Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1467879
MD5:	0b147a2bc6013c0de94e6e30a8c419db
SHA1:	12ea4e8059b4c38fd1810a4847951a96b5305d38
SHA256:	7cf88e667498e50034c25767aaf38bca971a5c995f61fe686b44f7bcc0f71851
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6060 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 0B147A2BC6013C0DE94E6E30A8C419DB)

RegAsm.exe (PID: 2732 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 876 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 272 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "77.105.135.107:3445", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2246916102.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: file.exe PID: 6060	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 2732	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 2732	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.f35ae0.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.f35ae0.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.f00000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Snort Signatures

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 77.105.135.107 - Destination IP: 192.168.2.6

Timestamp:	07/05/24-00:25:02.988901
SID:	2046056
Source Port:	3445
Destination Port:	49711
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.6 - Destination IP: 77.105.135.107

Timestamp:	07/05/24-00:24:57.551670
SID:	2046045
Source Port:	49711
Destination Port:	3445
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.6 - Destination IP: 77.105.135.107

Timestamp:	07/05/24-00:25:09.628865
SID:	2043231
Source Port:	49711
Destination Port:	3445
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 77.105.135.107 - Destination IP: 192.168.2.6

Timestamp:	07/05/24-00:24:57.748151
SID:	2043234
Source Port:	3445
Destination Port:	49711
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "77.105.135.107:3445", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F1F6FD FindFirstFileExW,

0_2_00F1F6FD

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.6:49711 -> 77.105.135.107:3445
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.6:49711 -> 77.105.135.107:3445
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 77.105.135.107:3445 -> 192.168.2.6:49711
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 77.105.135.107:3445 -> 192.168.2.6:49711

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 77.105.135.107:3445

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 77.105.135.107:3445

Source: Joe Sandbox View

IP Address: 77.105.135.107 77.105.135.107

Source: Joe Sandbox View

ASN Name: PLUSTELECOM-ASRU PLUSTELECOM-ASRU

Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107

Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: RegAsm.exe, 00000002.00000002.2247362351.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purl.oen
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002B1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002DF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002B1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002B1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002B1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002DF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16V
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002DF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2247954383.0000000002B1A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002DF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002B1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002B1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002DF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002B1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003A7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000002.00000002.2246916102.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003A7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003A7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003A7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003A7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003A7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003A7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003A7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003A7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F02880	0_2_00F02880
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F1B11C	0_2_00F1B11C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F1125C	0_2_00F1125C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F03320	0_2_00F03320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F115A4	0_2_00F115A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F19D96	0_2_00F19D96
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F15570	0_2_00F15570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F21D31	0_2_00F21D31
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F236B5	0_2_00F236B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00ECDC74	2_2_00ECDC74

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00F0B8C0 appears 54 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 272

Source: file.exe, 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenamePunningly.exe8 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/6@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6060

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\738493fb-b533-4fe4-b840-7c8d1cdaed67

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000002.00000002.2247954383.0000000002FC8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2247954383.0000000002EB6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2247954383.0000000002FDE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2247954383.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2247954383.0000000002F34000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2247954383.0000000002F4A000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 55%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 272
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F0B288 push ecx; ret

0_2_00F0B29B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2A40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4A40000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Window / User API: threadDelayed 1944

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6996	Thread sleep time: -6456360425798339s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4136	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F1F6FD FindFirstFileExW,

0_2_00F1F6FD

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: RegAsm.exe, 00000002.00000002.2247629301.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll{
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: RegAsm.exe, 00000002.00000002.2247954383.00000000030C8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2247954383.0000000002C0C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2247954383.0000000002CE5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2247954383.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2247954383.0000000002B1A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2247954383.0000000002EE0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2247954383.0000000002E67000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2247954383.0000000002FE4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJm6+yF+1A6ySN83i+WdwHy5TP6AGa54yNOQDMt0K/OHXfg+kqThLIfk6QFsLDCjZdpZTGOzjUsCOwZe5C6Gi8Q8TVSedBLpSfsvQj8BDp18kmZ3ex54YP0+Gs0yuOc0oHyahpuklKSN9DNVuBZhWH/uMHS1PAuQ5a2Lju9F/SWeKm7prBc0jVP84iPJxdnHVJ/HDDDbXL54Z89qdU0Vcin6gqmwXrJjGgP4IA8IR19qewIwTnUCQdrTZp1GW0u9j1R6sUgPUrm2c5cvXl9oot3E2Yi+lA6TVxs+wzTv0RyoJlnAb/LVyrQ+JXXkt08JQiqZojt7zmAq6A6TMAI3d99XjZOb1H2Ej05cPkbrRi3jsQ/1cA/+FiEaSdYURoSjyCbui7SR58sFKCEAn3HKH4uwm3eDW6eeqSVnn3vRu5S+ZPUrZgKYs8lgl1/fYieGCfbdnVWn1in27qZ19Yfhv4WKpf3SAPgywfR4sYK3wdc8VGoHmK3TWFL5jmOUHB49Ogy2jYoedRvh3h9D96fGhUBv0WbVKW3Fxq4ViXVL2x9NKNgA+vC8A5zUncE8H2TafulfEOSRqFccYu86ht5uc0nLgpiCrzoulmnAYZLfk4zbvX51WQrYMsc8ORmzRWmqqLFXZVINxxVKaxrpheUhYRfRx54cZnzZZxdMOYT0VhpWbZdIcVFHnb3QBFJEgxwyQpCTte0yQjzn7uCUZsuA+iYIJO4a+Hmq+9ONtmOcMMYl7TbktlwpTMf366yxqm+uPbWY4CHOTnXrwGvPjnt7OfVwg2HHr8jHcJ5uzn/JOx/BvEfztbLR
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: RegAsm.exe, 00000002.00000002.2251488982.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F12C23 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00F12C23

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F19B12 mov eax, dword ptr fs:[00000030h]	0_2_00F19B12
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F169CE mov ecx, dword ptr fs:[00000030h]	0_2_00F169CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F19B56 mov eax, dword ptr fs:[00000030h]	0_2_00F19B56

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F22E46 GetProcessHeap,

0_2_00F22E46

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0B905 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00F0B905
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F12C23 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00F12C23
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0B69A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00F0B69A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0B7F6 SetUnhandledExceptionFilter,	0_2_00F0B7F6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_030F018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_030F018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: AB7008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F0B380 cpuid

0_2_00F0B380

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00F228E6
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00F189E6
Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00F22280
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00F22A0F
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00F22BE4
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00F22B15
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00F2247B
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00F2256D
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00F22522
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00F22693
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00F22608
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00F18F4C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F0B594 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00F0B594

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: RegAsm.exe, 00000002.00000002.2257609176.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.f35ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.f35ae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2246916102.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2732, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2732, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.f35ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.f35ae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2246916102.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2732, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	251 Security Software Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	134 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	55%	ReversingLabs	Win32.Trojan.Zusy
file.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	Avira URL Cloud	safe
77.105.135.107:3445	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Avira URL Cloud	safe
http://purl.oen	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17ResponseD	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
77.105.135.107:3445	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	RegAsm.exe, 00000002.00000002.2251488982.0000000003A7B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	RegAsm.exe, 00000002.00000002.2251488982.0000000003A7B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14ResponseD	RegAsm.exe, 00000002.00000002.2247954383.0000000002B1A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	RegAsm.exe, 00000002.00000002.2247954383.0000000002DF9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21Response	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	RegAsm.exe, 00000002.00000002.2247954383.0000000002B1A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id4	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://purl.oen	RegAsm.exe, 00000002.00000002.2247362351.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19Response	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13ResponseD	RegAsm.exe, 00000002.00000002.2247954383.0000000002B1A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15Response	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	RegAsm.exe, 00000002.00000002.2247954383.0000000002B1A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000002.00000002.2247954383.0000000002B1A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6Response	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	file.exe, 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000002.00000002.2246916102.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9Response	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegAsm.exe, 00000002.00000002.2251488982.0000000003A7B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24Response	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	RegAsm.exe, 00000002.00000002.2251488982.0000000003A7B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21ResponseD	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15ResponseD	RegAsm.exe, 00000002.00000002.2247954383.0000000002B1A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11ResponseD	RegAsm.exe, 00000002.00000002.2247954383.0000000002DF9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	RegAsm.exe, 00000002.00000002.2247954383.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17ResponseD	RegAsm.exe, 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
77.105.135.107	unknown	Russian Federation		42031	PLUSTELECOM-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467879
Start date and time:	2024-07-05 00:24:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/6@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 26 Number of non-executed functions: 60
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
18:24:57	API Interceptor	1x Sleep call for process: WerFault.exe modified
18:25:07	API Interceptor	11x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
77.105.135.107	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	setup.exe	Get hash	malicious	RedLine	Browse
	1719859269.0326595_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, Xmrig	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PLUSTELECOM-ASRU	vGUfP1M4Q6.elf	Get hash	malicious	Unknown	Browse	77.105.135.60
	dM258lnwNu.elf	Get hash	malicious	Unknown	Browse	77.105.135.60
	file.exe	Get hash	malicious	RedLine	Browse	77.105.135.107
	file.exe	Get hash	malicious	RedLine	Browse	77.105.135.107
	file.exe	Get hash	malicious	RedLine	Browse	77.105.135.107
	file.exe	Get hash	malicious	Unknown	Browse	77.105.133.27
	setup.exe	Get hash	malicious	RedLine	Browse	77.105.135.107
	1719859269.0326595_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, Xmrig	Browse	77.105.135.107
	zyJWi2vy29.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer, Vidar, zgRAT	Browse	77.105.132.27
	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse	77.105.132.27

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_77195de72e43971d48d6de71c532aaf1a8604b66_05e236d2_6637171a-30ad-41d5-b2b5-4ea79d4d8a51\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7046310291679819
Encrypted:	false
SSDEEP:	192:MshTWWstoS1vQPlYt50c2tj03juGzuiF1Z24IO8ThBwR:fQWgQNuac2tIjfzuiF1Y4IO8LU
MD5:	D517F7C4C591ABC51B8D3280574A1FC0
SHA1:	A658A25580E08805B097243D95967AAF23F750CD
SHA-256:	F7D065D0996B763F35B10D62631AE5AA67D1E18E11C82A95C0FF9E71313C27E8
SHA-512:	4EF42A501E204AC38230A4CAD872CD7758ACD215284ED583836D1DBDD0230925C4EC02CC945CEE6ED3F7274586DD0BCCA1E853F935A124ED514A54A5E6F0424E
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.4.6.0.5.4.9.4.4.6.5.0.7.6.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.4.6.0.5.4.9.5.4.6.5.0.7.5.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.6.3.7.1.7.1.a.-.3.0.a.d.-.4.1.d.5.-.b.2.b.5.-.4.e.a.7.9.d.4.d.8.a.5.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.b.7.b.e.7.f.d.-.1.2.7.3.-.4.2.7.3.-.b.8.2.2.-.9.6.e.5.b.c.b.0.c.8.6.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.a.c.-.0.0.0.1.-.0.0.1.5.-.7.e.3.2.-.2.a.f.e.6.0.c.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.1.2.e.a.4.e.8.0.5.9.b.4.c.3.8.f.d.1.8.1.0.a.4.8.4.7.9.5.1.a.9.6.b.5.3.0.5.d.3.8.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.7.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB989.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Jul 4 22:24:54 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	52764
Entropy (8bit):	1.8967416394315122
Encrypted:	false
SSDEEP:	192:j2O6AgcwNwbhtOlv2hb9oYrnUiRLt4djfmf/zu7Ojj6eZmEgaLtDTcM9i:j4PabylvzYzUwL65fmf/YzKmEFtD4
MD5:	291841BB1F2AF3889FFD6629EBEC700F
SHA1:	B94473F303879903BEB18EF5C13A6C9522D92B92
SHA-256:	6CEFE13A874A2BCC45CC041FA247C3EBEBC1779661FAB185F175A314F52E6821
SHA-512:	76356E237C51AD3D33159B08871FEC5E1AFB0099127184155D5C51666EE2E03CF862199A0890FDC1399FE1DF3F701DACE07DC7A3401FF8C2892134615C1D4ACD
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......6!.f........................0...........T...b$..........T.......8...........T...............,...........,...........................................................................................eJ..............GenuineIntel............T...........5!.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBA65.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8260
Entropy (8bit):	3.6872818743363704
Encrypted:	false
SSDEEP:	192:R6l7wVeJYCP6H6Y2DDSU90p18/gmfByjv4pDH89b6Nsfx9em:R6lXJ36H6YuSU90p18/gmfkvN6GfL
MD5:	E9F3870981B04BDFC743089D23BF2296
SHA1:	A1A510C9FB9734872521FB82C68AF1A66F827435
SHA-256:	ED93051EE0E356A17E90869D7CF566F9581912B0DA631CC312060CE4AF3BB46C
SHA-512:	B5EB9C9B0BB9680DB91FF791627AB51E403FA40532CE9B7B9F06F8F2131493301DA7DD4EB880BDA8914DF28BF3C56B4CE8DD0D76CFF9C57AF1329AF5CF5103D9
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.0.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBAA5.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	4.426041368373842
Encrypted:	false
SSDEEP:	48:cvIwWl8zs5Jg77aI9AzWpW8VYW5Ym8M4JvsFBu1P+q8mcn8KVd:uIjfLI7qC7VyJBPQn5Vd
MD5:	DA5157DF9CD036978718C34E81A6E12B
SHA1:	3107E5F382C3A753DE8990927795D7757ABF1FF5
SHA-256:	9A4812FF00EB486F1B2AEDFD490592E2D64C075C6B236E9B12D1BCCDC5A4598C
SHA-512:	582DEEEC93E6912194E6B7B7091F7EBB4A1EC8B725681C8A2C7B009D76FC5215FD2EE83D5E36B0114D343A3233AFEA82C5ED35B7C76C0FB3AC18F16D5D875C39
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="396807" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468439030221739
Encrypted:	false
SSDEEP:	6144:rzZfpi6ceLPx9skLmb0fGZWSP3aJG8nAgeiJRMMhA2zX4WABluuNbjDH5S:HZHtGZWOKnMM6bFp9j4
MD5:	996901F8E2D57FA25531DD94AE2F030F
SHA1:	7EC53A80BACEA1521795786EA81398AA954D2FA6
SHA-256:	B655261F344F7C1CF2BC5C51A43FCA1492B9C3288145992463CFEFA5B52FD3FC
SHA-512:	CA30DA276001E4EEAAA075ED3E147353FB2EA7B1E87084B9E75888BBE5C983B02E795975E6535554FAFBD46521016AAEE6B554E07F415442E298E00167169836
Malicious:	false
Reputation:	low
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.X..`...............................................................................................................................................................................................................................................................................................................................................D...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.630645733267501
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	530'432 bytes
MD5:	0b147a2bc6013c0de94e6e30a8c419db
SHA1:	12ea4e8059b4c38fd1810a4847951a96b5305d38
SHA256:	7cf88e667498e50034c25767aaf38bca971a5c995f61fe686b44f7bcc0f71851
SHA512:	066b3dbea66c6d7487998862dc90fb469d623a40227236d84271f54e07f613c4e7d9a510a0c5d926f4f9aa2fa7a7bed9323b00fc0785e9d4416c46674a0085ec
SSDEEP:	12288:E/U6a+H7rj53HjNjZOLJXz9A0UsyHOr0pyh:E/oc7xZjZqj952HOwc
TLSH:	F0B4E00175C08432E573123709E4EBB6AA7EF9700F655ECB6B880F6F8F612D1DA3165A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........1.kxb.kxb.kxbj.{c.kxbj.}c.kxbj.\|c.kxb{.\|c.kxb{.{c.kxbj.yc.kxb.kyb8kxb{.}c.kxbJ.qc.kxbJ.xc.kxbJ..b.kxbJ.zc.kxbRich.kxb.......

