: e3b75703fbb10fbcf104bbdd9cd6d6a4545b7c3cdf7b4114b7e389422049cede
Opcode Fuzzy Hash: a3669498a42d9e5220e0fe876274c9a079c96da65c89ff277f2e5e43477907be
Instruction Fuzzy Hash:

Function 0066EC64 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0066EC64

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 5828ec36e9214e36f27fa254036199b57c7d97c63a6e233f8dcaa7ecf572ebf4
Instruction ID: 8a1496450b31a9e0a2c16abb6f179e342600f7743c34e85be07327f2890259f2
Opcode Fuzzy Hash: 5828ec36e9214e36f27fa254036199b57c7d97c63a6e233f8dcaa7ecf572ebf4
Instruction Fuzzy Hash: BDA011302022008B8B008F30AB08A083AAABA80280308A0A8A008C02A0EA288080AA00

Function 0065E1B2 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 708ba0e2f93da3dc06af356410f57d6997c240582a00b32ccae21ce1edf30f5c
Instruction ID: 634147693ce616871421398df136e08bd5df89a5734cb3f5d280916ddcfdb538
Opcode Fuzzy Hash: 708ba0e2f93da3dc06af356410f57d6997c240582a00b32ccae21ce1edf30f5c
Instruction Fuzzy Hash: 6FB19E7090060A8BCF2CCFA8C5556FEB7EBAB05302F14461EEC52D7395D622AB4ACB55

Function 00667730 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 731efcd965afb7d31dce2c77440add49c71747e3569c2edbd24de8de140de030
Instruction ID: 655de6fd7d1b6bd6d220f74c76ea9edc318424b649a4518c386a7012eecad820
Opcode Fuzzy Hash: 731efcd965afb7d31dce2c77440add49c71747e3569c2edbd24de8de140de030
Instruction Fuzzy Hash: D9E08C72A15238EBCB24DB88D904A8AF7EDEB44B04F15009AB501D3201C670EE00CBD0

Function 00662AD4 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: add6a00aa613c972d8003628ebf23b8b2d772b70a53c982e1f0facc8b7adb8b4
Instruction ID: 77458e0e22a1184803233930f417ebc8b1fa91bf7359da6f536973d6f697ed39
Opcode Fuzzy Hash: add6a00aa613c972d8003628ebf23b8b2d772b70a53c982e1f0facc8b7adb8b4
Instruction Fuzzy Hash: A8C08C34415DC086CF39892882B13E63357B3D2782F80048CC4820B742C5DE9C82E782

Function 00651EE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00651EF5
std::_Lockit::_Lockit.LIBCPMT ref: 00651F0F
std::_Lockit::~_Lockit.LIBCPMT ref: 00651F30
std::_Lockit::~_Lockit.LIBCPMT ref: 00651F88
std::_Lockit::_Lockit.LIBCPMT ref: 00651FCD
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0065201E
__Getctype.LIBCPMT ref: 00652035
std::_Facet_Register.LIBCPMT ref: 0065205F
std::_Lockit::~_Lockit.LIBCPMT ref: 00652078

Part of subcall function 006550DA: std::invalid_argument::invalid_argument.LIBCONCRT ref: 006550E6

Strings

bad locale name, xrefs: 00652087

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeLocinfo::_Locinfo_ctorRegisterstd::invalid_argument::invalid_argument
String ID: bad locale name
API String ID: 2137871723-1405518554
Opcode ID: 7d450c6d958953dc8e59ec8dd347e38fcb66ffdaa8969227193c0fa2876ac4a6
Instruction ID: f09ae62f4668ee2c6fcd11ad1ec56c9b034c970918f4b1d32946fa0db3cea33c
Opcode Fuzzy Hash: 7d450c6d958953dc8e59ec8dd347e38fcb66ffdaa8969227193c0fa2876ac4a6
Instruction Fuzzy Hash: 6641EF315083408FC360DF18D890BAABBE2AF92725F14455DFC999B352DB31E84ECB92

Function 006520A0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 006520B2
std::_Lockit::_Lockit.LIBCPMT ref: 006520CF
std::_Lockit::~_Lockit.LIBCPMT ref: 006520F0
std::_Lockit::~_Lockit.LIBCPMT ref: 0065214B
std::_Lockit::_Lockit.LIBCPMT ref: 0065218C
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 006521CF
std::_Facet_Register.LIBCPMT ref: 006521F8
std::_Lockit::~_Lockit.LIBCPMT ref: 00652211

Part of subcall function 006550DA: std::invalid_argument::invalid_argument.LIBCONCRT ref: 006550E6

Strings

bad locale name, xrefs: 00652220

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Locinfo::_Locinfo_ctorRegisterstd::invalid_argument::invalid_argument
String ID: bad locale name
API String ID: 3096327801-1405518554
Opcode ID: 3fde9a182ce82c0bd810540d6449788bfa34015a95815ad3703a124e48ee0b77
Instruction ID: 54f8be7899c44998491f485f85121c0e02a1d6fa1e8e6ee85cbd0ca2f7aa4aad
Opcode Fuzzy Hash: 3fde9a182ce82c0bd810540d6449788bfa34015a95815ad3703a124e48ee0b77
Instruction Fuzzy Hash: 2A41D0719043428FC360DF18D8A0A9BBBE2BF95721F04445DED8997351DB30E94ECB96

Function 00652FB0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00653011
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00653058
Concurrency::cancel_current_task.LIBCPMT ref: 0065311A
Concurrency::cancel_current_task.LIBCPMT ref: 0065311F
Concurrency::cancel_current_task.LIBCPMT ref: 00653124

Strings

bad locale name, xrefs: 00653129
false, xrefs: 006530B2
true, xrefs: 006530D8

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: 15a02b0ab0b3d366a59ef46d9f6db4e0a799d1544d788fa5dc898e74898009df
Instruction ID: 373a1068fb8ea2435a86be7ba9b97c2fa05d003f81be7e5ba8004a766bbb7d96
Opcode Fuzzy Hash: 15a02b0ab0b3d366a59ef46d9f6db4e0a799d1544d788fa5dc898e74898009df
Instruction Fuzzy Hash: 4141D031505B409FC360EF64888179ABBE2AF54B02F44582DFC8987392E771DA4DCB96

Function 00657182 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00657188
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00657196
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 006571A7
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 006571B8

Strings

GetTempPath2W, xrefs: 006571AD
kernel32.dll, xrefs: 00657183
GetCurrentPackageId, xrefs: 00657190
GetSystemTimePreciseAsFileTime, xrefs: 0065719C

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 4649156a776ec253f4fdc61f8e5a783f7b17795af1a563f44c0bbd98e522228a
Instruction ID: 5f4995b31e9a15f18fc795d4332213c09af1537f7897ba140006a9d99f3bfc54
Opcode Fuzzy Hash: 4649156a776ec253f4fdc61f8e5a783f7b17795af1a563f44c0bbd98e522228a
Instruction Fuzzy Hash: DDE08C71944B10AFC300AF70FE0CC5A3EE7EE093013026521F519C2561D6704181CF90

Function 0065A948 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0065AA67
___TypeMatch.LIBVCRUNTIME ref: 0065AB75
_UnwindNestedFrames.LIBCMT ref: 0065ACC7
CallUnexpected.LIBVCRUNTIME ref: 0065ACE2

Strings

csm, xrefs: 0065A9F2
csm, xrefs: 0065A985
csm, xrefs: 0065AA9E

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 3a9ad7f7599f7876b2bf692ec32975db21f308a4fab5abaf8768daed656c4588
Instruction ID: d1633a4fc4f17a851dab237f668f11a5e51d21e1301761cff90c780a3ff39d75
Opcode Fuzzy Hash: 3a9ad7f7599f7876b2bf692ec32975db21f308a4fab5abaf8768daed656c4588
Instruction Fuzzy Hash: 20B1487180020AEFCF25DFE4C9819AEBBB6FF04312F14465AEC156B212D731DA59CB96

Function 0066A76A Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 0066A9E3

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 219d8bbcfb1cf8f177198f9a44aba936c4bc10d324b7104ef1a68f1796210548
Instruction ID: 265eb3ba71d0f09f745dd0569f3e7bcffda55fbc374346f93422bdcb379fb7d7
Opcode Fuzzy Hash: 219d8bbcfb1cf8f177198f9a44aba936c4bc10d324b7104ef1a68f1796210548
Instruction Fuzzy Hash: A2B1CF74A00249AFDB15DFE9C980BBEBBB3AF49310F144169E445AB392C7719D42CF62

Function 00673004 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 006730AA
__alloca_probe_16.LIBCMT ref: 00673165
__alloca_probe_16.LIBCMT ref: 006731F4
__freea.LIBCMT ref: 0067323F
__freea.LIBCMT ref: 00673245
__freea.LIBCMT ref: 0067327B
__freea.LIBCMT ref: 00673281
__freea.LIBCMT ref: 00673291

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 44acd867636759317240caf3a428e530ebd0888fe4ded679ee79459a0d30c5f5
Instruction ID: 7942d96346f48d87c7a6708026ccff54b75ce60b1fc0f2a3903221541b991895
Opcode Fuzzy Hash: 44acd867636759317240caf3a428e530ebd0888fe4ded679ee79459a0d30c5f5
Instruction Fuzzy Hash: F671F572A042296BDF209EA4DC41BEE77BB9F45310F188059E85CB7392E735DF00A764

Function 00656E58 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00656EA1
__alloca_probe_16.LIBCMT ref: 00656ECD
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00656F0C
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00656F29
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00656F68
__alloca_probe_16.LIBCMT ref: 00656F85
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00656FC7
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00656FEA

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: f81eadfc8fdb5226f57ce123d228eb2ce6d67be9a3473ac7f89e01abd64a4780
Instruction ID: de8ef28d3a56e22ee77ac95c3000c888a4dc3a5a78071861089b04f76ffe57f0
Opcode Fuzzy Hash: f81eadfc8fdb5226f57ce123d228eb2ce6d67be9a3473ac7f89e01abd64a4780
Instruction Fuzzy Hash: 1551B07290420AABEF214F54EC45FAB7BBBEB44752F544428FD1597290E730DC58CB60

Function 006559ED Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006559F4
std::_Lockit::_Lockit.LIBCPMT ref: 006559FE