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40afb9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6686FB84 [Thu Jul 4 19:44:04 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	811cfc8e0687b9bcab4d19d1ac4a7df0

Entrypoint Preview

Instruction
call 00007F4B74E239C8h
jmp 00007F4B74E23219h
cmp ecx, dword ptr [00435040h]
jne 00007F4B74E233A3h
ret
jmp 00007F4B74E23D01h
jmp 00007F4B74E23ED1h
push ebp
mov ebp, esp
jmp 00007F4B74E233AFh
push dword ptr [ebp+08h]
call 00007F4B74E30686h
pop ecx
test eax, eax
je 00007F4B74E233B1h
push dword ptr [ebp+08h]
call 00007F4B74E2C8B7h
pop ecx
test eax, eax
je 00007F4B74E23388h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007F4B74E23EACh
jmp 00007F4B74E1FEC4h
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F4B74E23E96h
pop ecx
pop ebp
ret
push ebp
mov ebp, esp
test byte ptr [ebp+08h], 00000001h
push esi
mov esi, ecx
mov dword ptr [esi], 0042B35Ch
je 00007F4B74E233ACh
push 0000000Ch
push esi
call 00007F4B74E2337Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F4B74E233BBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F4B74E233ACh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F4B74E233AEh
add edx, 28h
cmp edx, esi
jne 00007F4B74E2338Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F4B74E2339Bh
push esi
call 00007F4B74E23E48h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x34160	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x341a8	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x82000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x83000	0x1f9c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x31fc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x31f00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2a000	0x164	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x27817	0x27a00	54e50506ee3457079b01d8f8d092f653	False	0.549475059148265	data	6.642285110957014	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.BSS	0x29000	0xdfd	0xe00	c8931465090505085f9d58aac99abd6b	False	0.6422991071428571	data	6.405204159056983	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2a000	0xa9c2	0xaa00	e520793fbdebdfa7a5b431864d88f430	False	0.4309512867647059	data	4.9597660102339365	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x35000	0x4cf84	0x4c000	6109adfbd26aaed69f45fedc418a8d27	False	0.9866654245476973	data	7.9888590462917035	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x82000	0x1e0	0x200	c35d66eb0330df7b21d6f51c26172ee0	False	0.52734375	data	4.704363013479242	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x83000	0x1f9c	0x2000	f19030931ad014e1637fe69a8d9b1875	False	0.749267578125	data	6.52060000230319	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x82060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

USER32.dll

OffsetRect, GetUpdateRgn

KERNEL32.dll

CreateFileW, HeapSize, GetProcessHeap, SetStdHandle, SetEnvironmentVariableW, VirtualAlloc, WaitForSingleObject, CreateThread, GetThreadId, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, GetCurrentThreadId, CloseHandle, WaitForSingleObjectEx, GetExitCodeThread, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, ReleaseSRWLockExclusive, WakeAllConditionVariable, QueryPerformanceCounter, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetCPInfo, IsProcessorFeaturePresent, GetCurrentProcessId, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetCurrentProcess, TerminateProcess, FreeEnvironmentStringsW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitThread, FreeLibraryAndExitThread, GetModuleHandleExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, WriteConsoleW

Exports

Name	Ordinal	Address
AwakeSound	1	0x429c70

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/05/24-00:25:02.988901	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	3445	49711	77.105.135.107	192.168.2.6
07/05/24-00:24:57.551670	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49711	3445	192.168.2.6	77.105.135.107
07/05/24-00:25:09.628865	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49711	3445	192.168.2.6	77.105.135.107
07/05/24-00:24:57.748151	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	3445	49711	77.105.135.107	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 00:24:56.861207962 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:24:56.866141081 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:24:56.866341114 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:24:56.875458002 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:24:56.880289078 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:24:57.518420935 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:24:57.551670074 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:24:57.558710098 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:24:57.748151064 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:24:57.789652109 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:02.793450117 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:02.798338890 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:02.988900900 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:02.988918066 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:02.988929987 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:02.988940954 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:02.988956928 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:02.988981009 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:02.989026070 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:03.116671085 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:03.121659994 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:03.310323000 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:03.332257032 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:03.338807106 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:03.527614117 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:03.534584045 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:03.541009903 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:03.729015112 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:03.730165958 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:03.735016108 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:03.934433937 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:03.962364912 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:03.974562883 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:04.162867069 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:04.166950941 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:04.173273087 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:04.361680031 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:04.365156889 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:04.369946957 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:04.558756113 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:04.602210045 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:04.642009974 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:04.867803097 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:05.180274010 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:05.623369932 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:05.623440027 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:05.623795986 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:05.623847008 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:05.624063969 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:05.624109030 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:05.626759052 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:05.626770020 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:05.629364014 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:05.814239979 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:05.817399979 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:05.825125933 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.014308929 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.055299044 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.072004080 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.078633070 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.078701973 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.087337017 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.087393045 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.089128017 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.089181900 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.093566895 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.093619108 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.095299959 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.095359087 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.095980883 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.096030951 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.096874952 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.096921921 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.100900888 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.102046967 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.103559971 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.103885889 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.104688883 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.104751110 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.104760885 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.377827883 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.430278063 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.475140095 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.483033895 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.483052015 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.483059883 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.483072996 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.483098984 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.483124971 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.483129025 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.483203888 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.485474110 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.485483885 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.485516071 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.485529900 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.487095118 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.487149954 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.489332914 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.489346981 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.489382982 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.489397049 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.490106106 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.490155935 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.491012096 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.491020918 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.491067886 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.491081953 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.492742062 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.492750883 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.492796898 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.494420052 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.494471073 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.497073889 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.497136116 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.498898029 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.498950005 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.499984026 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.500041962 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.501707077 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.501763105 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.505026102 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.505163908 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.505217075 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.506210089 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.506269932 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.509037971 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.509108067 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.511943102 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.512008905 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.515090942 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.515167952 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.517457962 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.517509937 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.517616034 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.517710924 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.518531084 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.518549919 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.518558979 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.518585920 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.518609047 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.519109011 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.519160032 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.521440983 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.521451950 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.521460056 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.521492958 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.521512032 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.524529934 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.524601936 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.525638103 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.525656939 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.525703907 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.525708914 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.525719881 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.525753975 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.525769949 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.526288033 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.526298046 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.526360035 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.528000116 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.528053045 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.528055906 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.528067112 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.528104067 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.530839920 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.530889988 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.531955004 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.531992912 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.532001972 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.532011032 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.532016039 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.532035112 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.532064915 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.533080101 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.533090115 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.533144951 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.534254074 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.534264088 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.534312010 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.534565926 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.534677029 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.537115097 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.537163019 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.538193941 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.538243055 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.538248062 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.538269997 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.538296938 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.538316011 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.538690090 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.538700104 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.538747072 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.539810896 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.539896965 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.539933920 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.541245937 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.541255951 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.541265011 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.541301966 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.541322947 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.543205976 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.543266058 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.545030117 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.545039892 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.545048952 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.545089006 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.545108080 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.546046972 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.546056986 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.546104908 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.546875954 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.546885967 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.546936035 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.547885895 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.547940016 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.547960043 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.547970057 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.547981024 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.548007011 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.548038960 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.549397945 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.549453974 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.551702023 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.551729918 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.551738977 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.551763058 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.551781893 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.552808046 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.552866936 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.552881956 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.552941084 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.553993940 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.554048061 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.554392099 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.554445982 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.554828882 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.554877043 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.554882050 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.554898024 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.554929972 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.554944038 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.555643082 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.555696011 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.556180000 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.556231022 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.557940006 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.557950020 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.558003902 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.558075905 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.558125973 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.559648037 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.559700966 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.559891939 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.559933901 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.560702085 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.560745955 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.560770988 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.560808897 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.561100006 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.561144114 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.561889887 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.561898947 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.561908007 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.561947107 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.561964989 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.562423944 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.562467098 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.563534021 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.563671112 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.564188004 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.564198971 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.564249039 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.565279007 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.565347910 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.566418886 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.566428900 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.566478968 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.567709923 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.567720890 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.567729950 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.567771912 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.567800999 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.569706917 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.569756031 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.569787979 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.569797039 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.569845915 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.570544004 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.570590973 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.570991039 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.571036100 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.571038961 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.571049929 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.571079969 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.571118116 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.571754932 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.571764946 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.571815014 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.572913885 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.572968960 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.573087931 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.573142052 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.574500084 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.574513912 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.574523926 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.574558973 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.574585915 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.576119900 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.576180935 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.576208115 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.576231956 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.576276064 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.576318026 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.577166080 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.577228069 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.577856064 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.577878952 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.577888966 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.577909946 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.577941895 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.578870058 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.578908920 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.578929901 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.579140902 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.580583096 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.580595016 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.580636024 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.581151962 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.581166983 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.581218004 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.581372023 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.581419945 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.582966089 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.583012104 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.583029985 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.583084106 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.583592892 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.583642006 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.584084988 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.584135056 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.584947109 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.584958076 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.584966898 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.584975958 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.585005999 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.585026979 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.585832119 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.585875988 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.585877895 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.585932016 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.587595940 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.587605953 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.587614059 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.587622881 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.587651968 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.587677956 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.587681055 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.587723017 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.590038061 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.590090990 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.590859890 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.590909004 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.591660976 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.591718912 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.591742039 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.591860056 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.593314886 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.593355894 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.593465090 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.593475103 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.593513012 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.594253063 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.594306946 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.595195055 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.595205069 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.595213890 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.595222950 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.595233917 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.595258951 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.595268965 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.595285892 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.595304966 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.595335007 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.595385075 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.596679926 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.596726894 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.597136974 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.597196102 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.597795010 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.597845078 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.598917961 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.598927021 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.598972082 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.600004911 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.600056887 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.600572109 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.600581884 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.600626945 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.600641012 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.601135969 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.601188898 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.601835966 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.601845980 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.601859093 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.601867914 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.601890087 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.601910114 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.602256060 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.602266073 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.602277040 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.602308035 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.602328062 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.603385925 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.603430033 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.603955984 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.604012966 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.605076075 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.605140924 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.605653048 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.605695009 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.605725050 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.605767012 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.606801987 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.606851101 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.607357025 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.607398033 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.607412100 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.607460976 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.607947111 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.607995987 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.608510017 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.608561993 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.608578920 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.608606100 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.608614922 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.608637094 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.608665943 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.609267950 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.609311104 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.609361887 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.609371901 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.609380960 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.609430075 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.609446049 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.609999895 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.610053062 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.611496925 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.611593008 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.612905025 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.612962961 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.613059998 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.613070011 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.613111019 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.615104914 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.615160942 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.615192890 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.615201950 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.615231037 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.615237951 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.615242004 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.615251064 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.615258932 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.615261078 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.615278006 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.615288973 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.615305901 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.615322113 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.616045952 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.616091967 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.616595030 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.616605043 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.616650105 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.616790056 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.616854906 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.618047953 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.618119955 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.618510962 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.618552923 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.619359970 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.619405031 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.619925976 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.619966984 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.619975090 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.620004892 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.621695995 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.621721029 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.621766090 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.621824980 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.621834993 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.621845961 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.621855021 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.621865988 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.621870995 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.621900082 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.621915102 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.622240067 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.622282028 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.622714996 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.622767925 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.623439074 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.623449087 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.623497009 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.623519897 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.623528004 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.623572111 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.623878956 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.623927116 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.624452114 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.624497890 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.625027895 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.625077009 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.625622034 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.625669003 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.626209021 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.626255989 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.626266956 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.626296997 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.627897024 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.627907991 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.627959013 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.628454924 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.628500938 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.628561974 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.628571987 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.628612041 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.628631115 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.628639936 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.628674984 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.628698111 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.629621029 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.629663944 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.629674911 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.629697084 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.630175114 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.630230904 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.630251884 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.630275965 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.630285025 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.630300045 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.630331039 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.630769014 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.630820990 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.630860090 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.630913973 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.631308079 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.631355047 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.631885052 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.631933928 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.633008003 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.633078098 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.633102894 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.633148909 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.634237051 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.634248018 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.634288073 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.634309053 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.634772062 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.634783983 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.634793043 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.634803057 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.634823084 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.634839058 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.634856939 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.634870052 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.636523008 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.636533022 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.636544943 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.636554956 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.636564970 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.636607885 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.636630058 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.637090921 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.637146950 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.637622118 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.637665033 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.637667894 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.637698889 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.638206959 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.638216019 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.638262033 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.638278008 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.640033007 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.640081882 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.640084982 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.640124083 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.641109943 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.641160011 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.641221046 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.641230106 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.641238928 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.641251087 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.641264915 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.641280890 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.641309977 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.641323090 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.641371012 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.642797947 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.642808914 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.642818928 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.642859936 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.642882109 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.643361092 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.643369913 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.643418074 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.643960953 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.644006968 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.644548893 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.644558907 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.644587994 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.644618988 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.645029068 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.645076036 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.645247936 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.645294905 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.646362066 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.646374941 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.646385908 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.646425009 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.646447897 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.647351980 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.647403002 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.647960901 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.647970915 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.647978067 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.647988081 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.648025990 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.648045063 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.649127960 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.649138927 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.649197102 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.649617910 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.649693012 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.649702072 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.649719954 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.649739027 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.650213003 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.650223017 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.650259972 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.650269032 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.650307894 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.651410103 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.651421070 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.651429892 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.651484013 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.651506901 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.651962042 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.652014017 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.653085947 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.653096914 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.653103113 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.653167009 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.654220104 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.654289007 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.654299021 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.654303074 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.654306889 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.654339075 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.654371023 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.655338049 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.655404091 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.655436039 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.655478954 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.655994892 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.656042099 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.656058073 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.656069040 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.656097889 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.656111002 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.657109022 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.657120943 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.657131910 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.657165051 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.657354116 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.657668114 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.657686949 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.657696009 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.657705069 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.657711029 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.657736063 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.657753944 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.658895016 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.659003973 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.659388065 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.659455061 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.659518957 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.659632921 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.660573959 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.660588980 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.660608053 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.660617113 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.660624981 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.660650969 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.660684109 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.661087990 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.661143064 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.662236929 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.662291050 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.662297964 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.662328959 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.662830114 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.662880898 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.662882090 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.662923098 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.662964106 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.663008928 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.663465023 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.663475990 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.663541079 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.663968086 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.664031029 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.664539099 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.664613962 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.664659977 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.664669991 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.664680004 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.664709091 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.664727926 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.665102005 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.665175915 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.665723085 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.665800095 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.666296959 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.666368008 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.666970015 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.666980982 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.666991949 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.667001009 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.667018890 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.667035103 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.667062044 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.668032885 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.668092012 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.668649912 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.668658972 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.668708086 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.668741941 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.669234991 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.669244051 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.669286013 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.669287920 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.669332981 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.670417070 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.670427084 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.670485020 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.670897007 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.670945883 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.670969009 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.670979023 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.671010017 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.671045065 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.671453953 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.671514034 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.671514988 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.671539068 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.671554089 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.671557903 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.671578884 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.671591043 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.672677040 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.672949076 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.673316002 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.673363924 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.673365116 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.673376083 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.673386097 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.673412085 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.673444986 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.674381018 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.674395084 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.674433947 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.674441099 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.675532103 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.675596952 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.675616980 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.676141977 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.676177979 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.676187992 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.676211119 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.676229000 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.676245928 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.677237988 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.677263021 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.677318096 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.677855968 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.677910089 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.677939892 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.677989960 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.678272963 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.678323030 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.678482056 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.678527117 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.678539991 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.678549051 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.678563118 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.678585052 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.678616047 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.679555893 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.679600000 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.680161953 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.680171013 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.680177927 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.680187941 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.680233002 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.680270910 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.681257010 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.681297064 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.681345940 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.682456970 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.682466984 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.682480097 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.682488918 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.682518005 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.682519913 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.682532072 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.682540894 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.682543993 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.682569027 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.682588100 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.684313059 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.684334040 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.684360027 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.684381962 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.684756041 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.684766054 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.684804916 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.684840918 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.684899092 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.685357094 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.685367107 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.685378075 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.685388088 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.685417891 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.685452938 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.686472893 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.686526060 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.687021017 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.687078953 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.687089920 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.687099934 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.687108994 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.687134027 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.687148094 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.687596083 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.687652111 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.687706947 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.688721895 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.688771963 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.688805103 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.688873053 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.688926935 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.689354897 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.689373970 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.689409018 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.689421892 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.689429045 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.689433098 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.689476013 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.691247940 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.691268921 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.691277981 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.691287994 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.691298962 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.691328049 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.691330910 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.691345930 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.691386938 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.692821026 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.692831039 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.692876101 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.692902088 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.692987919 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.693955898 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.694022894 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.694530964 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.694540024 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.694591045 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.695640087 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.695673943 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.695703030 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.695719004 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.695732117 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.695784092 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.696662903 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.696722984 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.697365999 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.697422981 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.697725058 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.697773933 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.699131966 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.699189901 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.699551105 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.699615955 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.700251102 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.700298071 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.700870037 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.700923920 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.701188087 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.701271057 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.702564955 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.702614069 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.702616930 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.702625990 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.702676058 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.703711033 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.703767061 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.704303980 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.704354048 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.705426931 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.705487967 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.706006050 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.706058025 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.706559896 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.706950903 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.707163095 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.707720041 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.707772970 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.708318949 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.708374023 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.708436012 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.709517002 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.709527016 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.709573984 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.709585905 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.710629940 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.710675955 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:06.711227894 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.712460995 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.712472916 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.713485956 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.714148045 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.714164019 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.714813948 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.714824915 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.715843916 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.715899944 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.717597008 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:06.717679977 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:07.291667938 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:07.329546928 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:07.335810900 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:07.526336908 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:07.536931038 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:07.543884993 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:07.755296946 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:07.761091948 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:07.767693043 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:07.767709970 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:07.767721891 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:07.769382000 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:08.055335045 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:08.102153063 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:08.205730915 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:08.212218046 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:08.400497913 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:08.445904016 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:08.838000059 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:08.843045950 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:09.031867981 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:09.036209106 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:09.041033983 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:09.229330063 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:09.231057882 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:09.235902071 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:09.433779001 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:09.434288979 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:09.439208984 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:09.628062010 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:09.628865004 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:09.634329081 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:09.823968887 CEST	3445	49711	77.105.135.107	192.168.2.6
Jul 5, 2024 00:25:09.867891073 CEST	49711	3445	192.168.2.6	77.105.135.107
Jul 5, 2024 00:25:09.886683941 CEST	49711	3445	192.168.2.6	77.105.135.107

Target ID:	0
Start time:	18:24:53
Start date:	04/07/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf00000
File size:	530'432 bytes
MD5 hash:	0B147A2BC6013C0DE94E6E30A8C419DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:24:54
Start date:	04/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x840000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.2246916102.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.2247954383.0000000002AD5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:24:54
Start date:	04/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 272
Imagebase:	0x8f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	0.3%
Signature Coverage:	3.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	19

Executed Functions

Function 030F018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,030F00FF,030F00EF), ref: 030F02FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 030F030F
Wow64GetThreadContext.KERNEL32(00000114,00000000), ref: 030F032D
ReadProcessMemory.KERNELBASE(0000010C,?,030F0143,00000004,00000000), ref: 030F0351
VirtualAllocEx.KERNELBASE(0000010C,?,?,00003000,00000040), ref: 030F037C
WriteProcessMemory.KERNELBASE(0000010C,00000000,?,?,00000000,?), ref: 030F03D4
WriteProcessMemory.KERNELBASE(0000010C,00400000,?,?,00000000,?,00000028), ref: 030F041F
WriteProcessMemory.KERNELBASE(0000010C,?,?,00000004,00000000), ref: 030F045D
Wow64SetThreadContext.KERNEL32(00000114,03100000), ref: 030F0499
ResumeThread.KERNELBASE(00000114), ref: 030F04A8

Strings

ReadProcessMemory, xrefs: 030F027A
ResumeThread, xrefs: 030F02C9
VirtualAllocEx, xrefs: 030F028D
GetP, xrefs: 030F020F
Load, xrefs: 030F01CB
TerminateProcess, xrefs: 030F038B
ress, xrefs: 030F0217
VirtualAlloc, xrefs: 030F0254
WriteProcessMemory, xrefs: 030F02A0
aryA, xrefs: 030F01D3
CreateProcessA, xrefs: 030F0241
GetThreadContext, xrefs: 030F0267
SetThreadContext, xrefs: 030F02B3
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 030F02FB

Memory Dump Source

Source File: 00000000.00000002.2138394389.00000000030F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30f0000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: c35369a4b656cf6c5c45e806a41948b4bf36472dc0fc1229005daba49f6ece4b
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: 8EB1F77264124AAFDB60CF68CC80BDA73A9FF88714F158564EA0CEB341D774FA418B94

Function 00F19B12 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a32428d224da878f8f57b6009f1a9ec6bb5a81043c30a534999c904bde2cab5
Instruction ID: 94b942e95f72079efeb415017932006810cae3c8c6ef4775438965063571dc57
Opcode Fuzzy Hash: 7a32428d224da878f8f57b6009f1a9ec6bb5a81043c30a534999c904bde2cab5
Instruction Fuzzy Hash: D2F0E531A18224EBCB12D74CD815AD9B3ACEB44B62F110096F801D7241C3B0EE41EBD0

Function 00F05240 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F0524D
std::_Lockit::_Lockit.LIBCPMT ref: 00F05267
std::_Lockit::~_Lockit.LIBCPMT ref: 00F05288
std::_Lockit::~_Lockit.LIBCPMT ref: 00F052B4
std::_Lockit::~_Lockit.LIBCPMT ref: 00F052E9
std::_Lockit::_Lockit.LIBCPMT ref: 00F05326
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F05377
std::_Facet_Register.LIBCPMT ref: 00F05396
std::_Lockit::~_Lockit.LIBCPMT ref: 00F053AF

Strings

bad locale name, xrefs: 00F053BE

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Locinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 3434717313-1405518554
Opcode ID: 12483240db66fca855063443f307253b62f84edb917db2b958b3c3a0225caf64
Instruction ID: 24f69ab95d455746a9c582adcc37d5748ec29827d0f0cd6ce62044c149f2c550
Opcode Fuzzy Hash: 12483240db66fca855063443f307253b62f84edb917db2b958b3c3a0225caf64
Instruction Fuzzy Hash: 5341B131A043408FC310DF64D844BABB7E4FF90B20F54455DE88897291DB75E90AFBA2

Function 00F29C80 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00F29CCD

Part of subcall function 00F0A7F2: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000), ref: 00F0A7FE
Part of subcall function 00F0A7F2: GetExitCodeThread.KERNEL32(?,?), ref: 00F0A817
Part of subcall function 00F0A7F2: CloseHandle.KERNEL32(?), ref: 00F0A829

std::_Throw_Cpp_error.LIBCPMT ref: 00F29D0B
std::_Throw_Cpp_error.LIBCPMT ref: 00F29D12
std::_Throw_Cpp_error.LIBCPMT ref: 00F29D19
std::_Throw_Cpp_error.LIBCPMT ref: 00F29D20
GetThreadId.KERNEL32(00000000,26250299), ref: 00F29D5D

Strings

Success created., xrefs: 00F29C83
Success destroyed., xrefs: 00F29D81

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_$Thread$CloseCodeCurrentExitHandleObjectSingleWait
String ID: Success created.$Success destroyed.
API String ID: 2210105531-4203135720
Opcode ID: ff02e16145b4574e5359987cf38adead49e57be2357544d26cccc0d48b4f29dc
Instruction ID: 7e8c33efbb5e0020cc5d034dd7c1ce40f520df39276d602f112299036fe03875
Opcode Fuzzy Hash: ff02e16145b4574e5359987cf38adead49e57be2357544d26cccc0d48b4f29dc
Instruction Fuzzy Hash: BA31FC71E48312ABE720BB649C03F5A77A4FB04B61F500565F954E71C2E7BA9810F792

Function 00F18BAF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,26250299,?,00F18CBC,?,?,?,00000000), ref: 00F18C70