Part of subcall function 00652CF0: std::_Lockit::_Lockit.LIBCPMT ref: 00652CFF
Part of subcall function 00652CF0: std::_Lockit::~_Lockit.LIBCPMT ref: 00652D1A

codecvt.LIBCPMT ref: 00655A38
std::_Facet_Register.LIBCPMT ref: 00655A4F
std::_Lockit::~_Lockit.LIBCPMT ref: 00655A6F

Strings

`e, xrefs: 00655A5C

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID: `e
API String ID: 712880209-3155454700
Opcode ID: a8c9bf2b17ebf8839c99ff4b448dd98a537f28b28c886b8eeb3ef3f8877c3aa3
Instruction ID: df16d0a1e246b7c7cfa368982ba6be8f86fbe8781a5e85c4c1b5e2cc06cace43
Opcode Fuzzy Hash: a8c9bf2b17ebf8839c99ff4b448dd98a537f28b28c886b8eeb3ef3f8877c3aa3
Instruction Fuzzy Hash: 9711E4719006249FCB50EF68D8596AEBBA6AF44711F14451DEC06A7382DF70AE09CB98

Function 006554AA Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006554B1
std::_Lockit::_Lockit.LIBCPMT ref: 006554BC
std::_Lockit::~_Lockit.LIBCPMT ref: 0065552A

Part of subcall function 0065560D: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00655625

std::locale::_Setgloballocale.LIBCPMT ref: 006554D7
_Yarn.LIBCPMT ref: 006554ED

Strings

`e, xrefs: 006554F9, 0065551D

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID: `e
API String ID: 1088826258-3155454700
Opcode ID: cfdb15055efa06a1e094fdb781943373432047ca013f92e9b3f81cbaf93ef6cf
Instruction ID: 2d07f0ac75d7c8453a973daa88a6fb9855f778461ca5354a346b1ce322988270
Opcode Fuzzy Hash: cfdb15055efa06a1e094fdb781943373432047ca013f92e9b3f81cbaf93ef6cf
Instruction Fuzzy Hash: F6018475A00A209BCB45EF24D85997D7B63BF84311F54404DEC1657391DF346E4ACB89

Function 00662AF6 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,226D7AA9,?,?,00000000,006747C0,000000FF,?,00662A86,?,?,00662A5A,00000016), ref: 00662B2B
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00662B3D
FreeLibrary.KERNEL32(00000000,?,00000000,006747C0,000000FF,?,00662A86,?,?,00662A5A,00000016), ref: 00662B5F

Strings

mscoree.dll, xrefs: 00662B24
CorExitProcess, xrefs: 00662B35
`e, xrefs: 00662B4E

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll$`e
API String ID: 4061214504-3383481718
Opcode ID: ae310759e8752527101bc83c1c1e7122fa9479694642c0f430f1871937f694f7
Instruction ID: 76780d826306ecb7885022943c00d26041834e648be49110eb22936ca68ea950
Opcode Fuzzy Hash: ae310759e8752527101bc83c1c1e7122fa9479694642c0f430f1871937f694f7
Instruction Fuzzy Hash: 2A018631940A5AEFDB158F54DC09FEEBBFAFB04B15F004625F815A22D0DB749944CBA4

Function 00652230 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0065223D
std::_Lockit::_Lockit.LIBCPMT ref: 0065225B
std::_Lockit::~_Lockit.LIBCPMT ref: 0065227C
std::_Lockit::~_Lockit.LIBCPMT ref: 006522CC
std::_Facet_Register.LIBCPMT ref: 006522F6
std::_Lockit::~_Lockit.LIBCPMT ref: 0065230F

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Register
String ID:
API String ID: 1858714459-0
Opcode ID: cfc6f9b9dd96275cb885e1aad4146b7b9a63aa21721cc0dbe61a421cecb5e63f
Instruction ID: 09099ffc790d7ed39e95fbf05ff6bce63cd464035d5c52b020c571fa9b0e4f12
Opcode Fuzzy Hash: cfc6f9b9dd96275cb885e1aad4146b7b9a63aa21721cc0dbe61a421cecb5e63f
Instruction Fuzzy Hash: 702104369042128BC710EF18E8609AAB3A3FF81332F14055DEC4957361DB35AE4ECBD2

Function 0065A5DA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0065A5D1,00658D0A,00657EA5), ref: 0065A5E8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0065A5F6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0065A60F
SetLastError.KERNEL32(00000000,0065A5D1,00658D0A,00657EA5), ref: 0065A661

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 862f77878c11239966222ce7484d565a2b3e1d8a364170158c9adde0214c1d05
Instruction ID: 350a1f79103f14f482952b338642c833129839ca06c3d0ae3243d0df91ef9ff6
Opcode Fuzzy Hash: 862f77878c11239966222ce7484d565a2b3e1d8a364170158c9adde0214c1d05
Instruction Fuzzy Hash: 3A0128322097159E975427B47C86DB62A5BEF01773F24733EFC10522E0EF915C0A5149

Function 0065A6F1 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0065A7B8
___AdjustPointer.LIBCMT ref: 0065A7DB
___AdjustPointer.LIBCMT ref: 0065A877