Strings

api-ms-, xrefs: 00F18C06
ext-ms-, xrefs: 00F18C1A

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: c3f598135e70ab0507a75f7ebdc403a1da97781ba1df51c7b81246f236cb3bfb
Instruction ID: ed0cac3a1664085962cea135a70c09941895f066635360a172c12de4a9ea15e7
Opcode Fuzzy Hash: c3f598135e70ab0507a75f7ebdc403a1da97781ba1df51c7b81246f236cb3bfb
Instruction Fuzzy Hash: E5210572E02215ABCB219B60DE50AEA3768EF517F0B150110E905A7290EF30ED83FAE1

Function 00F0F7DC Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_0000F680,00000000,?,?), ref: 00F0F825
GetLastError.KERNEL32 ref: 00F0F831
__dosmaperr.LIBCMT ref: 00F0F838

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 88f339caaa21f6914a415f5e800041fc912145154cd87a0ae4ea8b259fb05583
Instruction ID: 9bba1db3debcaf765b2ece98955f58b2345b972c7abf57ea54e2912876828c7c
Opcode Fuzzy Hash: 88f339caaa21f6914a415f5e800041fc912145154cd87a0ae4ea8b259fb05583
Instruction Fuzzy Hash: 29017172900219EFDF259FE0DC06ADE7BA4EF00360F104168F901965A0DB75DE59FBA1

Function 00F29B20 Relevance: 3.1, APIs: 2, Instructions: 93
memorysynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040,?,?,?,?), ref: 00F29BB8
GetUpdateRgn.USER32(00000000,00000000,00000000), ref: 00F29BC9
CreateThread.KERNELBASE(00000000,00000000,00F29B20,00000000,00000000,00000000), ref: 00F29C5F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,?), ref: 00F29C68

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: AllocCreateObjectSingleThreadUpdateVirtualWait
String ID:
API String ID: 1268193855-0
Opcode ID: b65ea98179643923dec94bcddfcda20fe18eb977cd90c52e86dfc0d498d9bbca
Instruction ID: bc5e5895c64ec147a00ec712310c4f35870841c0115ab0b9d4dc3a2e7d9a4466
Opcode Fuzzy Hash: b65ea98179643923dec94bcddfcda20fe18eb977cd90c52e86dfc0d498d9bbca
Instruction Fuzzy Hash: 21314B71E042086BD704EF68FD82BADB7B1BF45310F104219FD006B3C1EB74AA85A785

Function 00F0F680 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00F33A10,0000000C), ref: 00F0F693
ExitThread.KERNEL32 ref: 00F0F69A

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 7ad203570ddc88d3382a307768c468c2bfde9fb25fe98e06c92ef15845f5f4d1
Instruction ID: 799c165b582ded6d5f8cf7c857ddffc30f63862c7ee62f91fe431ffb13ca02ee
Opcode Fuzzy Hash: 7ad203570ddc88d3382a307768c468c2bfde9fb25fe98e06c92ef15845f5f4d1
Instruction Fuzzy Hash: 4AF0AF71900205AFDF10EF70DC0AAAE3B65EF40720F204159F0019B2A2CB78A945FFA1

Function 00F18C7A Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4178875456d40899b514963a65378089199750952555010cc48c70ebc79e0d18
Instruction ID: 7e22ca319a5d5a75f72f88a54216d7703acb926a650d2ae70c5aaca789d511af
Opcode Fuzzy Hash: 4178875456d40899b514963a65378089199750952555010cc48c70ebc79e0d18
Instruction Fuzzy Hash: 5201F5737116269BEB198E2DEE40ADB3396FBC47B03244220F900DB184DF318882A7E0

Function 00F19B87 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00F1FFAD,?,?,00F1FFAD,00000220,?,00000010,?), ref: 00F19BB9

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 018e87c890bf3407da0c5fcbea86bf0a1ed3ab78e993752324b77d19db6aab2c
Instruction ID: ed4cfe266e4fa767044c98ae6118259b8fb5659203a1405d6cf2856ff7244932
Opcode Fuzzy Hash: 018e87c890bf3407da0c5fcbea86bf0a1ed3ab78e993752324b77d19db6aab2c
Instruction Fuzzy Hash: 18E06532A0C62566DA22A665AC25BEB365CAB813B0F150120AC09960D5DFE4CDC1B5E1

Non-executed Functions

Function 00F236B5 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00F23899

Strings

1#SNAN, xrefs: 00F237C1
1#QNAN, xrefs: 00F237C8
1#INF, xrefs: 00F237EB
1#IND, xrefs: 00F237BA

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 82e1e0cc00390f72e7b940ae73839dd120bc172d309814ff97a055522362a3bf
Instruction ID: 9dfb54704dce60df67fc9da0afaf787ff20e20c4b99fc916259aa8b2a527bcd0
Opcode Fuzzy Hash: 82e1e0cc00390f72e7b940ae73839dd120bc172d309814ff97a055522362a3bf
Instruction Fuzzy Hash: 4DD22AB2E082388FDB65CE28ED407EAB7B5EB84315F1441EAD44DE7240D778AE859F41

Function 00F22A0F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00F22D2D,00000002,00000000,?,?,?,00F22D2D,?,00000000), ref: 00F22AA8
GetLocaleInfoW.KERNEL32(?,20001004,00F22D2D,00000002,00000000,?,?,?,00F22D2D,?,00000000), ref: 00F22AD1
GetACP.KERNEL32(?,?,00F22D2D,?,00000000), ref: 00F22AE6

Strings

ACP, xrefs: 00F22A2D
OCP, xrefs: 00F22A63

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 0168e14e1de8f03321c9e6ba85eec2270e75f1fd14f8ec9c17e675183cb28591
Instruction ID: cb7b7064dd039ebf608971e4de04e91fa5bf9b955b85d3b1db85702d924105cb
Opcode Fuzzy Hash: 0168e14e1de8f03321c9e6ba85eec2270e75f1fd14f8ec9c17e675183cb28591
Instruction Fuzzy Hash: 2621B322E00125BBDBB4DF54ED01B9772A7EB50F70B568434E80AD7901E73ADE41EB50

Function 00F22BE4 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F19827: GetLastError.KERNEL32(?,?,00F0F6A5,00F33A10,0000000C), ref: 00F1982B
Part of subcall function 00F19827: SetLastError.KERNEL32(00000000), ref: 00F198CD

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00F22CF0
IsValidCodePage.KERNEL32(00000000), ref: 00F22D39
IsValidLocale.KERNEL32(?,00000001), ref: 00F22D48
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00F22D90
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00F22DAF

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: a28094d3bfedc0d6b5b3983b8ea7d6d9440b6d48403dc804f339351aea6a5dcc
Instruction ID: 0186a318d3b9c4ec557ba287dd4eb5da836d5de8b990a83ca8c348c87090ebc8
Opcode Fuzzy Hash: a28094d3bfedc0d6b5b3983b8ea7d6d9440b6d48403dc804f339351aea6a5dcc
Instruction Fuzzy Hash: A4518372E00229BBDF60DFA5EC41ABE77B8FF14720F544429E911E7150EB749A40AB61

Function 00F22280 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F19827: GetLastError.KERNEL32(?,?,00F0F6A5,00F33A10,0000000C), ref: 00F1982B
Part of subcall function 00F19827: SetLastError.KERNEL32(00000000), ref: 00F198CD

GetACP.KERNEL32(?,?,?,?,?,?,00F1730D,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00F22341
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00F1730D,?,?,?,00000055,?,-00000050,?,?), ref: 00F2236C
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00F224CF

Strings

utf8, xrefs: 00F2243E

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 4ea83fa0e645c5aca0b8fa16d1f26bd1704c68945d6f3c814c911ad06011b77a
Instruction ID: d65690c552be10aaef6238b8ab830e65ee8bda080d04a3cb8b554f25a504fc72
Opcode Fuzzy Hash: 4ea83fa0e645c5aca0b8fa16d1f26bd1704c68945d6f3c814c911ad06011b77a
Instruction Fuzzy Hash: DD71F671A00225BADB64EB75EC42FBA73A8FF18720F144029F905DB182EB78ED41E751

Function 00F19D96 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00F19E23

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: adabab75f0cd4e4127e2d25f40a6035a1c11768978d09e5fd8cbb18de81cc5b4
Instruction ID: 959a9a45ba8511943bd9f36512c9332af71eba69830eb799b663458a49b61680
Opcode Fuzzy Hash: adabab75f0cd4e4127e2d25f40a6035a1c11768978d09e5fd8cbb18de81cc5b4
Instruction Fuzzy Hash: F9B17A32D092459FDB11CF28C8A17FEBBA5EF59310F148169E805EB241C279DD82EBE1

Function 00F0B69A Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00F0B6A6
IsDebuggerPresent.KERNEL32 ref: 00F0B772
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00F0B78B
UnhandledExceptionFilter.KERNEL32(?), ref: 00F0B795

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: cf29895d772fb92023c396bfe8b01b11f737166eef92909d3fedd0791e3055ca
Instruction ID: ebb96b0b5f8b10f1cde260211a5b9d9761b2d4c9b3dbbd72d447a4c214334ef8
Opcode Fuzzy Hash: cf29895d772fb92023c396bfe8b01b11f737166eef92909d3fedd0791e3055ca
Instruction Fuzzy Hash: 4731F875D0521C9BDF21DF64DD497CDBBB8AF08300F1041EAE50CAB290EB759A85AF45

Function 00F22693 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00F19827: GetLastError.KERNEL32(?,?,00F0F6A5,00F33A10,0000000C), ref: 00F1982B
Part of subcall function 00F19827: SetLastError.KERNEL32(00000000), ref: 00F198CD

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F226E7
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F22731
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F227F7

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 382dae221ed905098da1fe29c99baa7a059f89b4e65e9f7225c4aabfbd77b35d
Instruction ID: 64ce01469644c8cae3e299c9f21c82780ebc9004ca55c1e38592f8aec6e2c3a1
Opcode Fuzzy Hash: 382dae221ed905098da1fe29c99baa7a059f89b4e65e9f7225c4aabfbd77b35d
Instruction Fuzzy Hash: 9D619371900127AFEB68DF28EC82BBA73A8FF04721F10417AED05D6585E738D995EB50

Function 00F12C23 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000010), ref: 00F12D1B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000010), ref: 00F12D25
UnhandledExceptionFilter.KERNEL32(00F33748,?,?,?,?,?,00000010), ref: 00F12D32

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 8b044d3bb22dbeaf18a06f50a50fddca049f83336e41bbce28c38158231231bd
Instruction ID: 78a49aa3e2949bc793c3b96a3cf8aabadfcd04f3ea278ab02b5c9602c81fe518
Opcode Fuzzy Hash: 8b044d3bb22dbeaf18a06f50a50fddca049f83336e41bbce28c38158231231bd
Instruction Fuzzy Hash: 7D31D47490121C9BCB21DF64DD88BCDBBB8BF18310F5042EAE41CA72A0E7349B859F45

Function 00F15570 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec831842d4b3e083d0d5fc355441d8007b4a970f2afc1f871a5a5b277875a26
Instruction ID: dd296c86e960f34dddef56b101d9859a381234520b845e394dc70c327bf67457
Opcode Fuzzy Hash: fec831842d4b3e083d0d5fc355441d8007b4a970f2afc1f871a5a5b277875a26
Instruction Fuzzy Hash: 08F12A71E01619DFDF14CFA9C880AEDB7B1EF88724F158269E819AB390D730AD45DB90

Function 00F02880 Relevance: 3.0, Strings: 2, Instructions: 463COMMON

Download Yara Rule

Strings

+, xrefs: 00F02D30
%, xrefs: 00F02D21

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %$+
API String ID: 0-2626897407
Opcode ID: 4a586fbefb8ed2c832e795624db4beffdacac52e4c76899d37a4faa7a2be287b
Instruction ID: 77463a6087b77aa95c44f2260d2ff62229dfba96d3a042e22af96a38b597b566
Opcode Fuzzy Hash: 4a586fbefb8ed2c832e795624db4beffdacac52e4c76899d37a4faa7a2be287b
Instruction Fuzzy Hash: F6F10F729082409FC715DF28CC45A6FBBE5BFC9710F444A1DF984AB291D734E944BBA2

Function 00F03320 Relevance: 3.0, Strings: 2, Instructions: 463COMMON

Download Yara Rule

Strings

%, xrefs: 00F037C1
+, xrefs: 00F037D0

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %$+
API String ID: 0-2626897407
Opcode ID: 11b3d8ab0354165112c8db349d577438aacb0c46dd2bd858a6bc34d66a29565e
Instruction ID: 2c872f7a2b1af1c94750ca6b4282459adf85f02c2ad786a3e907bad0c308aece
Opcode Fuzzy Hash: 11b3d8ab0354165112c8db349d577438aacb0c46dd2bd858a6bc34d66a29565e
Instruction Fuzzy Hash: D2F101729083419FC715DF28CC41A6FBBE9EFC9710F044A1DF984AB291D735EA44AB92

Function 00F1B11C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00F1B117,?,?,00000008,?,?,00F27A35,00000000), ref: 00F1B349

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 05061122be17ca4da7febe00b5e5b0f52f9d0d1f2d7f3810bc5f68e18b29e8bd
Instruction ID: b23835bcb3e8cba30620761b94905d0e464b757234b4e3ccb98170a4aa2e14ac
Opcode Fuzzy Hash: 05061122be17ca4da7febe00b5e5b0f52f9d0d1f2d7f3810bc5f68e18b29e8bd
Instruction Fuzzy Hash: C2B14D32610608DFD719CF2CC496BA97BE0FF45364F258658E8A9CF2A1C335E992DB40