Strings

`e, xrefs: 0065A750

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID: `e
API String ID: 1740715915-3155454700
Opcode ID: f0b2bbd1e6c34365a126457071400ccb077eb59af86761ca5b5000674373a072
Instruction ID: b7e6d38efa1c2a4773a429dc3383fea55a997a0a4946e20b1ef88eed83f2bbec
Opcode Fuzzy Hash: f0b2bbd1e6c34365a126457071400ccb077eb59af86761ca5b5000674373a072
Instruction Fuzzy Hash: 4251C376A01206AFDB288F94D841BBA77A6FF04312F14462DEC1557791E731AC4ACB92

Function 006686F3 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0066877A
__alloca_probe_16.LIBCMT ref: 0066883B
__freea.LIBCMT ref: 006688A2

Part of subcall function 00666756: HeapAlloc.KERNEL32(00000000,?,?,?,006571E1,?,?,0065142D,?,?,00675C1E,?,?), ref: 00666788

__freea.LIBCMT ref: 006688B7
__freea.LIBCMT ref: 006688C7

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: bbf9339359732202b5d81dfea1f0df5e3aefafd6253f0888a936626557f61b04
Instruction ID: 8cbf7f397b7b751e89792bf5926f83123a0183022c28b357de56cbc343835288
Opcode Fuzzy Hash: bbf9339359732202b5d81dfea1f0df5e3aefafd6253f0888a936626557f61b04
Instruction Fuzzy Hash: 8C518F72600206AFEB219FB5DC81EFB3AABEF44350B55022DFD04E7251EE35CD5096A4

Function 0065A3E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0065A41F
__IsNonwritableInCurrentImage.LIBCMT ref: 0065A4D3

Strings

csm, xrefs: 0065A4BD
`e, xrefs: 0065A4EC

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm$`e
API String ID: 3480331319-707837221
Opcode ID: 6f52682abf0db7a06e32806a6f21e5a5365de21fff6317767bf28ef421cfc487
Instruction ID: 96cceb7c0b3e7f2656d9ae0eaca30ff9999946ed4b894c3fcd1e3fca5efda92d
Opcode Fuzzy Hash: 6f52682abf0db7a06e32806a6f21e5a5365de21fff6317767bf28ef421cfc487
Instruction Fuzzy Hash: 6141D634A002089FCF10DFA8C845A9EBBE7EF45325F148259EC199B352D771A949CB92

Function 0065B722 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(0067FDAC,00000000,00000800,?,0065B6D3,00000000,?,?,?,?,?,0065B7FD,00000002,FlsGetValue,00677E78,FlsGetValue), ref: 0065B72F
GetLastError.KERNEL32(?,0065B6D3,00000000,?,?,?,?,?,0065B7FD,00000002,FlsGetValue,00677E78,FlsGetValue,00000000,?,0065A68D), ref: 0065B739
LoadLibraryExW.KERNEL32(0067FDAC,00000000,00000000,?,0067FDAC,?,?,?,?,?,?,0067FC80,string too long,0067FC80,0067FC80), ref: 0065B761

Strings

api-ms-, xrefs: 0065B746

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: f11122d260deb7111f126ff625c3623f691db8d494f0a24f5fd29ae2b0241ef3
Instruction ID: 38314b019c62166ea08c328687fc88a82c7f273adb37e21e68e5188e9f98daac
Opcode Fuzzy Hash: f11122d260deb7111f126ff625c3623f691db8d494f0a24f5fd29ae2b0241ef3
Instruction Fuzzy Hash: 7DE04F30684605FBEF102F61ED06B993B67AB45B41F10A020FD0DE82F1DB62E8549BA4

Function 00668CBC Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(226D7AA9,00000000,00000000,?), ref: 00668D1F

Part of subcall function 0066AEBC: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00668898,?,00000000,-00000008), ref: 0066AF68

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00668F7A
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00668FC2
GetLastError.KERNEL32 ref: 00669065

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 3e2941ce6485f76388b11edeeed8e39137c5eb6a9b59b90d9cf6d79baef3cfc9
Instruction ID: 01d2e5add3c093fbcff62ab0e9c1a567fbc887f658c01d22dfdcbfa7a9e48967
Opcode Fuzzy Hash: 3e2941ce6485f76388b11edeeed8e39137c5eb6a9b59b90d9cf6d79baef3cfc9
Instruction Fuzzy Hash: 68D16A75D042589FCF15CFA8D8809EDBBBAFF49314F28416AE856E7351DB30A942CB60

Function 0066B2D8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0066AEBC: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00668898,?,00000000,-00000008), ref: 0066AF68

GetLastError.KERNEL32 ref: 0066B33C
__dosmaperr.LIBCMT ref: 0066B343
GetLastError.KERNEL32(?,?,?,?), ref: 0066B37D
__dosmaperr.LIBCMT ref: 0066B384

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: b327d36807fa8252490c9e7e927f1bdd665017cadeae6aa5d71586e7694e40a9
Instruction ID: 8b45b1ece33d496c3f89bec724d9318d55a683ab8fa4f81d03d4e300b14ff5ad
Opcode Fuzzy Hash: b327d36807fa8252490c9e7e927f1bdd665017cadeae6aa5d71586e7694e40a9
Instruction Fuzzy Hash: BC218E71700605EFDB20AF66C8819ABB7AFEF44364714952CF959E7351EB31EC908BA0