Function 00F0B380 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00F0B396

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 00cfeea7622ce364bf144aaeff949745fe8200ec50221dc462ebd2b3452df178
Instruction ID: 50dc59824a73c4cc0453e19356d157e7590e95680f12700240cbb03716ba882e
Opcode Fuzzy Hash: 00cfeea7622ce364bf144aaeff949745fe8200ec50221dc462ebd2b3452df178
Instruction Fuzzy Hash: B2519FB1E0060ACFEB18CF64D9917AABBF4FB44324F28816AC405EB2A5D3759D40EF50

Function 00F1F6FD Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9db252a685bb700f1e053ad85b181b54124ff2fff39ee67472883ea303e0cacf
Instruction ID: baa57257d024193db9b16213076b82042c640efd86a2243fc6988de7d5c1ad52
Opcode Fuzzy Hash: 9db252a685bb700f1e053ad85b181b54124ff2fff39ee67472883ea303e0cacf
Instruction Fuzzy Hash: 1641D0B5C0021DAFCB20DF69CC89AEABBB9AF45310F1442E9E418D3201DA359E899F50

Function 00F115A4 Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

0, xrefs: 00F11732

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 3467f9763bca30649f1aa725c7faaaf86a7a43dc6dcc06b12b5c08708c750d9b
Instruction ID: af625ae3085f325451d439e047492ea4ae0629bc5bdb56b2a285c1392e79a5a4
Opcode Fuzzy Hash: 3467f9763bca30649f1aa725c7faaaf86a7a43dc6dcc06b12b5c08708c750d9b
Instruction Fuzzy Hash: 28C1C174A006468FDB28CF68C4906FEBBB2BB45320F18461DD6969B791C736ACC5EB41

Function 00F228E6 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00F19827: GetLastError.KERNEL32(?,?,00F0F6A5,00F33A10,0000000C), ref: 00F1982B
Part of subcall function 00F19827: SetLastError.KERNEL32(00000000), ref: 00F198CD

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F2293A

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 9e955aa83ef2a33a1d4b6d679389c8c0c25536ddf3ae69aa39b423bbd5fe083b
Instruction ID: df7f4c2aab0b039b14a2f93dd4493e414ff9bf1d8fcb8cf00fdd4f8cffe576be
Opcode Fuzzy Hash: 9e955aa83ef2a33a1d4b6d679389c8c0c25536ddf3ae69aa39b423bbd5fe083b
Instruction Fuzzy Hash: AD21A772A10216BBDB689F25EC41BBA73A8EF44324F100079FD05DA141EB78ED81FB51

Function 00F1125C Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

0, xrefs: 00F113E6

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 328e3061344a81f2a28b4a5077caa0b2ebb049cd22caf3a934faea4d5a1222f3
Instruction ID: 9efa9d302458ee2f312863a7b92fc9a778fb88492b7c3e5d7f5f685277170330
Opcode Fuzzy Hash: 328e3061344a81f2a28b4a5077caa0b2ebb049cd22caf3a934faea4d5a1222f3
Instruction Fuzzy Hash: F5B1C070E0064A8BCF34CE68C891AFEB7B1BB45720F14061ED6A2D7691D735A9C1EB52

Function 00F2256D Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F19827: GetLastError.KERNEL32(?,?,00F0F6A5,00F33A10,0000000C), ref: 00F1982B
Part of subcall function 00F19827: SetLastError.KERNEL32(00000000), ref: 00F198CD

EnumSystemLocalesW.KERNEL32(00F22693,00000001,00000000,?,-00000050,?,00F22CC4,00000000,?,?,?,00000055,?), ref: 00F225DF

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ffce52c6f3a92b5edaa3f71e17a614c2dc70057cd5b7f7d9a216cc0154e9f63f
Instruction ID: cecd43b856ac3d705965a2c4eed86d18af1459ad2eb1dbb8ce0080a2bca4a6a1
Opcode Fuzzy Hash: ffce52c6f3a92b5edaa3f71e17a614c2dc70057cd5b7f7d9a216cc0154e9f63f
Instruction Fuzzy Hash: 52114C376043016FDB189F39D8A16BABB91FF80328B18842CE94747B40D775B942DB40

Function 00F22B15 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00F19827: GetLastError.KERNEL32(?,?,00F0F6A5,00F33A10,0000000C), ref: 00F1982B
Part of subcall function 00F19827: SetLastError.KERNEL32(00000000), ref: 00F198CD

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00F22990,00000000,00000000,?), ref: 00F22B41

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 280a39ea19d4bff47191c2340eee7010871f0b1dd5af2992d2c89367c8671e7f
Instruction ID: 3cc3d16440d46e6a0d681e65484305ff3a3b20edd014d416c122eb624178c10a
Opcode Fuzzy Hash: 280a39ea19d4bff47191c2340eee7010871f0b1dd5af2992d2c89367c8671e7f
Instruction Fuzzy Hash: E7F0F9339001267BDB685E209C05BBA7754EB80764F044428EC11A3190DB74FD41E691

Function 00F2247B Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00F19827: GetLastError.KERNEL32(?,?,00F0F6A5,00F33A10,0000000C), ref: 00F1982B
Part of subcall function 00F19827: SetLastError.KERNEL32(00000000), ref: 00F198CD

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00F224CF

Strings

utf8, xrefs: 00F2243E

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: b168ea0836c01a2546a141ec6a08f75de0b5fc809adc264a72ef8b6bdbbda0f8
Instruction ID: 1f590aec1d088294523982524c1bd863fd9775ad16c934b5005807a421e74ffb
Opcode Fuzzy Hash: b168ea0836c01a2546a141ec6a08f75de0b5fc809adc264a72ef8b6bdbbda0f8
Instruction Fuzzy Hash: 96F02832A00119ABC714AF34EC16EFE73E8DB45720F004079B902D7281EA78AD01A790

Function 00F22608 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F19827: GetLastError.KERNEL32(?,?,00F0F6A5,00F33A10,0000000C), ref: 00F1982B
Part of subcall function 00F19827: SetLastError.KERNEL32(00000000), ref: 00F198CD

EnumSystemLocalesW.KERNEL32(00F228E6,00000001,?,?,-00000050,?,00F22C88,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00F22652

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ea915c01fba3deb2c7416fd2b0f82e73942da850a3ecd4a16120490e9b29b3aa
Instruction ID: 7cd56934a8a15d95ebb734fd42240f7de64fcb8cb906106d692d7b8056145abf
Opcode Fuzzy Hash: ea915c01fba3deb2c7416fd2b0f82e73942da850a3ecd4a16120490e9b29b3aa
Instruction Fuzzy Hash: 49F040336003146FCB246F39AC81ABABF90FF80738F05802DF9418B680C7B5AC02EA40

Function 00F189E6 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F12F71: EnterCriticalSection.KERNEL32(?,?,00F194FF,?,00F33DE0,00000008,00F196C3,?,?,?), ref: 00F12F80

EnumSystemLocalesW.KERNEL32(00F189D9,00000001,00F33D80,0000000C,00F18E48,00000000), ref: 00F18A1E

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: ca1fa0f0bf411f9ac662037a061c214a617e9c515a9e3bec7cc08e27f2366d1f
Instruction ID: c5e97c24c89494e8f17782d92d744bfb43466655260880efdf8540362eaa779a
Opcode Fuzzy Hash: ca1fa0f0bf411f9ac662037a061c214a617e9c515a9e3bec7cc08e27f2366d1f
Instruction Fuzzy Hash: 48F04F76A40208DFD700DF98E842BDD77F0FB05721F10811AF411DB2A0CB795942AF41

Function 00F22522 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F19827: GetLastError.KERNEL32(?,?,00F0F6A5,00F33A10,0000000C), ref: 00F1982B
Part of subcall function 00F19827: SetLastError.KERNEL32(00000000), ref: 00F198CD

EnumSystemLocalesW.KERNEL32(00F2247B,00000001,?,?,?,00F22CE6,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00F22559

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0e8a54bf31e5837c6bb2617476979c597b557d6a51c502bd46e275194c6c7b9c
Instruction ID: 2e09da178c50f8ab34d1df48a7ba69dc55179bfcc55f3c0c0bfc5b9576284d92
Opcode Fuzzy Hash: 0e8a54bf31e5837c6bb2617476979c597b557d6a51c502bd46e275194c6c7b9c
Instruction Fuzzy Hash: E3F05536700204A7CB18EF36E856A6ABF90EFC2724F0A8059EE058B250C275D843EB90

Function 00F18F4C Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00F17E73,?,20001004,00000000,00000002,?,?,00F17475), ref: 00F18F80

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b327e762e59d7bfa1f0b7c5bb58b7b52b2a4173d13267c759044350406e7fa6d
Instruction ID: 3807d3dd68d0735e2871bcc30baf9101b21689def4037a68ba55e23877c53544
Opcode Fuzzy Hash: b327e762e59d7bfa1f0b7c5bb58b7b52b2a4173d13267c759044350406e7fa6d
Instruction Fuzzy Hash: 88E0BF3690421CBBCF226F61DD09ADE7E16EF447A0F044011FD0565161CF799972BAD5

Function 00F0B7F6 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000B802,00F0AE2A), ref: 00F0B7FB

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1e299bafec373e3a030b4b9295d074f2a089a5491985ef8deb607cc4e56b7369
Instruction ID: 2c9c55039f135784c125461dc08e222310cd12077ec95af7aefd69a5f04c014c
Opcode Fuzzy Hash: 1e299bafec373e3a030b4b9295d074f2a089a5491985ef8deb607cc4e56b7369
Instruction Fuzzy Hash:

Function 00F22E46 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00F22E46

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 9310adad2f6c646f6495697b8de1c6aeb1322cf97e509d2be13476c68ac3f850
Instruction ID: a6b37295289ba5f097aedf0bf54ed9aed6d869b648efcecdb623178a7defa648
Opcode Fuzzy Hash: 9310adad2f6c646f6495697b8de1c6aeb1322cf97e509d2be13476c68ac3f850
Instruction Fuzzy Hash: 2EA02230202208CFC300CF30AF0838C3BECBB0C2C03080028A008C0030EB3080AABB0A

Function 00F21D31 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 3b9efd91b0036223baba0dcb90ef31f7ebadf15890c068ae2eccf03a5b32a6fe
Instruction ID: bca8d535ffccdd35d77ba10eeb11d8bca066780ef4f4507525f960eca918f83e
Opcode Fuzzy Hash: 3b9efd91b0036223baba0dcb90ef31f7ebadf15890c068ae2eccf03a5b32a6fe
Instruction Fuzzy Hash: B4B13675A007519BDB38EB24DC82BBBB3E8FF64318F44442DE942C6580EB75B985E704

Function 00F19B56 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40462530d1634de5f1ed506cdc9d9bcd32bdc8a5f714ca53be199472989dfe9
Instruction ID: 781de58acb809e31e48e15efd01de544abfddff906d680b06bba900db79df6b1
Opcode Fuzzy Hash: c40462530d1634de5f1ed506cdc9d9bcd32bdc8a5f714ca53be199472989dfe9
Instruction Fuzzy Hash: A2E08C32A19228EBCB18DB88D904D8AF3ECEB88B90B110496B501D3110C2B4DF40EBD0

Function 00F169CE Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5a630a47bc7cf2c319f03ac5adf3fe6ea5721287783c53932d153f0d08af9e9
Instruction ID: 5221d865fb332cb6d3e2864ceffa566caee48b2965b16bc1486d8b59194b5479
Opcode Fuzzy Hash: b5a630a47bc7cf2c319f03ac5adf3fe6ea5721287783c53932d153f0d08af9e9
Instruction Fuzzy Hash: D5C08C3540090087CE298D1892B23E83354A3D1792FC0048CD4528B642C52EDCCAFA00

Function 00F04E90 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 292COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F04E9D
std::_Lockit::_Lockit.LIBCPMT ref: 00F04EB7
std::_Lockit::~_Lockit.LIBCPMT ref: 00F04ED8
std::_Lockit::~_Lockit.LIBCPMT ref: 00F04F04
std::_Lockit::~_Lockit.LIBCPMT ref: 00F04F39
std::_Lockit::_Lockit.LIBCPMT ref: 00F04F76
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F04FC7
__Getctype.LIBCPMT ref: 00F04FDE
std::_Facet_Register.LIBCPMT ref: 00F04FF7
std::_Lockit::~_Lockit.LIBCPMT ref: 00F05010

Strings

bad locale name, xrefs: 00F0501F

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_GetctypeLocinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 1407599034-1405518554
Opcode ID: 7257f96bcb437c8aa98b96364c19e0093b322c628db8d1224f1a1e1202056d0e
Instruction ID: d2aad11f734aef28d6c04f22c509def8b52ff731714e0d9d41ca13f2ddc5f869
Opcode Fuzzy Hash: 7257f96bcb437c8aa98b96364c19e0093b322c628db8d1224f1a1e1202056d0e
Instruction Fuzzy Hash: 33B1DF75A006458FCB20DF68C840BAAB7F1FF84B20F258259E9549B3D1DB75AC06FB91

Function 00F053D0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F053DD
std::_Lockit::_Lockit.LIBCPMT ref: 00F053F7
std::_Lockit::~_Lockit.LIBCPMT ref: 00F05418
std::_Lockit::~_Lockit.LIBCPMT ref: 00F05444
std::_Lockit::~_Lockit.LIBCPMT ref: 00F05479
std::_Lockit::_Lockit.LIBCPMT ref: 00F054B6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F05507
std::_Facet_Register.LIBCPMT ref: 00F05526
std::_Lockit::~_Lockit.LIBCPMT ref: 00F0553F

Strings

bad locale name, xrefs: 00F0554E

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Locinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 3434717313-1405518554
Opcode ID: 7aa702bc9986699bd85716937421520ecd22f9ef9cfd3ba57fb4928e6294ff9c
Instruction ID: ceda08299fdd98cf3d59d74301af2d01412edc375c852684a42d0c18cae96d89
Opcode Fuzzy Hash: 7aa702bc9986699bd85716937421520ecd22f9ef9cfd3ba57fb4928e6294ff9c
Instruction Fuzzy Hash: C841AF35A043408FC710DF64D844BABB7E4FF90B21F14445DE9889B291DB79E94AFBA2

Function 00F06490 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F064A0
std::_Lockit::_Lockit.LIBCPMT ref: 00F064BA
std::_Lockit::~_Lockit.LIBCPMT ref: 00F064DB
std::_Lockit::~_Lockit.LIBCPMT ref: 00F0650A
std::_Lockit::_Lockit.LIBCPMT ref: 00F06571
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F065CE
__Getctype.LIBCPMT ref: 00F065E5
std::_Facet_Register.LIBCPMT ref: 00F0662A

Strings

bad locale name, xrefs: 00F06644

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_$Lockit::~_$Facet_GetctypeLocinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 2622896957-1405518554
Opcode ID: bc129e2cb88066e2835c37da05be0b9f43dfd84eb2bb85eef8c5661e71337900
Instruction ID: 54ac884c0b5ddcc5b64981298a8a205cfbbe6a7f91d34419104e3b5a100ed83a
Opcode Fuzzy Hash: bc129e2cb88066e2835c37da05be0b9f43dfd84eb2bb85eef8c5661e71337900
Instruction Fuzzy Hash: BE51D2719047848FD321DF24CD40BABB7E0BF94710F18855CE9899B2A2EB34E955FB92

Function 00F06950 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 158COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F069B1
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F06A06
Concurrency::cancel_current_task.LIBCPMT ref: 00F06B7E

Strings

,, xrefs: 00F06B16
true, xrefs: 00F06ABC
false, xrefs: 00F06AA2
., xrefs: 00F06AD3
bad locale name, xrefs: 00F06B74

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: std::_$Concurrency::cancel_current_taskLocinfo::_Locinfo_ctorLockitLockit::_
String ID: ,$.$bad locale name$false$true
API String ID: 1995332507-3659324578
Opcode ID: c33fad70a10e224b20d4b22906554e692a50b3c3c85bb6f246a956c645f3d54a
Instruction ID: 292757b318b12a7fb44a6910ae13d49534e83496da0bbf1697980485457971a0
Opcode Fuzzy Hash: c33fad70a10e224b20d4b22906554e692a50b3c3c85bb6f246a956c645f3d54a
Instruction Fuzzy Hash: 7251A2B18083859FD720DF64C841BABB7E4BF84314F044A6EF98897281E775E558EB93

Function 00F06B90 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 120COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F06BE2
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F06C37
Concurrency::cancel_current_task.LIBCPMT ref: 00F06D01
Concurrency::cancel_current_task.LIBCPMT ref: 00F06D06
Concurrency::cancel_current_task.LIBCPMT ref: 00F06D0B

Strings

true, xrefs: 00F06CC5
false, xrefs: 00F06C9F
bad locale name, xrefs: 00F06CF7

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: 1ea1a6df6453e5b24fa05e50fd1ef2ac79f61487ec55ff2cfefdb058e94e46e6
Instruction ID: a2938e0c8e4ef401eb2e7a9c006fc4a2774e6ff31a3d35ae21ca7a41223614c9
Opcode Fuzzy Hash: 1ea1a6df6453e5b24fa05e50fd1ef2ac79f61487ec55ff2cfefdb058e94e46e6
Instruction Fuzzy Hash: 9441BFB46093409ED720EF64CC4175BBBE4BF85310F04486DF5989B2D1E7B9D509EBA2

Function 00F0AD2D Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00F0AD33
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00F0AD41
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00F0AD52
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00F0AD63

Strings

GetTempPath2W, xrefs: 00F0AD58
kernel32.dll, xrefs: 00F0AD2E
GetCurrentPackageId, xrefs: 00F0AD3B
GetSystemTimePreciseAsFileTime, xrefs: 00F0AD47

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: cc686d4001349f776bdfd134973f3ccb4dd96be6d8f4d581fb6da9da9582b501
Instruction ID: 36652d519ecab24d89bf77856cec8baa440fd0a50366b6a02a5256cceb9eace8
Opcode Fuzzy Hash: cc686d4001349f776bdfd134973f3ccb4dd96be6d8f4d581fb6da9da9582b501
Instruction Fuzzy Hash: 40E0EC31551328EB8320DF74BC0DDA63BA8FB0A7123040316F801D2160D7708803BBA3

Function 00F0E508 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00F0E627
___TypeMatch.LIBVCRUNTIME ref: 00F0E735
_UnwindNestedFrames.LIBCMT ref: 00F0E887
CallUnexpected.LIBVCRUNTIME ref: 00F0E8A2

Strings

csm, xrefs: 00F0E65E
csm, xrefs: 00F0E545
csm, xrefs: 00F0E5B2

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 18f40784e4211f1313ff1ec11001cf35ddc690e15f7f9b0d911b78d9cbb778ae
Instruction ID: dfaa2804e5042e0e2e5623d22f4c5d81a30f32cc8f5ab49c06d47cf019c0c254
Opcode Fuzzy Hash: 18f40784e4211f1313ff1ec11001cf35ddc690e15f7f9b0d911b78d9cbb778ae
Instruction Fuzzy Hash: ABB16B71C00209EFCF29DFA4C9819AEBBB5FF14320B14895AE8116B292D735DA51FB91

Function 00F1DBF7 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00F1DE70

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: fc4f53fedef683d08a49aaace1fa026347e850894a4930f3cb280f7a0bef890c
Instruction ID: c7d4993df362b6846e78b20462f862c8bdb562ecdeeb14ed6b703f2abe747537
Opcode Fuzzy Hash: fc4f53fedef683d08a49aaace1fa026347e850894a4930f3cb280f7a0bef890c
Instruction Fuzzy Hash: B2B11271E0020AAFDB11DFA8C880BFDBBB5BF95310F144258E5119B292C7759EC2EB61

Function 00F268FA Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(01524380,01524380,?,7FFFFFFF,?,00F26BCA,01524380,01524380,?,01524380,?,?,?,?,01524380,?), ref: 00F269A0
__alloca_probe_16.LIBCMT ref: 00F26A5B
__alloca_probe_16.LIBCMT ref: 00F26AEA
__freea.LIBCMT ref: 00F26B35
__freea.LIBCMT ref: 00F26B3B
__freea.LIBCMT ref: 00F26B71
__freea.LIBCMT ref: 00F26B77
__freea.LIBCMT ref: 00F26B87

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 15a14bc4ce32fa3c86b6b08b2785177165b9d4daed5a86ad6194420f15fe30b7
Instruction ID: 727f3d2ab3106d5e198c0d82eee1fff72d6ca6efd6103713b8927faa7caecf44
Opcode Fuzzy Hash: 15a14bc4ce32fa3c86b6b08b2785177165b9d4daed5a86ad6194420f15fe30b7
Instruction Fuzzy Hash: 3471F872E00225ABDF219F54AC81FAE77B9DF85324F290059E905F7181DA39DC40B7A1

Function 00F0AB11 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,CCCCCCCC,00F01C8F,?,00000001,00000000,00000002,00000001,?,00F01C8F,?), ref: 00F0AB5A
__alloca_probe_16.LIBCMT ref: 00F0AB86
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,00F01C8F,?,00000000,00F31DDE,01526580,?,?,?,00F06AAC), ref: 00F0ABC5
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00F01C8F,?,00000000,00F31DDE,01526580), ref: 00F0ABE2
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,00F01C8F,?,00000000,00F31DDE,01526580), ref: 00F0AC21
__alloca_probe_16.LIBCMT ref: 00F0AC3E
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00F01C8F,?,00000000,00F31DDE,01526580), ref: 00F0AC80
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,00F01C8F,?,00000000,00F31DDE,01526580), ref: 00F0ACA3

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 203cb852745f2c729cec57f09f2f9e7566b8f4f6a37b7245af3a42cc1b7f5912
Instruction ID: 533bdb0db2bf1ff9a37b0b415a63f93c7f9d9fb17befe908c5a48d60dae37a17
Opcode Fuzzy Hash: 203cb852745f2c729cec57f09f2f9e7566b8f4f6a37b7245af3a42cc1b7f5912
Instruction Fuzzy Hash: BF51B072A0031AABEF219F60CC45FAA7BA9EB44760F158124FD05A61D0E735CC10FB52

Function 00F06100 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F0610D
std::_Lockit::_Lockit.LIBCPMT ref: 00F0612B
std::_Lockit::~_Lockit.LIBCPMT ref: 00F0614C
std::_Lockit::~_Lockit.LIBCPMT ref: 00F0619C
std::_Facet_Register.LIBCPMT ref: 00F061C6
std::_Lockit::~_Lockit.LIBCPMT ref: 00F061DF

Part of subcall function 00F01930: ___std_exception_copy.LIBVCRUNTIME ref: 00F0196C

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Register___std_exception_copy
String ID:
API String ID: 728164013-0
Opcode ID: 24f5f897d34d1bb087acd4c9d693dfa417c19e2501653bd423dedc4273f9cde1
Instruction ID: e33dc26bb3a86fc2a2e54aa140094a1d520311c87ff0af2e07347529f7aaf6e7
Opcode Fuzzy Hash: 24f5f897d34d1bb087acd4c9d693dfa417c19e2501653bd423dedc4273f9cde1
Instruction Fuzzy Hash: A7212232A042118FC721EF14DC409AAB3A4FF80720F144699E955972E2DB34AD2AFBD2

Function 00F05A60 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F05A6D
std::_Lockit::_Lockit.LIBCPMT ref: 00F05A8B
std::_Lockit::~_Lockit.LIBCPMT ref: 00F05AAC
std::_Lockit::~_Lockit.LIBCPMT ref: 00F05AFC
std::_Facet_Register.LIBCPMT ref: 00F05B26
std::_Lockit::~_Lockit.LIBCPMT ref: 00F05B3F

Part of subcall function 00F01930: ___std_exception_copy.LIBVCRUNTIME ref: 00F0196C

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Register___std_exception_copy
String ID:
API String ID: 728164013-0
Opcode ID: be89350e9cf22fbefbd9744fb5ebffaab65c4cccad9c4ba6a9fcda47856a3462
Instruction ID: d268860868c4ce8bf447330928ebab6de79d20ce830d749c3916c4d488407803
Opcode Fuzzy Hash: be89350e9cf22fbefbd9744fb5ebffaab65c4cccad9c4ba6a9fcda47856a3462
Instruction Fuzzy Hash: 9721C171A003158BC711EF14EC809ABB7A8FB94720F14465DE981972D1DB39BD0AFBD2

Function 00F0E19A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00F0E191,00F0C74C,00F0B846), ref: 00F0E1A8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00F0E1B6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F0E1CF
SetLastError.KERNEL32(00000000,00F0E191,00F0C74C,00F0B846), ref: 00F0E221

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 330bf8f99e15bd7d54bc468ba7e6926b15613132131c52069c558d6f71504bc4
Instruction ID: 5add77705468695a058f7d43f2ca70f9598c4d8f18510e147f62da218abddffe
Opcode Fuzzy Hash: 330bf8f99e15bd7d54bc468ba7e6926b15613132131c52069c558d6f71504bc4
Instruction Fuzzy Hash: 2D01F773A0D6166EE73827B47CC5B6A3B5ADB41774320063AF9108A4E1EF628C45B181

Function 00F169F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,26250299,?,?,00000000,00F286B3,000000FF,?,00F16980,00000002,?,00F16954,00F1302A), ref: 00F16A25
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00F16A37
FreeLibrary.KERNEL32(00000000,?,?,00000000,00F286B3,000000FF,?,00F16980,00000002,?,00F16954,00F1302A), ref: 00F16A59

Strings

mscoree.dll, xrefs: 00F16A1E
CorExitProcess, xrefs: 00F16A2F

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 1f2cea55758545008ce32485b386da22d32b5a0ceb68ee3550eb7ef48d055009
Instruction ID: 538754885e671d7f64b92fae812a25787766b0e6fc085b516b814ada8e06bb93
Opcode Fuzzy Hash: 1f2cea55758545008ce32485b386da22d32b5a0ceb68ee3550eb7ef48d055009
Instruction Fuzzy Hash: C501A731944629ABCB11DF50DD05BAE7BF8FB04B20F044125E811F22D0DB799900DE91

Function 00F1ECA2 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00F1ED29
__alloca_probe_16.LIBCMT ref: 00F1EDEA
__freea.LIBCMT ref: 00F1EE51

Part of subcall function 00F19B87: RtlAllocateHeap.NTDLL(00000000,00F1FFAD,?,?,00F1FFAD,00000220,?,00000010,?), ref: 00F19BB9