Function 00661B66 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02677cf44ad8c280345f36ff5f10dab5676d930166c80cd86640f52b32ca429
Instruction ID: 7ad96369509d64e6a74b7b34247529952cb7c88b44932f5f348fabce9620b69c
Opcode Fuzzy Hash: a02677cf44ad8c280345f36ff5f10dab5676d930166c80cd86640f52b32ca429
Instruction Fuzzy Hash: BF21CD31600605BFDB60AF61DC819AFB7ABEF463647185928F819DB250EB35EC408BA0

Function 0066C26E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0066C276

Part of subcall function 0066AEBC: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00668898,?,00000000,-00000008), ref: 0066AF68

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0066C2AE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0066C2CE

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: e462f952d68928431dc001e1737e3eb7c4be2929ac93f3f77fe6e00acd2980ac
Instruction ID: 34efedd3fc5bc348df3f530f4c986a0b1c9a48bd5e26796309959420deca4ab7
Opcode Fuzzy Hash: e462f952d68928431dc001e1737e3eb7c4be2929ac93f3f77fe6e00acd2980ac
Instruction Fuzzy Hash: 691104B2601E097EE72127F59D8ECBF6A6EDE843A87100128F806E1202FA349E4581B5

Function 00672E39 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,00671BF4,00000000,00000001,00000000,?,?,006690B9,?,00000000,00000000), ref: 00672E50
GetLastError.KERNEL32(?,00671BF4,00000000,00000001,00000000,?,?,006690B9,?,00000000,00000000,?,?,?,00669640,00000001), ref: 00672E5C

Part of subcall function 00672E22: CloseHandle.KERNEL32(FFFFFFFE,00672E6C,?,00671BF4,00000000,00000001,00000000,?,?,006690B9,?,00000000,00000000,?,?), ref: 00672E32

___initconout.LIBCMT ref: 00672E6C

Part of subcall function 00672DE4: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00672E13,00671BE1,?,?,006690B9,?,00000000,00000000,?), ref: 00672DF7

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,00671BF4,00000000,00000001,00000000,?,?,006690B9,?,00000000,00000000,?), ref: 00672E81

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: d9b8ae22a9cec35e3f0111a6732546c4b76f54988a1b4175cd74e990af8d1333
Instruction ID: bb001199445531c3968f759aaeb8fada429b1449cc2269e1fee6d5a0aa6013a8
Opcode Fuzzy Hash: d9b8ae22a9cec35e3f0111a6732546c4b76f54988a1b4175cd74e990af8d1333
Instruction Fuzzy Hash: 1BF0153680052ABBCF622FD5DC0C99A7F27EB083B0B049014FA0C85221C73289A09BA0

Function 006755F0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 238COMMON

Download Yara Rule

APIs

OffsetRect.USER32(00000000,00000000,00000000), ref: 00675716

Strings

Zatlat, xrefs: 00675650
0, xrefs: 006757A8

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: OffsetRect
String ID: 0$Zatlat
API String ID: 177026234-1547964091
Opcode ID: b26ce1d2425874173c8f3718448d860953e416c08159bf82b781951f48e0a4e2
Instruction ID: 3bab531afd7504f970d5fcaf537f8f9be47a2b3294dded006a53d278d477c7c9
Opcode Fuzzy Hash: b26ce1d2425874173c8f3718448d860953e416c08159bf82b781951f48e0a4e2
Instruction Fuzzy Hash: 0D910F315087808FD310DF28C895B6FBBE2AFC5318F584A6DF8C98B292C3B5D5488B56

Function 0065ACED Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0065AD12

Strings

MOC, xrefs: 0065AD24
RCC, xrefs: 0065AD2C

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 73ee98f6389a3fad698b97f5926271e85ba06418da60ce2f13c11857a653497c
Instruction ID: e0041dd6c25f361a89006d7d8c3ba6458d4dcbb1d6d6e466e80b97ff23332d8a
Opcode Fuzzy Hash: 73ee98f6389a3fad698b97f5926271e85ba06418da60ce2f13c11857a653497c
Instruction Fuzzy Hash: AC414971900209AFCF15DF94C982AEEBBB6FF48302F184299FD0467261D7359954DF92

Function 00655537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00655543
std::_Lockit::~_Lockit.LIBCPMT ref: 0065559F

Strings

`e, xrefs: 0065556A, 00655584

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: `e
API String ID: 593203224-3155454700
Opcode ID: 1b83a074cfee4bc2880ebed0ab8e3de08d404cea7cc38e065dbe731d97a43839
Instruction ID: 5a48bc90dbb9018e4c1aa6373352f5f95bf93c22edcb3622fb94ef9243ea7a5d
Opcode Fuzzy Hash: 1b83a074cfee4bc2880ebed0ab8e3de08d404cea7cc38e065dbe731d97a43839
Instruction Fuzzy Hash: D101B535600614EFCB05DB18C899E9D77B7EF84355F140099E8069B361EF70EE48CB50

Function 00652420 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00652425
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0065246A

Part of subcall function 006555A8: _Yarn.LIBCPMT ref: 006555C7
Part of subcall function 006555A8: _Yarn.LIBCPMT ref: 006555EB

Strings

bad locale name, xrefs: 00652478

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 1cf4976e2f997223a487336168ff1a725515796dd9c51b78386c634d16a2fa97
Instruction ID: c987a8c60132547469ca8b891b52b8de7a04a33fb48d0089927983367a6e3194
Opcode Fuzzy Hash: 1cf4976e2f997223a487336168ff1a725515796dd9c51b78386c634d16a2fa97
Instruction Fuzzy Hash: 64F01770101B408ED3B0DF39C415743BEE0AF29315F048A5DE8DAC7A42E375E548CBAA

Function 00666234 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 00666274

Strings

InitializeCriticalSectionEx, xrefs: 00666244
`e, xrefs: 00666264

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$`e
API String ID: 2593887523-1225887122
Opcode ID: 6a39e89ba973099bf33b89171225a1bc68e8e6dfd47bfe64c09533c4f4627ed1
Instruction ID: 1a401b6f9238a69108d3697926154cebbb17c71db16c2e13cda6b4777d690dd2
Opcode Fuzzy Hash: 6a39e89ba973099bf33b89171225a1bc68e8e6dfd47bfe64c09533c4f4627ed1
Instruction Fuzzy Hash: A5E09232180258B7CF112F91DC09D9E7F27EB54761F01C010FD0D25160C6B28A61DB91

Function 006660BA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 006660EE

Strings

FlsAlloc, xrefs: 006660CA
`e, xrefs: 006660E4

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: FlsAlloc$`e
API String ID: 2773662609-2626264062
Opcode ID: 6511020889e5315f406a22e3f878ff8d14aa90dc9a0f204449ca9a71a9cdb9cb
Instruction ID: 108806486a9bbeb506b9497777dabd5c9d48fa016e0da567329e9f2b6b381c36
Opcode Fuzzy Hash: 6511020889e5315f406a22e3f878ff8d14aa90dc9a0f204449ca9a71a9cdb9cb
Instruction Fuzzy Hash: A4E0C2316807A8B3C71037A0ED0AC9F7E07CB80B61B018030FE0D51292D9A149D1C6E7

Function 00652CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00652CFF
std::_Lockit::~_Lockit.LIBCPMT ref: 00652D1A

Strings

ios_base::badbit set, xrefs: 00652CF1

Memory Dump Source

Source File: 00000000.00000002.1761104122.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1761087802.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761308959.0000000000676000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761326554.0000000000681000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1761449438.00000000006CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_setup.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: ios_base::badbit set
API String ID: 593203224-3882152299
Opcode ID: de2d671080a7fc240998f32aa51542fe3ba30e485b4f8f0fc3ab2ec687952814
Instruction ID: a4998278354bf1a3f61e2522a69c2df159637af8efc93f6f758a385088e82496
Opcode Fuzzy Hash: de2d671080a7fc240998f32aa51542fe3ba30e485b4f8f0fc3ab2ec687952814
Instruction Fuzzy Hash: 20E08C71400202DFC324DF18E855BE1B3E2EF14322F20052EE4D983290EFB058C4CB80

Analysis Process: RegAsm.exePID: 3704, Parent PID: 5284COMMON

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	45
Total number of Limit Nodes:	6

Executed Functions

Function 00D9D0A8 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00D9D136
GetCurrentThread.KERNEL32 ref: 00D9D173
GetCurrentProcess.KERNEL32 ref: 00D9D1B0
GetCurrentThreadId.KERNEL32 ref: 00D9D209

Memory Dump Source

Source File: 00000002.00000002.1827132726.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d90000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 636b3ec42e69c77afb77798e37d796d62399bbd3127de892428b99d3a39f8005
Instruction ID: 35b3ed81ea8a7eab77e248c8463a2f1839776da2b62d5a5dd5794b3d9b37c6c4
Opcode Fuzzy Hash: 636b3ec42e69c77afb77798e37d796d62399bbd3127de892428b99d3a39f8005
Instruction Fuzzy Hash: B65137B0900349CFDB54CFAAD948BAEBBF2EF88314F24845DE419A73A0D7749944CB65

Function 00D9D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00D9D136
GetCurrentThread.KERNEL32 ref: 00D9D173
GetCurrentProcess.KERNEL32 ref: 00D9D1B0
GetCurrentThreadId.KERNEL32 ref: 00D9D209

Memory Dump Source

Source File: 00000002.00000002.1827132726.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d90000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 072158f05dba3223fb8bf004684526398157094b4624f3010bea19569c25b1ab
Instruction ID: c5fc3c34d1b16ebe563d500296ebcc85421605c64c930b7f14f10c11167885e4
Opcode Fuzzy Hash: 072158f05dba3223fb8bf004684526398157094b4624f3010bea19569c25b1ab
Instruction Fuzzy Hash: 3C5137B0900349CFDB54CFAAD948B9EBBF2EF88314F24845DE419A73A0D7749984CB65

Function 00D9AE30 Relevance: 1.7, APIs: 1, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00D9B086

Memory Dump Source

Source File: 00000002.00000002.1827132726.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d90000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 00133621c44e467151a474ae4fbd9b10019d61757175db24ba755e75f9bde4ae
Instruction ID: 514126c16023a87b6dc23c043fa3dc72e05063219365e197038418de231fc60e
Opcode Fuzzy Hash: 00133621c44e467151a474ae4fbd9b10019d61757175db24ba755e75f9bde4ae
Instruction Fuzzy Hash: E7816AB1A00B058FDB24DF29D14176ABBF1FF88304F14892EE08AD7A51D775E846CBA1

Function 00D95935 Relevance: 1.6, APIs: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00D959F1

Memory Dump Source

Source File: 00000002.00000002.1827132726.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d90000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 97bb3878e29e328c9a5d99974acd8bf34ee07c0d66f31c4d84ae9e69502f753f
Instruction ID: babfef6074e1a5cecdf115fd56efb134aeca5fbd69356b323f15406f29211549
Opcode Fuzzy Hash: 97bb3878e29e328c9a5d99974acd8bf34ee07c0d66f31c4d84ae9e69502f753f
Instruction Fuzzy Hash: 094113B0C00719CEDF25CFA9D984B9EBBB5FF84304F20816AD408AB255DB756946CFA0

Function 00D94248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00D959F1

Memory Dump Source

Source File: 00000002.00000002.1827132726.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d90000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5bc7e8d662363539f9ea18e39f64893ea678f92283b6aa86185122e871e46fdb
Instruction ID: 20313364027dffad0cd03889ce082bb564f98e3970fdd61f7dc096a429c916d6
Opcode Fuzzy Hash: 5bc7e8d662363539f9ea18e39f64893ea678f92283b6aa86185122e871e46fdb
Instruction Fuzzy Hash: 6541DFB0D00619CFDB25CFA9C984B9EBBB5FF48304F20816AD408AB255DBB56945CFA0

Function 00D9D2F9 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D9D387

Memory Dump Source

Source File: 00000002.00000002.1827132726.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d90000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 53b6b0f5d83535150d0a7a828bcc13cff15d638a5b7c2b78c9f558a29aa6f1b0
Instruction ID: 4ad8a91620a9a5f7ac7e9d04c6c4132bb85f9835ce7fd95bd3ed9431f217b338
Opcode Fuzzy Hash: 53b6b0f5d83535150d0a7a828bcc13cff15d638a5b7c2b78c9f558a29aa6f1b0
Instruction Fuzzy Hash: DD21E3B59002099FDB10CF9AD985AEEBBF5EB48310F24801AE918A3310D374A944CFA1

Function 00D9D300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D9D387

Memory Dump Source

Source File: 00000002.00000002.1827132726.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d90000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 25eb0e7a28910246ca8e4da26e244c08418ad39b6e7645139ba0203d2459d3cc
Instruction ID: 5f44373ea28584c9829f78b2e2a9bfcd8b7658fa08d372364be3d61fcb195620
Opcode Fuzzy Hash: 25eb0e7a28910246ca8e4da26e244c08418ad39b6e7645139ba0203d2459d3cc
Instruction Fuzzy Hash: BB21C4B5900249DFDB10CF9AD984ADEBFF5EB48320F14841AE918A7310D374A954DFA5

Function 00D9B2A0 Relevance: 1.6, APIs: 1, Instructions: 58
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,00D9B101,00000800,00000000,00000000), ref: 00D9B312

Memory Dump Source

Source File: 00000002.00000002.1827132726.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d90000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: abf3016b3e079cde1b6a940dbc22c8eb7fcfc8d3640c5dbccb62901eed89fc9a
Instruction ID: c9ca0580533f724a6e25f185dca6cb57b1991273b1430604fa1599f99482c5c8
Opcode Fuzzy Hash: abf3016b3e079cde1b6a940dbc22c8eb7fcfc8d3640c5dbccb62901eed89fc9a
Instruction Fuzzy Hash: E42117B69002499FCF10CF9AD544AEEFBF5EB98320F15842ED419A7300C775A945CFA5

Function 00D9A870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,00D9B101,00000800,00000000,00000000), ref: 00D9B312

Memory Dump Source

Source File: 00000002.00000002.1827132726.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d90000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 44f19fd068cfcd182ed67e08fc1b6bf776f029bfda0ce82b4a245f202d4c872e
Instruction ID: 7ec6c55692c45a5933d21f2bf3db5bfe9ef9497c3264119e3a3ebb6d0ae87815
Opcode Fuzzy Hash: 44f19fd068cfcd182ed67e08fc1b6bf776f029bfda0ce82b4a245f202d4c872e
Instruction Fuzzy Hash: 391114B6D003499FCB10CF9AD544A9EFBF5EB48320F15842EE819A7300C375A945CFA5

Function 00D9B020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00D9B086

Memory Dump Source

Source File: 00000002.00000002.1827132726.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d90000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 49c8b5b582cb9a7e2fda1798f796acf0cee02d99dafe0c56214d554138718b72
Instruction ID: d0ed35f658f14d9eec2169bf6fe7fbeed819937f95a3b6e7fc67063c6b254c84
Opcode Fuzzy Hash: 49c8b5b582cb9a7e2fda1798f796acf0cee02d99dafe0c56214d554138718b72
Instruction Fuzzy Hash: 33110FB5C003498FCB20CF9AD544A9EFBF5AB89324F14841AD428A7210C379A545CFA1

Function 00D3D774 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1826915050.0000000000D3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d3d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1917c32ef1cb376a8cf97f4d91231fc40a39e736ee99fd25ebe9605845849ba1
Instruction ID: bb5d4977bc4365ca4a72ea254d64da4f6b7491c476b19b02eedf8c36d5be205e
Opcode Fuzzy Hash: 1917c32ef1cb376a8cf97f4d91231fc40a39e736ee99fd25ebe9605845849ba1
Instruction Fuzzy Hash: 212106B1504240EFCB15CF14E9C0B26BFA6FB88314F24C569E9494B245C336E816DFB1

Function 00D3D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1826915050.0000000000D3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d3d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05dab6f924b7a2352b3b90b2aaafa4a7d682696b194cad7c03cd6a70b8b491a4
Instruction ID: 9191b37d52e458d4fb53ec509275491ce68adf248e2606d4d14eb8e2f5d76933
Opcode Fuzzy Hash: 05dab6f924b7a2352b3b90b2aaafa4a7d682696b194cad7c03cd6a70b8b491a4
Instruction Fuzzy Hash: 0D2125B1504204DFDB05DF14E9C0B26BF66FB94324F24C569E94A0B256C336E856DFB2

Function 00D3D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1826915050.0000000000D3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d3d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e535ca251eee153cadaf195a074bca614fe4d96152942a528c2ce2f0762e442
Instruction ID: 8373b969b1198394c7ec16aeac0ed4f076fdfbe454e3168a6c2cb3a1c8c2fc00
Opcode Fuzzy Hash: 9e535ca251eee153cadaf195a074bca614fe4d96152942a528c2ce2f0762e442
Instruction Fuzzy Hash: C82125B2504240DFCB15DF14E9C0B26BF66FB94318F24C569E9490B256C336D856DFB1

Function 00D4D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1826949629.0000000000D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d4d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a89a7e54ef74224c050f4d323441ad351093b149dc6f5e67f0c52228e0d86363
Instruction ID: 21d02550d04332ad164192c58b868947fd8f9de5481c81e4c11975ac31648087
Opcode Fuzzy Hash: a89a7e54ef74224c050f4d323441ad351093b149dc6f5e67f0c52228e0d86363
Instruction Fuzzy Hash: 942104B5604240DFCB14DF14D9C4B26BB66FB84314F24C96DE94A4B286C73AD847CB71

Function 00D4D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1826949629.0000000000D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d4d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e9024de70a485db2970b75393ec887b8c46bd6a135c5a4ea766f77dac84b926
Instruction ID: 8f8f0979a87b40c3daa06af802e13f147e22ea1ad7bfe5f5b2def5311429237a
Opcode Fuzzy Hash: 9e9024de70a485db2970b75393ec887b8c46bd6a135c5a4ea766f77dac84b926
Instruction Fuzzy Hash: 842180755093C08FCB12CF24D994715BF72EB46314F28C5EAD8498B6A7C33AD84ACB62

Function 00D3D76F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1826915050.0000000000D3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d3d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 390633afb84827573b5761d9362e8787b9a5bcb2a7aa5b15411ec10cb4b37b7d
Instruction ID: d06a5a7979e23c9ac482b68c710bceca88340e76191678af0ec26b26113719d8
Opcode Fuzzy Hash: 390633afb84827573b5761d9362e8787b9a5bcb2a7aa5b15411ec10cb4b37b7d
Instruction Fuzzy Hash: 6021D276404280DFCB16CF10E9C0B16BF72FB88314F28C6A9D9480B216C33AD826CFA1

Function 00D3D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1826915050.0000000000D3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d3d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc07a575d8e399a32a752274fa621ccc9f9672b2c77dae55393772abe3e3f78f
Instruction ID: e2eec2bd48552e5949ab9c09f15ba45b6ca32c317fc94d6e9429d1feaed6b3f6
Opcode Fuzzy Hash: cc07a575d8e399a32a752274fa621ccc9f9672b2c77dae55393772abe3e3f78f
Instruction Fuzzy Hash: FF110372404240CFCB12CF10E9C0B16BF72FB94324F28C2A9D8090B616C33AE85ACFA1

Function 00D3D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1826915050.0000000000D3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d3d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc07a575d8e399a32a752274fa621ccc9f9672b2c77dae55393772abe3e3f78f
Instruction ID: be2bf35d522fdc1684ca2241e461eb175a9effbcccc2c81a680799ccfe535530
Opcode Fuzzy Hash: cc07a575d8e399a32a752274fa621ccc9f9672b2c77dae55393772abe3e3f78f
Instruction Fuzzy Hash: 0411E676504280CFCB16CF14D9C4B16BF72FB94318F28C6A9D8494B656C33AD85ACFA1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_setup.exe_unknow_d795e61bb36a5b66a28bc5ab663876d6c3a884d6_99ceb0df_d18f51e4-4d2a-4fde-9e32-dff53f2c61f8\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5570.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER564C.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER566C.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Windows Analysis Report
setup.exe

Function 0127018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 00675940 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 214
synchronizationthreadCOMMON

Function 00675D30 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 61
libraryloaderCOMMON

Function 00675000 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74
threadCOMMON

Function 00665E1C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 0065F06A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
threadCOMMON

Function 0065F1C6 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 0065628D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108
COMMON

Function 00669572 Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Function 00669174 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 0066661A Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00665A1C Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 00675BF0 Relevance: 2.6, APIs: 2, Instructions: 98
sleepmemoryCOMMON