__freea.LIBCMT ref: 00F1EE66
__freea.LIBCMT ref: 00F1EE76

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 94c8421d10192eacf065c7ce3cc41290a876abc2578d6f63e11153a73f2da96b
Instruction ID: f336aa3286aea7f476e194a656d3e1ece2567d85e5edaf12a34b89079af0c9a4
Opcode Fuzzy Hash: 94c8421d10192eacf065c7ce3cc41290a876abc2578d6f63e11153a73f2da96b
Instruction Fuzzy Hash: 6E51D372A00206AFEF259F60DC81EFB76A9EF48760F160528FC18D6150EB75CD90B7A0

Function 00F07BDC Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F07BE3
std::_Lockit::_Lockit.LIBCPMT ref: 00F07BED

Part of subcall function 00F01AC0: std::_Lockit::_Lockit.LIBCPMT ref: 00F01ACF
Part of subcall function 00F01AC0: std::_Lockit::~_Lockit.LIBCPMT ref: 00F01AEA

codecvt.LIBCPMT ref: 00F07C27
std::_Facet_Register.LIBCPMT ref: 00F07C3E
std::_Lockit::~_Lockit.LIBCPMT ref: 00F07C5E

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: d120e53a5567d15d4ff8ac984dba334b2b87f4b63c83631e5ed6d42b52bea7bb
Instruction ID: d198e4e0c401ecb941be162163a568970f67283f2daf3017068a166270c3e82f
Opcode Fuzzy Hash: d120e53a5567d15d4ff8ac984dba334b2b87f4b63c83631e5ed6d42b52bea7bb
Instruction Fuzzy Hash: EB11AF71D042259FCB11FF649C456AEBBA4AF84760F244449F401AB3D2DF78AE01BB91

Function 00F0930F Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F09316
std::_Lockit::_Lockit.LIBCPMT ref: 00F09320

Part of subcall function 00F01AC0: std::_Lockit::_Lockit.LIBCPMT ref: 00F01ACF
Part of subcall function 00F01AC0: std::_Lockit::~_Lockit.LIBCPMT ref: 00F01AEA

codecvt.LIBCPMT ref: 00F0935A
std::_Facet_Register.LIBCPMT ref: 00F09371
std::_Lockit::~_Lockit.LIBCPMT ref: 00F09391

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 8256dc932707a041c3c1bf42b394f60a4b7af50acc7eed15f09b2411cfd36d36
Instruction ID: 5ea0af35ca3e0627ce3c869aaf03afe617d07f1dbe0b26142585f96a9e099fc8
Opcode Fuzzy Hash: 8256dc932707a041c3c1bf42b394f60a4b7af50acc7eed15f09b2411cfd36d36
Instruction Fuzzy Hash: 0211AF71D042299FCB11EB64CD067AEB7A8BF44760F144509F411A72D2EFB8AE01FB91

Function 00F08F97 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F08F9E
std::_Lockit::_Lockit.LIBCPMT ref: 00F08FA9
std::_Lockit::~_Lockit.LIBCPMT ref: 00F09017

Part of subcall function 00F090FA: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00F09112

std::locale::_Setgloballocale.LIBCPMT ref: 00F08FC4
_Yarn.LIBCPMT ref: 00F08FDA

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: b460d07ca793a5f316e48e8044d0b432299b9656b575213b0b1b026957561970
Instruction ID: 8391acfd6e798250ee1d8f79ff935832ce3943697ec3642eca035a6f2ab24a82
Opcode Fuzzy Hash: b460d07ca793a5f316e48e8044d0b432299b9656b575213b0b1b026957561970
Instruction Fuzzy Hash: 2901BC79A042659BC706EB20DC4697D77A1FF85790B144008E811573C2DF78AA43FBD2

Function 00F02230 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00F022CD

Part of subcall function 00F0BC00: RaiseException.KERNEL32(E06D7363,00000001,00000003,00F0BB23,?,?,?,?,00F0BB23,?,00F340FC,?), ref: 00F0BC60

Strings

ios_base::failbit set, xrefs: 00F0217D, 00F02271
ios_base::badbit set, xrefs: 00F02267, 00F02292, 00F022B0
ios_base::eofbit set, xrefs: 00F02276

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: 96c682ea3b8ff5695cf5e2aa16b4bf9187feadf0537da9f72e6bb56e6842f297
Instruction ID: 3564b4ed10f08e90eea8f0d40fd861ab8d139677d47cf3904f06213aa5b5802e
Opcode Fuzzy Hash: 96c682ea3b8ff5695cf5e2aa16b4bf9187feadf0537da9f72e6bb56e6842f297
Instruction Fuzzy Hash: D7113AB2900304ABD710DF98CC45B86B3D8BF45320F04852AF954972C1F774E844F7A1

Function 00F0F2E2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000011,00000000,00000800,?,00F0F293,00000000,00000001,00F817D4,?,?,?,00F0F436,00000004,InitializeCriticalSectionEx,00F2BE28,InitializeCriticalSectionEx), ref: 00F0F2EF
GetLastError.KERNEL32(?,00F0F293,00000000,00000001,00F817D4,?,?,?,00F0F436,00000004,InitializeCriticalSectionEx,00F2BE28,InitializeCriticalSectionEx,00000000,?,00F0F1ED), ref: 00F0F2F9
LoadLibraryExW.KERNEL32(00000011,00000000,00000000,?,00000011,00F0E103), ref: 00F0F321

Strings

api-ms-, xrefs: 00F0F306

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: ff53797d9bb4705faf54fadf72ca7895e8ad6a1df1221f640843ebe113a62943
Instruction ID: 5339d469e81de620f6f2efa98846c7e5a2a3e352917d9495c6803b84c0873ce2
Opcode Fuzzy Hash: ff53797d9bb4705faf54fadf72ca7895e8ad6a1df1221f640843ebe113a62943
Instruction Fuzzy Hash: C2E04830641208B7DF301B60EC06B593F559F00B60F540030F90CE84E1D761D859B5C9

Function 00F1BD96 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(26250299,00000010,00000000,?), ref: 00F1BDF9

Part of subcall function 00F1F09E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00F1EE47,?,00000000,-00000008), ref: 00F1F14A

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00F1C054
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00F1C09C
GetLastError.KERNEL32 ref: 00F1C13F

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: e5eba9c2602a56281e13c1d7cf2322a4d4433fc39452ae3504201c24e3d81572
Instruction ID: c022be82d7a48bfb3a3f07aa67d06bc3747e881281a6f3c8090071f6ea218103
Opcode Fuzzy Hash: e5eba9c2602a56281e13c1d7cf2322a4d4433fc39452ae3504201c24e3d81572
Instruction Fuzzy Hash: 99D159B5D40258EFCB15CFA8D880AEDBBB5FF09314F18452AE455EB352D730A982DB90

Function 00F0E2B1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00F0E378
___AdjustPointer.LIBCMT ref: 00F0E39B
___AdjustPointer.LIBCMT ref: 00F0E437

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 28f081f8925f60337291edb51183af8a09c8b1eb097ddda2682d14964f497310
Instruction ID: dc99c085be43b515b27a5d71b38303479e83682c07cf1484b5ef83c57b2c1902
Opcode Fuzzy Hash: 28f081f8925f60337291edb51183af8a09c8b1eb097ddda2682d14964f497310
Instruction Fuzzy Hash: E351D1B6A05206EFDB288F50D881BBA7FA5EF40320F14496DE845872E1D735EC80FB90

Function 00F1F4BA Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00F1F09E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00F1EE47,?,00000000,-00000008), ref: 00F1F14A

GetLastError.KERNEL32 ref: 00F1F51E
__dosmaperr.LIBCMT ref: 00F1F525
GetLastError.KERNEL32(?,?,?,?), ref: 00F1F55F
__dosmaperr.LIBCMT ref: 00F1F566

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 27f3321c2fe9a7c9e1e89311e65325c95c0a109d8dae3bba2b9b33ece96d1bb7
Instruction ID: 0f3ee071af59e9af369d5ea150886ca152f74c90db093b216dd6ac2bf2a1da9a
Opcode Fuzzy Hash: 27f3321c2fe9a7c9e1e89311e65325c95c0a109d8dae3bba2b9b33ece96d1bb7
Instruction Fuzzy Hash: 7321C571A00605AFDB20AFB5CC809EBB7A9FF043647548538F929C7151E735EDD4ABA0

Function 00F15DCA Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3e14e73fb4e220e6132aec3df07a2d4cc0ba722ea4bfd8ce836d152bd4c04b8
Instruction ID: 5f228bd1ba84044656ac25c3b5e0180ace462f98a5a4994563ba069d278ac239
Opcode Fuzzy Hash: a3e14e73fb4e220e6132aec3df07a2d4cc0ba722ea4bfd8ce836d152bd4c04b8
Instruction Fuzzy Hash: B121C332E04A05EFDB20AFA1DC409EB77A9EF80B647104514F915DB141E735EED1BBA0

Function 00F20450 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00F20458

Part of subcall function 00F1F09E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00F1EE47,?,00000000,-00000008), ref: 00F1F14A

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00F20490
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00F204B0

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: a636a32f75d2c792e8f2ddbf7f17b4108a4fe04a287decc3403235909704baac
Instruction ID: a8a08811fbe2322427d022e0c7b869a81341736545a9bfb1304e15d77202aff4
Opcode Fuzzy Hash: a636a32f75d2c792e8f2ddbf7f17b4108a4fe04a287decc3403235909704baac
Instruction Fuzzy Hash: EF11C4B3D01229BF6621B771AC89CBFB95CDF857A43108025FA06D1102FE78CD4271B2

Function 00F26686 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000010,00000000,00F33A70,00000000,00000010,?,00F24EA2,00000010,00000001,00000010,?,?,00F1C193,?,00000010,00000000), ref: 00F2669D
GetLastError.KERNEL32(?,00F24EA2,00000010,00000001,00000010,?,?,00F1C193,?,00000010,00000000,?,?,?,00F1C71A,00000010), ref: 00F266A9

Part of subcall function 00F2666F: CloseHandle.KERNEL32(FFFFFFFE,00F266B9,?,00F24EA2,00000010,00000001,00000010,?,?,00F1C193,?,00000010,00000000,?,?), ref: 00F2667F

___initconout.LIBCMT ref: 00F266B9

Part of subcall function 00F26631: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00F26660,00F24E8F,?,?,00F1C193,?,00000010,00000000,?), ref: 00F26644

WriteConsoleW.KERNEL32(00000010,00000000,00F33A70,00000000,?,00F24EA2,00000010,00000001,00000010,?,?,00F1C193,?,00000010,00000000,?), ref: 00F266CE

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: c1abef627f1c818d985fad660ad6ce1b800ba176cf9749c4b62ec03f6489cc50
Instruction ID: 3af13052fdffdc1e19da0028c1554a327d36514589810a980a4bade3cb48daa7
Opcode Fuzzy Hash: c1abef627f1c818d985fad660ad6ce1b800ba176cf9749c4b62ec03f6489cc50
Instruction Fuzzy Hash: 23F0AC36500228BFCF622FD5EC08A993F66FB487B1F144510FA19D9130D6368820FF91

Function 00F29190 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 390COMMON

Download Yara Rule

APIs

Part of subcall function 00F04E90: std::_Lockit::_Lockit.LIBCPMT ref: 00F04E9D
Part of subcall function 00F04E90: std::_Lockit::_Lockit.LIBCPMT ref: 00F04EB7
Part of subcall function 00F04E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00F04ED8
Part of subcall function 00F04E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00F04F04

OffsetRect.USER32(00000000,00000000,00000000), ref: 00F2931F

Part of subcall function 00F04E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00F04F39

Strings

0, xrefs: 00F293C4
Zatlat, xrefs: 00F291E0

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::~_$Lockit::_$OffsetRect
String ID: 0$Zatlat
API String ID: 2708111867-1547964091
Opcode ID: 9ff7ed4520d334609afba42ce5afa986dd8413c8f53224beb29c9319be667e15
Instruction ID: e57e1aebb1a932045f89b98935c608693027645efb8faaff7614d0fb388f957f
Opcode Fuzzy Hash: 9ff7ed4520d334609afba42ce5afa986dd8413c8f53224beb29c9319be667e15
Instruction Fuzzy Hash: 41E1BB706083418FD714DF24D895B6ABBE1BFC9304F18496CF5898B392DB75E845EB82

Function 00F02160 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00F022CD

Part of subcall function 00F0BC00: RaiseException.KERNEL32(E06D7363,00000001,00000003,00F0BB23,?,?,?,?,00F0BB23,?,00F340FC,?), ref: 00F0BC60

Strings

ios_base::failbit set, xrefs: 00F0217D
ios_base::badbit set, xrefs: 00F02267, 00F02292, 00F022B0

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 3109751735-1240500531
Opcode ID: b6c91aefbaedf9c25c60c281fbfbdbc1686d323748371d9e9d9f79321c6126f4
Instruction ID: d22ed3a4d26016714b3623f285e1ba9f59855537b3c911d64edcde6486a40702
Opcode Fuzzy Hash: b6c91aefbaedf9c25c60c281fbfbdbc1686d323748371d9e9d9f79321c6126f4
Instruction Fuzzy Hash: 424106B2504304AFD704DF68CC45B9BB7E8BF89320F14861EF95487291E774E945EBA2

Function 00F0DFA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00F0DFDF
__IsNonwritableInCurrentImage.LIBCMT ref: 00F0E093

Strings

csm, xrefs: 00F0E07D

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 6074cfe10a010edf9df0586590e2bfbf0db5218a97d82738f21313254a64700a
Instruction ID: ca68203acdbad4dc760ae7bd3470e2f141918ef519d0bffd8cfd5f0ba7e3d5cc
Opcode Fuzzy Hash: 6074cfe10a010edf9df0586590e2bfbf0db5218a97d82738f21313254a64700a
Instruction Fuzzy Hash: DB41A170E00209DBCF20DF68CC84A9EBBB5BF44324F148556E8159B3D2D776A915FB91

Function 00F0E8AD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00F0E8D2

Strings

MOC, xrefs: 00F0E8E4
RCC, xrefs: 00F0E8EC

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 0f77710dee4e5701d2ee22b20ee85e46306e04d60c26feb208cf579bda4a4fc1
Instruction ID: 13f87a401604b8a0c961baef17d47af05f76013902e9fd2e2d6b76683aacf588
Opcode Fuzzy Hash: 0f77710dee4e5701d2ee22b20ee85e46306e04d60c26feb208cf579bda4a4fc1
Instruction Fuzzy Hash: 78414971900209AFDF16DF94CD81AAEBBB5BF48310F148499F904672A1D3359A50FB91

Function 00F019B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F019B5
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F019FA

Part of subcall function 00F09095: _Yarn.LIBCPMT ref: 00F090B4
Part of subcall function 00F09095: _Yarn.LIBCPMT ref: 00F090D8

Strings

bad locale name, xrefs: 00F01A08

Memory Dump Source

Source File: 00000000.00000002.2138000335.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2137984169.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138027358.0000000000F2A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138045741.0000000000F77000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2138103233.0000000000F82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: fdf154453030496162538d663cb1c9e1aaa2e07cf0b41730643f9ad98463f4d1
Instruction ID: 35374fa9e28a82615364cb06f96a8035a4f3ba7a5dab8a2cfa32838d8b18d7ed
Opcode Fuzzy Hash: fdf154453030496162538d663cb1c9e1aaa2e07cf0b41730643f9ad98463f4d1
Instruction Fuzzy Hash: 37F01D71505B408ED371DF758804743BAE0AF25710F048A5DE4CAC7A81E379E508DBA6

Analysis Process: RegAsm.exePID: 2732, Parent PID: 6060COMMON

Execution Graph

Execution Coverage:	7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	44
Total number of Limit Nodes:	6

Executed Functions

Function 00ECD0A8 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00ECD136
GetCurrentThread.KERNEL32 ref: 00ECD173
GetCurrentProcess.KERNEL32 ref: 00ECD1B0
GetCurrentThreadId.KERNEL32 ref: 00ECD209

Memory Dump Source

Source File: 00000002.00000002.2247538267.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: bf4ee91332fab757574437bdc7010f21516aaafe34ed5da2c73c3baea73009c0
Instruction ID: 5be02c30eef2e27e7a1a7be30e3e2b7826f60a60a112bcc0e0bba69440dceaef
Opcode Fuzzy Hash: bf4ee91332fab757574437bdc7010f21516aaafe34ed5da2c73c3baea73009c0
Instruction Fuzzy Hash: 695185B0900349CFDB14DFAADA48BAEBBF1EF88314F24845DE009A72A0CB755845CB25

Function 00ECD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00ECD136
GetCurrentThread.KERNEL32 ref: 00ECD173
GetCurrentProcess.KERNEL32 ref: 00ECD1B0
GetCurrentThreadId.KERNEL32 ref: 00ECD209

Memory Dump Source

Source File: 00000002.00000002.2247538267.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a3aca848a2d362d0d5b249b7c91b6448b22cfdaa6e242e192ae9c6338fdd0ba2
Instruction ID: 922c6b49eb5f6c984389cf796b74bec739e6003e1b94d68dd70f4ab17f79608c
Opcode Fuzzy Hash: a3aca848a2d362d0d5b249b7c91b6448b22cfdaa6e242e192ae9c6338fdd0ba2
Instruction Fuzzy Hash: 985177B09003498FDB54DFAADA48BAEBBF1EF88314F24841DE009B7360DB755945CB65

Function 00ECAE30 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00ECB086

Memory Dump Source

Source File: 00000002.00000002.2247538267.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 693dfbdb87e0706906c46768a5584e399e90da95d88b0227e53f28f177e08341
Instruction ID: 89e3d079aac6b0acc441b7f77cc611e4c722243abfc1b1f4289fb519e3e305ef
Opcode Fuzzy Hash: 693dfbdb87e0706906c46768a5584e399e90da95d88b0227e53f28f177e08341
Instruction Fuzzy Hash: 3C714870A00B498FD724DF69D545B6ABBF1FF88308F04892DE446E7A40DB76E846CB91

Function 00EC4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00EC59F1

Memory Dump Source

Source File: 00000002.00000002.2247538267.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f22ebaf3c7c78dcade0d4558439461c727fcf773f8be5d1da7456f52f21fed34
Instruction ID: 3b59e73227e99b25c4ba08d0cbb8b43b5de4b66dbae411cd951fe598f09075c0
Opcode Fuzzy Hash: f22ebaf3c7c78dcade0d4558439461c727fcf773f8be5d1da7456f52f21fed34
Instruction Fuzzy Hash: 9441B271C00719CBDB24DFAAC984B9DBBB5FF84714F20816AD408BB251DB766986CF90

Function 00EC5935 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00EC59F1

Memory Dump Source

Source File: 00000002.00000002.2247538267.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9a37ad17771a8330bc56e0b0cc4309c66c209a64185e744819296aa963e47331
Instruction ID: 9f828b13d6c9e5d088c236d3838f0c7931c98bfdc25f5e09638935aecab1f29c
Opcode Fuzzy Hash: 9a37ad17771a8330bc56e0b0cc4309c66c209a64185e744819296aa963e47331
Instruction Fuzzy Hash: BD41D371C00719CBDB24DFA9C984B9DBBB5FF44304F24815AD418BB251DB756945CF50

Function 00ECA858 Relevance: 1.6, APIs: 1, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00ECB101,00000800,00000000,00000000), ref: 00ECB312

Memory Dump Source

Source File: 00000002.00000002.2247538267.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ebe199b49cbcc8f749d6d27dbcd19b85d8fa38b80b3e444d82a845e124e43086
Instruction ID: 10821f87c2eac84f8cdc6fa7f63b1092df0b58bd33f0f07024f58dc5aac200d2
Opcode Fuzzy Hash: ebe199b49cbcc8f749d6d27dbcd19b85d8fa38b80b3e444d82a845e124e43086
Instruction Fuzzy Hash: 3931DEB6808398CFDB05CFAAC845BEEBFB0EB45314F04505ED444A7212C3799406CFA1

Function 00ECD300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00ECD387

Memory Dump Source

Source File: 00000002.00000002.2247538267.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 61e39322a7d54ac1d424af4aa10bf7c2f54193bbffa7a86307f084745659b9c4
Instruction ID: 59575c8ae27898cbd51946a851922b9e2c26b7985e5e23315193ee461dc37074
Opcode Fuzzy Hash: 61e39322a7d54ac1d424af4aa10bf7c2f54193bbffa7a86307f084745659b9c4
Instruction Fuzzy Hash: 0821E2B5900349DFDB10CFAAD984ADEBBF4EB48320F14841AE918A3310D379A954CFA1

Function 00ECD2F9 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00ECD387

Memory Dump Source

Source File: 00000002.00000002.2247538267.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e43a4b7046736fdf4991f91f45d3fa73f13c62f704d02da951fcf1b710117684
Instruction ID: 9dac8c858a0450429ecd20e9455a6f91d50f26c5f3cce1920ecfa60b8009aa04
Opcode Fuzzy Hash: e43a4b7046736fdf4991f91f45d3fa73f13c62f704d02da951fcf1b710117684
Instruction Fuzzy Hash: 6F21E0B5904249DFDB10CFAAD985ADEBBF4AB48324F14842AE918A3210C379A954CF61

Function 00ECB2A0 Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00ECB101,00000800,00000000,00000000), ref: 00ECB312

Memory Dump Source

Source File: 00000002.00000002.2247538267.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c5a144bed168088a3b31f793e2440aab4763644640f41b470b00fa1e0a294804
Instruction ID: 53346b737fcf12e58bfeb97b95e0b567836519f77f05f1e6a833676824ffaf28
Opcode Fuzzy Hash: c5a144bed168088a3b31f793e2440aab4763644640f41b470b00fa1e0a294804
Instruction Fuzzy Hash: 8E1103B68002498FDB10CF9AD984BDEFBF4AB88724F14842EE519B7200C3B5A545CFA5

Function 00ECA870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00ECB101,00000800,00000000,00000000), ref: 00ECB312

Memory Dump Source

Source File: 00000002.00000002.2247538267.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ad2f52c99157495d2de9c5c2ef7b233f1531e2a75e5dfc4da9cf07f3d21587d0
Instruction ID: 7c438b4fcd86236505e9e8676c69637ffc324ae9572e17771493edfbe06d6c6b
Opcode Fuzzy Hash: ad2f52c99157495d2de9c5c2ef7b233f1531e2a75e5dfc4da9cf07f3d21587d0
Instruction Fuzzy Hash: 3E1106B68003499FDB10CF9AC545B9EFBF4EB88724F10841EE515B7200C3B5A545CFA5

Function 00ECB020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00ECB086

Memory Dump Source

Source File: 00000002.00000002.2247538267.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5b5f02b330fd6840e62b573417846a5add3c57f0d8bc37de23350ab7b8c1c516
Instruction ID: 4fba02120066c70e0b354fb1903a6ac513150934b93240ed62adcdfacc7ed284
Opcode Fuzzy Hash: 5b5f02b330fd6840e62b573417846a5add3c57f0d8bc37de23350ab7b8c1c516
Instruction Fuzzy Hash: EA11C0B6C00749CBDB20CF9AC545B9EFBF4AB88724F14841AD429B7210D3B6A545CFA1

Function 00DED3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2247223012.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ded000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da0a2e6ef403c42755ff9515da048ba7dcedb088c11ff48843f2078aa1a88f76
Instruction ID: 9b9bb4bd05610e3353003f4ed5b5e59a42336e544f44d4dca1ef630fda5e850d
Opcode Fuzzy Hash: da0a2e6ef403c42755ff9515da048ba7dcedb088c11ff48843f2078aa1a88f76
Instruction Fuzzy Hash: 9A216A76100284DFDB04EF01D9C0B26BF66FBA4324F24C16CD9090B296CB36E856CBB2

Function 00DFD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2247252288.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_dfd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0246d8336d45faff0c0e86396509d6cdf1ec98cf35af17572497b69578598510
Instruction ID: 30a73c693f3f16ab046bcf9aed23cd9cef2fa3851d095c059898f18f575e8a8c
Opcode Fuzzy Hash: 0246d8336d45faff0c0e86396509d6cdf1ec98cf35af17572497b69578598510
Instruction Fuzzy Hash: 98212275604248EFDB14DF14D9C0B26BB63EB84314F24C56DEA4A4B252CB7AD847CA71

Function 00DFD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2247252288.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_dfd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f0a7b70d604d4b4d5a0df3c0fac4acd5a48f9d997466654cb9ced795758f27
Instruction ID: 9e88c880df586f50fb8c2708335f0e82ce2cf05e21390f7658fe8f957cf48348
Opcode Fuzzy Hash: e0f0a7b70d604d4b4d5a0df3c0fac4acd5a48f9d997466654cb9ced795758f27
Instruction Fuzzy Hash: 9E218E755093C48FCB02CF20D990715BF72EB46314F29C5EAD9498B6A7C33A980ACB62

Function 00DED3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2247223012.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ded000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5504dfd99aeaae02a5904faf24bf7c180eb56da23d91347c8bcbb22ee6d9b3
Instruction ID: e8c5279a92a1e0a8985b1f0e9ca14a5e7dab943e9a704f3f434d7b5bb897ed19
Opcode Fuzzy Hash: 5a5504dfd99aeaae02a5904faf24bf7c180eb56da23d91347c8bcbb22ee6d9b3
Instruction Fuzzy Hash: 1A1126B6404280CFCB01DF00D9C0B16BF72FBA4324F28C6A9D8090B656C33AE856CBA1

Function 00DEDA28 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2247223012.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ded000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b232e072bcdf9674c1756a50e1b2b6d56025cc22547644403e8b4e18428fd5
Instruction ID: d097c183134b16739786e21a1ae6cb53e8cfd14da7933af004e3d585e2b98c0c
Opcode Fuzzy Hash: f3b232e072bcdf9674c1756a50e1b2b6d56025cc22547644403e8b4e18428fd5
Instruction Fuzzy Hash: E3F0C271408384AAE7208E06DD84B62FF98EF50725F18C45AED084A282C6799940CBB1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_77195de72e43971d48d6de71c532aaf1a8604b66_05e236d2_6637171a-30ad-41d5-b2b5-4ea79d4d8a51\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB989.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBA65.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBAA5.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
file.exe

Function 030F018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 00F05240 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131
COMMON

Function 00F29C80 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 111
threadCOMMON

Function 00F18BAF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00F0F7DC Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 00F29B20 Relevance: 3.1, APIs: 2, Instructions: 93
memorysynchronizationthreadCOMMON

Function 00F0F680 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 00F18C7A Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Function 00F19B87 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE