Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1504335
MD5:	49fbbdd3bd005ded23aeadf895b316ed
SHA1:	5ddb0f409cce64e5859c0e6f1b4186469f71914d
SHA256:	b6e0fe385b4c96a6b9ce87315989e949e47d1835efa1cc037e5c00238e6e2a42
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Installs new ROOT certificates

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7588 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 49FBBDD3BD005DED23AEADF895B316ED)

conhost.exe (PID: 7596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7688 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "147.45.47.36:30035", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.1468172849.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1326352449.0000000004375000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: file.exe PID: 7588	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7688	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7688	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.4375570.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.4375570.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-04T19:28:06.698820+0200	2043234	1	A Network Trojan was detected	147.45.47.36	30035	192.168.2.9	49711	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-04T19:28:06.504712+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:11.748834+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:12.266722+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:12.557580+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:12.815172+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:13.038636+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:13.320504+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:13.559527+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:13.758238+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:14.022617+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:14.319036+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:14.565778+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:14.612223+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:14.623744+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:15.455847+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:15.657215+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:16.019173+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:16.230168+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:16.493868+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:16.734549+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:17.961728+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:18.160741+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:18.359371+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:18.557466+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:18.787756+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-04T19:28:11.952398+0200	2046056	1	A Network Trojan was detected	147.45.47.36	30035	192.168.2.9	49711	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-04T19:28:06.504712+0200	2046045	1	A Network Trojan was detected	192.168.2.9	49711	147.45.47.36	30035	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.1326352449.0000000004375000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "147.45.47.36:30035", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.9:49711 -> 147.45.47.36:30035
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.9:49711 -> 147.45.47.36:30035
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 147.45.47.36:30035 -> 192.168.2.9:49711
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 147.45.47.36:30035 -> 192.168.2.9:49711

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 147.45.47.36:30035

Source: global traffic

TCP traffic: 192.168.2.9:49711 -> 147.45.47.36:30035

Source: Joe Sandbox View

IP Address: 147.45.47.36 147.45.47.36

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36

Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: RegAsm.exe, 00000003.00000002.1468679556.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adp/1.0/
Source: RegAsm.exe, 00000003.00000002.1468679556.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.exif/1:
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000032BD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: RegAsm.exe, 00000003.00000002.1470218861.0000000003228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: file.exe, 00000000.00000002.1326352449.0000000004375000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1468172849.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp23FB.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp240B.tmp			Jump to dropped file

System Summary

.NET source code contains very large array initializations

Source: file.exe, MoveAngles.cs

Large array initialization: MoveAngles: array initializer size 311296

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02F3DC74	3_2_02F3DC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05706948	3_2_05706948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05700AFC	3_2_05700AFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05707C20	3_2_05707C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05700040	3_2_05700040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05700007	3_2_05700007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05700AF9	3_2_05700AF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05707C10	3_2_05707C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05701FF0	3_2_05701FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06AB67D8	3_2_06AB67D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06ABA3E8	3_2_06ABA3E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06ABA3E1	3_2_06ABA3E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06AB6FE8	3_2_06AB6FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06AB6FF8	3_2_06AB6FF8

Source: file.exe, 00000000.00000002.1323973758.000000000148E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000002.1326352449.00000000043B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePennants.exe8 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamesecinitj% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/6@0/1

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7596:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\Tmp23FB.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000003.00000002.1470218861.00000000036D9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1470218861.000000000362F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1470218861.000000000379A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1470218861.0000000003644000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1470218861.0000000003784000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1470218861.00000000036EF000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.3.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0570E090 push es; ret	3_2_0570E0A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0570C9C0 push es; ret	3_2_0570C9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06ABC71B push es; ret	3_2_06ABC720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06ABD413 push es; ret	3_2_06ABD420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06ABD538 pushad ; retn 0006h	3_2_06ABD539
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06ABD021 pushad ; retn 0006h	3_2_06ABD022
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06ABE069 push es; ret	3_2_06ABE070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06ABCE88 pushad ; retn 0006h	3_2_06ABCE8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06ABCED1 pushad ; retn 0006h	3_2_06ABCED2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06ABECF2 push eax; ret	3_2_06ABED01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06ABBC5F push esi; retn 0006h	3_2_06ABBC62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06ABDA70 pushfd ; retn 0006h	3_2_06ABDA71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06ABD9E0 push eax; retn 0006h	3_2_06ABD9E1

Source: file.exe

Static PE information: section name: .text entropy: 7.996132371262729

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 3120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 3370000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 31A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2EF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 3140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2F50000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 493			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1868			Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 7680	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7968	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7708	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696497155
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696497155
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: RegAsm.exe, 00000003.00000002.1483862437.0000000005AEB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: RegAsm.exe, 00000003.00000002.1470218861.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: RegAsm.exe, 00000003.00000002.1474313836.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_03372129 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_03372129

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: E04008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000002.1323973758.00000000014C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: file.exe, 00000000.00000002.1323973758.00000000014C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AVP.exe
Source: RegAsm.exe, 00000003.00000002.1487399073.0000000007995000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1469052988.000000000157D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1487311549.000000000797B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.4375570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.4375570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1468172849.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1326352449.0000000004375000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7688, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7688, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.4375570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.4375570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1468172849.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1326352449.0000000004375000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7688, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Install Root Certificate	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	URL Reputation	safe
147.45.47.36:30035	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	URL Reputation	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	Avira URL Cloud	safe
http://ns.adp/1.0/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8ResponseD	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
147.45.47.36:30035	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14ResponseD	RegAsm.exe, 00000003.00000002.1470218861.0000000003228000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	RegAsm.exe, 00000003.00000002.1470218861.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12Response	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21Response	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	RegAsm.exe, 00000003.00000002.1470218861.0000000003228000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id4	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19Response	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13ResponseD	RegAsm.exe, 00000003.00000002.1470218861.0000000003228000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15Response	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	RegAsm.exe, 00000003.00000002.1470218861.0000000003228000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000003.00000002.1470218861.0000000003228000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6Response	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	file.exe, 00000000.00000002.1326352449.0000000004375000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1468172849.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9Response	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24Response	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1Response	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21ResponseD	RegAsm.exe, 00000003.00000002.1470218861.0000000003228000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ns.adp/1.0/	RegAsm.exe, 00000003.00000002.1468679556.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15ResponseD	RegAsm.exe, 00000003.00000002.1470218861.0000000003228000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11ResponseD	RegAsm.exe, 00000003.00000002.1470218861.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17ResponseD	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	RegAsm.exe, 00000003.00000002.1470218861.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8ResponseD	RegAsm.exe, 00000003.00000002.1470218861.0000000003228000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	RegAsm.exe, 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.45.47.36	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1504335
Start date and time:	2024-09-04 19:27:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/6@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 93 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe, UsoClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, settings-win.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
13:28:16	API Interceptor	13x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
147.45.47.36	FileApp.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Stealc, Vidar, Xmrig, zgRAT	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	bj6NsBOOyE.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	FileApp.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Stealc, Vidar, Xmrig, zgRAT	Browse	147.45.47.36
	file.exe	Get hash	malicious	RedLine	Browse	147.45.47.36
	file.exe	Get hash	malicious	Stealc	Browse	147.45.47.137
	Selenium.exe	Get hash	malicious	LummaC	Browse	147.45.44.131
	Kpmg.exe	Get hash	malicious	LummaC	Browse	147.45.44.131
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	147.45.47.137
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.68.138
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.68.138
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.68.138
	file.exe	Get hash	malicious	RedLine	Browse	147.45.47.36

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 08:16:11 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.457771726436173
Encrypted:	false
SSDEEP:	48:8S6dYT5H0lRYrnvPdAKRkdAGdAKRFdAKRz:8Stx7
MD5:	CFC952154F54922BC2D8FD8CBB508037
SHA1:	50B4DC7AAFA25058F671653D4A01DA0CAC56B0CE
SHA-256:	31F34AB7220D598720CBF08F859E8AB962C666A35B5475F78082048F4473C029
SHA-512:	BAD9E686CC66E6EFBF79406A75F56272D7F2424AB5C0622E173685F692A95830695059DA21ADAB8C69B91F1F02F59AAB97072C7981EEB4CDBD2A6870DEBB09D4
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,........l....X.&&... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.IEW.I....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEW.F....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VEW.F....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VEW.F.............................A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.L .chrome.exe..F......CW.VEW.I..........................l...c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Temp\Tmp23FB.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp240B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.986315153668413
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	320'512 bytes
MD5:	49fbbdd3bd005ded23aeadf895b316ed
SHA1:	5ddb0f409cce64e5859c0e6f1b4186469f71914d
SHA256:	b6e0fe385b4c96a6b9ce87315989e949e47d1835efa1cc037e5c00238e6e2a42
SHA512:	cff67060ed809bff241b5ecec681d2960cbed94000ce1b2558069ab20a63e77767c3c38a512ee5f363aabef9e6d228f6c9997e6483db24ab1324f7de5c655a1c
SSDEEP:	6144:j6ulq0zUqahs0Tm9yNmxtXRHGXXtDlpxvaKV7LXAzfB6y3cq:20q0Ins0Tm9Um7JGHtDAKV7rq
TLSH:	D66423D7DE0BE7B1CD3609F290B98EAC2575E3F9447F8C482646833AC9E591C097A874
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M`.f................................. ........@.. .......................@............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x44f6de
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D8604D [Wed Sep 4 13:27:41 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4f690	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x50000	0x602	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x52000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4f558	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4d6e4	0x4d800	ef43b908c20ffb64d440bb83ce926c6b	False	0.9940492691532258	data	7.996132371262729	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x50000	0x602	0x800	9639fa6120fd371837905935aa41ec17	False	0.34619140625	data	3.469016537160503	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x52000	0xc	0x200	ccc8c3241508cfaa5c8a5493ebb495f9	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x500a0	0x378	data	English	United States	0.4560810810810811
RT_MANIFEST	0x50418	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-04T19:28:06.504712+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:06.504712+0200	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:06.698820+0200	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	147.45.47.36	30035	192.168.2.9	49711	TCP
2024-09-04T19:28:11.748834+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:11.952398+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	147.45.47.36	30035	192.168.2.9	49711	TCP
2024-09-04T19:28:12.266722+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:12.557580+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:12.815172+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:13.038636+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:13.320504+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:13.559527+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:13.758238+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:14.022617+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:14.319036+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:14.565778+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:14.612223+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:14.623744+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:15.455847+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:15.657215+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:16.019173+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:16.230168+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:16.493868+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:16.734549+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:17.961728+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:18.160741+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:18.359371+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:18.557466+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP
2024-09-04T19:28:18.787756+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49711	147.45.47.36	30035	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 4, 2024 19:28:05.796370983 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:05.801362038 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:05.801490068 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:05.811198950 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:05.816060066 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:06.462352991 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:06.503246069 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:06.504712105 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:06.509641886 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:06.698820114 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:06.753434896 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:11.748833895 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:11.753895998 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:11.952223063 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:11.952240944 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:11.952259064 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:11.952301025 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:11.952398062 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:11.952409983 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:11.952470064 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:12.003252983 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:12.266721964 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:12.271912098 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:12.462858915 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:12.518919945 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:12.557579994 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:12.562540054 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:12.750284910 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:12.800122023 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:12.815171957 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:12.820056915 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:13.009001970 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:13.038635969 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:13.044222116 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:13.319529057 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:13.320503950 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:13.325788975 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:13.522247076 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:13.559526920 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:13.565774918 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:13.753861904 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:13.758238077 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:13.763600111 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:13.951550961 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.003267050 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.022617102 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.027787924 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.027803898 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.027877092 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.027895927 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.027906895 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.027928114 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.027936935 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.028050900 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.028060913 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.028068066 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.028072119 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.028079987 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.033200026 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.033452034 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.033462048 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.033516884 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.312194109 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.319036007 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.324306965 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.324321985 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.324330091 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.324503899 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.324515104 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.324522972 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.324534893 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.324546099 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.525510073 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.565778017 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.612222910 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.621557951 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.621576071 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.621639013 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.623642921 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.623655081 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.623662949 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.623672962 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.623682976 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.623744011 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.623830080 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.626621008 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.626631021 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.626638889 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.626647949 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.626701117 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.626765013 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.626774073 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.626782894 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.626808882 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.626817942 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.626817942 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.626854897 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.626872063 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.626941919 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.626992941 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.627135992 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.627145052 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.627155066 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.627165079 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.627194881 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.627223015 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.631524086 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.631577969 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.631606102 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.631623983 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.631634951 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.631649971 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.631655931 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.631705999 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.631736994 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.631808996 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.631819010 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.631836891 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.631845951 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.631855011 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.631864071 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.631865025 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.631880045 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.631917953 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.632045031 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.632184982 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.632302046 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.632311106 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.632349968 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.632848024 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.632857084 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.632869959 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.632880926 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.632891893 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.632900953 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.632909060 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.632919073 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.632926941 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.632936001 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.632945061 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.632956028 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.632966042 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.632981062 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.632988930 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.632997036 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.633006096 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.633013964 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.633023977 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.633033037 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.633042097 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.633052111 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.633060932 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.633071899 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.633162975 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.636288881 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.636298895 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.636307001 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.636353970 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.636384010 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.636456966 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.636466980 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.636478901 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.636493921 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.636503935 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.636512995 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.636522055 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.636531115 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.636540890 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.636657953 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.636729002 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.636739016 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.636746883 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.636785984 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.636795044 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.636830091 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.636914968 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637001991 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637011051 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637020111 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637099981 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637219906 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637229919 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637238026 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637680054 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637689114 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637697935 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637706041 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637716055 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637728930 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637737989 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637747049 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637758017 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637767076 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637775898 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637784004 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637793064 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.637800932 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.638017893 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.638094902 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.638266087 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.638278008 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.638334990 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.638385057 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.638567924 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.638576984 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.638612986 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.638622999 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.638631105 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.638638973 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.638701916 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.638729095 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.638745070 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.638752937 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.638762951 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.638772011 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.638868093 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.638930082 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.638940096 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.639287949 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.639297009 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.639305115 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.639313936 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.639322042 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.639331102 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.639341116 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.639349937 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.639358044 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.639365911 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.639374018 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.639384985 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.639394045 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.639404058 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641143084 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641160965 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641251087 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641259909 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641319036 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641328096 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641446114 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641454935 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641472101 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641480923 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641514063 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641522884 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641531944 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641582966 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641592979 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641601086 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641668081 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641678095 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641959906 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641968966 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.641978025 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.642175913 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.642239094 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.642996073 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643048048 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643129110 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643137932 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643146038 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643156052 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643163919 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643198013 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643366098 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643376112 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643384933 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643393040 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643402100 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643413067 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643421888 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643471003 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643480062 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643487930 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643497944 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643507004 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643516064 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643526077 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643630981 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643639088 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643646955 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643656015 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643665075 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643673897 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643867016 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643877983 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643891096 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643901110 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643909931 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643919945 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643930912 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643940926 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643949986 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643959045 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.643968105 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.644002914 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.644012928 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.644021988 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.644031048 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.644040108 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.644047976 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.644057035 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.644066095 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.644076109 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.644084930 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.644092083 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.644100904 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.644367933 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.644376040 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.644385099 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.644582987 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.644640923 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.647250891 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647260904 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647269011 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647387028 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647396088 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647404909 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647416115 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647424936 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647434950 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647443056 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647599936 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647609949 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647618055 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647625923 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647660017 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647669077 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647676945 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647687912 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647696972 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647706032 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647869110 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647878885 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647890091 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647898912 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647907972 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647967100 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647974968 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647984028 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.647993088 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648108006 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648122072 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648129940 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648140907 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648188114 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648197889 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648205996 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648211002 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648215055 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648377895 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648387909 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648396015 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648405075 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648415089 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648418903 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648427963 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648437023 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648446083 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648456097 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648464918 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648474932 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648493052 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648504972 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648514032 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648524046 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.648699045 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.648768902 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.649535894 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.649600983 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.649610996 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.649859905 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.649869919 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.649879932 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.649936914 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.649946928 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.649955988 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650042057 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650053024 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650207043 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650216103 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650255919 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650265932 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650274038 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650284052 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650399923 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650408983 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650418043 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650427103 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650578022 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650587082 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650595903 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650605917 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650614023 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650696039 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650705099 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650713921 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650722980 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650732040 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650779963 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650789976 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650798082 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650808096 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650820971 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650830030 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650840044 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650850058 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650859118 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650866985 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.650875092 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.651143074 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.651150942 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.651159048 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.651168108 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.651176929 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.651185989 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.651195049 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.651204109 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.651212931 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.651221991 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.651231050 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.651240110 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.651402950 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.651489019 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.653831959 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.653841972 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.653851032 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.653861046 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.653939009 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.654016018 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.654023886 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.654033899 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.654042959 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.654159069 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.654167891 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.654304028 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.654313087 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.654316902 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.654445887 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.654625893 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.654634953 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.654644012 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.654654026 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.654763937 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.654773951 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.654783964 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.654793978 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.654802084 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655149937 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655158997 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655168056 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655177116 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655185938 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655194998 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655204058 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655214071 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655222893 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655368090 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655376911 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655385971 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655395031 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655404091 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655412912 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655421972 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655436993 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655447006 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655457020 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655466080 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655476093 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655484915 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655495882 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655513048 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655522108 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655529976 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655783892 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655793905 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655802011 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.655811071 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.656048059 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.656126022 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.656476021 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.656621933 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.656630993 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.656753063 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.656763077 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.656771898 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.656785011 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.656790018 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.656794071 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.656801939 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.656965971 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.656976938 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.656985998 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.656996012 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657103062 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657111883 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657120943 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657135010 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657144070 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657152891 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657160997 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657170057 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657179117 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657187939 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657206059 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657215118 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657223940 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657233000 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657243013 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657253981 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657263041 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657273054 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657283068 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657320023 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657464027 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657473087 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657480955 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657490015 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657499075 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657507896 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657579899 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657588959 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657598972 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657608032 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657617092 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657625914 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657629967 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657802105 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657809973 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657814026 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657821894 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657830954 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657840014 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.657850027 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.658051968 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.658126116 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.661000967 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661026955 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661158085 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661228895 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661237955 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661247015 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661258936 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661267996 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661344051 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661353111 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661360979 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661381006 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661391973 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661401033 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661410093 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661540031 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661550045 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661556959 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661566019 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661575079 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661583900 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661592960 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.661654949 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.702497959 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:14.704113007 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:14.753793001 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:15.453211069 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:15.455847025 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:15.461420059 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:15.654294014 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:15.657215118 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:15.665642023 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:15.874351978 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:15.925148010 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:16.019172907 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:16.029392004 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:16.225857973 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:16.230168104 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:16.235430956 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:16.423384905 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:16.472084045 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:16.493868113 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:16.499010086 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:16.693003893 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:16.734549046 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:16.741089106 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:16.929035902 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:16.972059011 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:17.961728096 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:17.966722965 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:18.158312082 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:18.160741091 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:18.170274019 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:18.358908892 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:18.359370947 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:18.364257097 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:18.556668043 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:18.557466030 CEST	49711	30035	192.168.2.9	147.45.47.36
Sep 4, 2024 19:28:18.568392038 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:18.757477045 CEST	30035	49711	147.45.47.36	192.168.2.9
Sep 4, 2024 19:28:18.787755966 CEST	49711	30035	192.168.2.9	147.45.47.36

Target ID:	0
Start time:	13:28:03
Start date:	04/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xff0000
File size:	320'512 bytes
MD5 hash:	49FBBDD3BD005DED23AEADF895B316ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1326352449.0000000004375000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:28:03
Start date:	04/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:28:03
Start date:	04/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xd90000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.1468172849.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.1470218861.00000000031E7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	34.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	25%
Total number of Nodes:	24
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 03372129 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0337209B,0337208B), ref: 03372298
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 033722AB
Wow64GetThreadContext.KERNEL32(0000009C,00000000), ref: 033722C9
ReadProcessMemory.KERNELBASE(00000098,?,033720DF,00000004,00000000), ref: 033722ED
VirtualAllocEx.KERNELBASE(00000098,?,?,00003000,00000040), ref: 03372318
WriteProcessMemory.KERNELBASE(00000098,00000000,?,?,00000000,?), ref: 03372370
WriteProcessMemory.KERNELBASE(00000098,00400000,?,?,00000000,?,00000028), ref: 033723BB
WriteProcessMemory.KERNELBASE(00000098,05050F18,?,00000004,00000000), ref: 033723F9
Wow64SetThreadContext.KERNEL32(0000009C,03250000), ref: 03372435
ResumeThread.KERNELBASE(0000009C), ref: 03372444

Strings

WriteProcessMemory, xrefs: 0337223C
TerminateProcess, xrefs: 03372327
GetThreadContext, xrefs: 03372203
SetThreadContext, xrefs: 0337224F
aryA, xrefs: 0337216F
ResumeThread, xrefs: 03372265
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 03372297
VirtualAllocEx, xrefs: 03372229
Load, xrefs: 03372167
ress, xrefs: 033721B3
CreateProcessA, xrefs: 033721DD
GetP, xrefs: 033721AB
ReadProcessMemory, xrefs: 03372216
VirtualAlloc, xrefs: 033721F0

Memory Dump Source

Source File: 00000000.00000002.1325301350.0000000003371000.00000040.00000800.00020000.00000000.sdmp, Offset: 03371000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3371000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: eb656cb76fbd38af85da25f8dc8332769aa85bb7cdb249706ae6c1318752da8e
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 35B1E77664024AAFDB60CF68CC80BDA77A9FF88714F158564EA0CEB341D774FA418B94

Function 03120AD7 Relevance: 1.8, APIs: 1, Instructions: 262
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,04373590,?,?,?), ref: 03120DDC

Memory Dump Source

Source File: 00000000.00000002.1324419446.0000000003120000.00000040.00000800.00020000.00000000.sdmp, Offset: 03120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3120000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 70bb7f42d38c6a51854c1ec60c0023ab3163f9c05e66f66137b12a17aa9986ee
Instruction ID: ca54b538cf6d31e76211750fc65e0b3037a49fa1209f303538ed2210865edac1
Opcode Fuzzy Hash: 70bb7f42d38c6a51854c1ec60c0023ab3163f9c05e66f66137b12a17aa9986ee
Instruction Fuzzy Hash: 1EB18F71A002698FCB15CB9DC890AEDFBF2FB4D314F1986A9D459AB351C334AD51CBA0

Function 031204B0 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,04373590,?,?,?), ref: 03120DDC

Memory Dump Source

Source File: 00000000.00000002.1324419446.0000000003120000.00000040.00000800.00020000.00000000.sdmp, Offset: 03120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3120000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2f8dd6cf9b5530956ceb85149e1182ca5ba9c089b408e36c1f0bbdc9f67ac9dc
Instruction ID: 56e60d93ba90c457474bcc82bdd45c473e70d149c08bfeb5f9f72ce892ac3e8e
Opcode Fuzzy Hash: 2f8dd6cf9b5530956ceb85149e1182ca5ba9c089b408e36c1f0bbdc9f67ac9dc
Instruction Fuzzy Hash: 9321DEB590125DEBDB10DF9AD884BDEFFB4FB48310F50826AE918A7250C374A950CFA5

Analysis Process: RegAsm.exePID: 7688, Parent PID: 7588COMMON

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	159
Total number of Limit Nodes:	10

Executed Functions

Function 05706948 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1483532186.0000000005700000.00000040.00000800.00020000.00000000.sdmp, Offset: 05700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5700000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b3590145b5b0f9c7d0cd9446689830c8b86362e99cebb3277ebb0d9a187f3f
Instruction ID: deddfff4d2bc3c99e49116b500d15d47c8cce36175ecf57fdbe8e99303442f30
Opcode Fuzzy Hash: 37b3590145b5b0f9c7d0cd9446689830c8b86362e99cebb3277ebb0d9a187f3f
Instruction Fuzzy Hash: F9220274900228DFDB65DF64C958BE9BBB2FF4A300F0094E9D509AB2A0DB359E84DF51

Function 06AB67D8 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1bc92cb9b88a13affd3d745f5dc67bf26365f4e9f4ad3fedeb9a2c216965222
Instruction ID: b9903482961b49ba9d62692de8a245fcee2d0418e728c8c9992593f678093ad9
Opcode Fuzzy Hash: f1bc92cb9b88a13affd3d745f5dc67bf26365f4e9f4ad3fedeb9a2c216965222
Instruction Fuzzy Hash: 0BF19F30A003199FDB45EF68D840BDEBBF6EF89310F159569E505AB2A2DB30ED45CB90

Function 06ABA3E1 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9886a20670b1fc806df2a6ec8429daf40eee2c89358c7941fe6c062cfa6767
Instruction ID: 20bd48d11f5f4f84cd8edd3dd1f81b9e69eeb14f32e5095f24fc95a9039a2bf3
Opcode Fuzzy Hash: 5a9886a20670b1fc806df2a6ec8429daf40eee2c89358c7941fe6c062cfa6767
Instruction Fuzzy Hash: 1AD1E470D00218CFCB58EFB5D954A9DBBB2FF8A301F1085ADD50AAB254DB359986CF21

Function 06ABA3E8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab31556b8047233ae622e1a2fd270296cb3b6752b4900afb1a4f727379c61eaa
Instruction ID: de64eae515052de0f16f8c06605dcdcc85302c177097cdd046f810f5288e6988
Opcode Fuzzy Hash: ab31556b8047233ae622e1a2fd270296cb3b6752b4900afb1a4f727379c61eaa
Instruction Fuzzy Hash: F0D1D470D00218CFCB58EFB5D954A9DBBB2FF8A301F1085ADD50AAB254DB359986CF21

Function 05707C20 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1483532186.0000000005700000.00000040.00000800.00020000.00000000.sdmp, Offset: 05700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5700000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9497911521bf56c21272cb31cb17a91141ca8f79a5b07f514072db80e7ea88eb
Instruction ID: a8fd9f614216b6f1f777f25b926b6cf28d95c20fd121cdb08cc5996c5ba629a2
Opcode Fuzzy Hash: 9497911521bf56c21272cb31cb17a91141ca8f79a5b07f514072db80e7ea88eb
Instruction Fuzzy Hash: 1FC19374E04218CFDB14DFA6D884A9EBBF2FF89300F10D1A9D809AB255DB346986CF55

Function 05700AFC Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1483532186.0000000005700000.00000040.00000800.00020000.00000000.sdmp, Offset: 05700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5700000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f0b3b2e9db6b66ae2d25752eec5023f36751e517524d3b24b9a8237aa12df8
Instruction ID: 6a2feb752e8b9b7abc8c4123d08e80fef3ea96f552607fc86ea3b2b85e18b6a5
Opcode Fuzzy Hash: a9f0b3b2e9db6b66ae2d25752eec5023f36751e517524d3b24b9a8237aa12df8
Instruction Fuzzy Hash: 2BA17275E10319CFCB04DBA4C8549DDFBFAFF89310F158216E416AB2A1DB30A945EB60

Function 05700AF9 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1483532186.0000000005700000.00000040.00000800.00020000.00000000.sdmp, Offset: 05700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5700000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c38a9f5c334f532c2753e84493c17e40412a07cac71caf80347791fbba4c8ce9
Instruction ID: 88ecd8acee38b3780b1a23a65193a69dbc3a53b5ac72abe4cc779ece424e65ab
Opcode Fuzzy Hash: c38a9f5c334f532c2753e84493c17e40412a07cac71caf80347791fbba4c8ce9
Instruction Fuzzy Hash: 05917075E10319DFCB04DBA4D8449DDFBFAFF89310F158216E516AB2A1DB30A941EBA0

Function 05701FF0 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1483532186.0000000005700000.00000040.00000800.00020000.00000000.sdmp, Offset: 05700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5700000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e4f7109d51e767410428a2e42d2c306d459dc1597e3e7919bb379ff8f2032a3
Instruction ID: 53ea43ff7e626e76ee636b2a54513787c6065718efa6f2b9d01e6be8a51d0edf
Opcode Fuzzy Hash: 0e4f7109d51e767410428a2e42d2c306d459dc1597e3e7919bb379ff8f2032a3
Instruction Fuzzy Hash: AA917075E10319DFCB04DBA4D8449DDFBFAFF89310F158216E516AB2A0DB30A945EBA0

Function 05707C10 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1483532186.0000000005700000.00000040.00000800.00020000.00000000.sdmp, Offset: 05700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5700000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1d08cbdd02f62a4c59bc44b2791d86e60d1e2cee62c5487e7bbaec6f6dee861
Instruction ID: 907ced5ec5a7277ed347074ab2da93338b703eac2d9e299b5eeb8a465dfbc847
Opcode Fuzzy Hash: f1d08cbdd02f62a4c59bc44b2791d86e60d1e2cee62c5487e7bbaec6f6dee861
Instruction Fuzzy Hash: 9751A674E00618CBEB18DFAAD844B9EBBB3BFC8300F14C1A9D81DAB255DB3459859F54

Function 06AB0040 Relevance: 9.3, Strings: 5, Instructions: 3078
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ld<t, xrefs: 06AB27C9
H;<t, xrefs: 06AB2768
09<t, xrefs: 06AB288B
:<t, xrefs: 06AB2ADC
(:<t, xrefs: 06AB29AE

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID: (:<t$09<t$H;<t$Ld<t$:<t
API String ID: 0-3123518023
Opcode ID: 2c641f0c834cb4cdff8fbcbf46e05112cede8dd8034121d601f1a7e43eca6ae1
Instruction ID: 4fdedbfd77bfc87a716028904b2d6c76800fde636d4e6fcbabf7a70784ac8f4d
Opcode Fuzzy Hash: 2c641f0c834cb4cdff8fbcbf46e05112cede8dd8034121d601f1a7e43eca6ae1
Instruction Fuzzy Hash: 83536F31A40318AFEB269B90DC15BED77B6FF89700F1040D9E60A6B6D0CA765E84CF59

Function 06A90597 Relevance: 1.7, Strings: 1, Instructions: 462
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

olPj, xrefs: 06A9059C

Memory Dump Source

Source File: 00000003.00000002.1485031236.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID: olPj
API String ID: 0-336650015
Opcode ID: 2f694211c4a08dc26bf426fa28fc666dc7cdf4810092cd9d596190956de7e3ee
Instruction ID: b0c0a886ed408db85c4b2837e9893755badc8a1fcbc2e6653634e9ef8e2cc02b
Opcode Fuzzy Hash: 2f694211c4a08dc26bf426fa28fc666dc7cdf4810092cd9d596190956de7e3ee
Instruction Fuzzy Hash: 1602A930B007148FDB64AB64D894A6E77F2BF8A704F50855CD6029B3A1CF79ED05CBA6

Function 02F3AE30 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02F3B086

Memory Dump Source

Source File: 00000003.00000002.1469751574.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f30000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4f7d2bdcd4318afebd375442127e4dfbee8b09d40343ee938430ced0bc29ecf1
Instruction ID: 77f40cfe7d6b104e32f972b0e084cfab4565098e369d97bc6697ae357a2e1f2c
Opcode Fuzzy Hash: 4f7d2bdcd4318afebd375442127e4dfbee8b09d40343ee938430ced0bc29ecf1
Instruction Fuzzy Hash: 3F7156B1A00B058FD725DF2AD44079ABBF1FF88754F00892DD18ADBA50D774E845CB91

Function 05700AA8 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05701E02

Memory Dump Source

Source File: 00000003.00000002.1483532186.0000000005700000.00000040.00000800.00020000.00000000.sdmp, Offset: 05700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5700000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3ae3d66decf42a46dc9a3166d53905345ba68bdb08c9400d7efbd117f1a4fc5c
Instruction ID: 4622d611b19d0e8dfd292ab360373cfe207d288cbfbbf5593b70757b2164d951
Opcode Fuzzy Hash: 3ae3d66decf42a46dc9a3166d53905345ba68bdb08c9400d7efbd117f1a4fc5c
Instruction Fuzzy Hash: 8251CFB1D00349DFDB14CFA9C984ADEBBF6BF48710F64812AE819AB250D7709885CF90

Function 05701CE4 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05701E02

Memory Dump Source

Source File: 00000003.00000002.1483532186.0000000005700000.00000040.00000800.00020000.00000000.sdmp, Offset: 05700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5700000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c8aca1f5a593dbdcffb95eda52c5c97d0f54a28099e96592fb31f1c7153f2ca8
Instruction ID: 3b17c426d69596a6e056af920e6f5b14e568be8dec678083ad65d82f72de65aa
Opcode Fuzzy Hash: c8aca1f5a593dbdcffb95eda52c5c97d0f54a28099e96592fb31f1c7153f2ca8
Instruction Fuzzy Hash: E851BEB1D00359DFDB14CFA9C984ADEBBF5BF48710F64812AE819AB250D7B09985CF90

Function 05700BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05704381

Memory Dump Source

Source File: 00000003.00000002.1483532186.0000000005700000.00000040.00000800.00020000.00000000.sdmp, Offset: 05700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5700000_RegAsm.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 366319622b25572e68f933b14e09c04f7b3bb6051c35b9c1bfac38c072c08ac6
Instruction ID: 99a59a9d8278279e7a543463740ba284b0374b9e8137c1c7b80e13f1df6598f6
Opcode Fuzzy Hash: 366319622b25572e68f933b14e09c04f7b3bb6051c35b9c1bfac38c072c08ac6
Instruction Fuzzy Hash: 834129B5900309DFCB14CF99C848AAAFBF6FF88314F249559E519AB360D770A845CBA0

Function 02F34248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02F359F1

Memory Dump Source

Source File: 00000003.00000002.1469751574.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f30000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f3ea1c9975c8a5676b1f8073187872e417ef497a3a9dea0d84fa979c06e93527
Instruction ID: 2bc7c565cb54f239e4ae06af64ef0fead1c3cd9e3db603fa728896910fb5e30e
Opcode Fuzzy Hash: f3ea1c9975c8a5676b1f8073187872e417ef497a3a9dea0d84fa979c06e93527
Instruction Fuzzy Hash: FF41C171D0071CCBDB25CFA9C884B9EBBB5BF48704F64806AD508AB250DBB5694ACF90

Function 02F35935 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02F359F1

Memory Dump Source

Source File: 00000003.00000002.1469751574.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f30000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b490649481ce3a048163a332cc97057bd1bc7b044879b29a1ca01c52909da86d
Instruction ID: 66d31a7fadd597db9f37735b8a52f8459d56c1d77697c3221efa8042020f6c01
Opcode Fuzzy Hash: b490649481ce3a048163a332cc97057bd1bc7b044879b29a1ca01c52909da86d
Instruction Fuzzy Hash: A541D171D00718CFDB25CFA9C884BCEBBB5BF48304F24806AD508AB250DBB5694ACF50

Function 02F3C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02F3D2C6,?,?,?,?,?), ref: 02F3D387

Memory Dump Source

Source File: 00000003.00000002.1469751574.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f30000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1ef5caca74d5a6828e5618560a575ed684c626eaf3ec5ff0754729362475e408
Instruction ID: 4183be4049b8d1ec338a5958a311e4823b270a2f7552c13690d8519c257861a6
Opcode Fuzzy Hash: 1ef5caca74d5a6828e5618560a575ed684c626eaf3ec5ff0754729362475e408
Instruction Fuzzy Hash: DB21E5B5900348DFDB11CF9AD984AEEBBF4EB48314F14845AE914A7310D374A954CFA5

Function 02F3D2F9 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02F3D2C6,?,?,?,?,?), ref: 02F3D387

Memory Dump Source

Source File: 00000003.00000002.1469751574.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f30000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f6d23746a559d7e87b0eb759d79a151383657038775cf0933ea7496a9804a1b8
Instruction ID: 51b17f8f3c44450e3201311a426f44c0eea58df477298b780fc08a42a20cb76d
Opcode Fuzzy Hash: f6d23746a559d7e87b0eb759d79a151383657038775cf0933ea7496a9804a1b8
Instruction Fuzzy Hash: 2A21E3B6D00348DFDB11CFA9D985AEEBBF4AB48324F14841AE958A7210C374A944CF64

Function 02F3B2A0 Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02F3B101,00000800,00000000,00000000), ref: 02F3B312

Memory Dump Source

Source File: 00000003.00000002.1469751574.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f30000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f0430381d2f43253688618d13872d6964f9d2f5c69245bd7cb20d9e4986edd2e
Instruction ID: 70fa851a1c701a77836b20bbcb51e77fde28e869ea97e572ecd65285ef4f3f4b
Opcode Fuzzy Hash: f0430381d2f43253688618d13872d6964f9d2f5c69245bd7cb20d9e4986edd2e
Instruction Fuzzy Hash: 671114B6C003498FDB21CF9AC884BDEFBF4EB48724F14842AE919A7600C374A545CFA5

Function 02F3A870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02F3B101,00000800,00000000,00000000), ref: 02F3B312

Memory Dump Source

Source File: 00000003.00000002.1469751574.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f30000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 26ebcb4a098e78aec6d23f047c9a17745152153720986683f04df2bfb822e127
Instruction ID: 90e73b7e164d8dfca9acb2ef926c9bc50861c549050dfeb9ead5b3868feef3d6
Opcode Fuzzy Hash: 26ebcb4a098e78aec6d23f047c9a17745152153720986683f04df2bfb822e127
Instruction Fuzzy Hash: 371114B6D003498FDB21CF9AC844BDEFBF4EB48714F14842AE919A7200C374A545CFA5

Function 02F3B020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02F3B086

Memory Dump Source

Source File: 00000003.00000002.1469751574.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f30000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0c7ace647ed23d9e54e7406467c2a0a15c6c1f046f4d50e47769d04461d9e3d8
Instruction ID: bc077d793f30701987b0db306f33a99c8ede530588bfc2df37ad88fce609bfa8
Opcode Fuzzy Hash: 0c7ace647ed23d9e54e7406467c2a0a15c6c1f046f4d50e47769d04461d9e3d8
Instruction Fuzzy Hash: ED110FB6C003498FCB20CF9AC844BDEFBF4AB88628F14842AD568B7210C375A545CFA1

Function 06A91BA0 Relevance: 1.4, Instructions: 1353
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1485031236.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f738e9732cd05fabe624210a89a52a3d402afee744a6448a9bc401b5dc4328e
Instruction ID: c120b25aab266f683e47f10dba53cdcb9b54edbdb9d4939561ec52401294bac8
Opcode Fuzzy Hash: 7f738e9732cd05fabe624210a89a52a3d402afee744a6448a9bc401b5dc4328e
Instruction Fuzzy Hash: 3FC25E30B102189FDF54DB64C954BEDB7B2BF89304F118099E60AAB3A1DB719E85CF61

Function 06A93838 Relevance: 1.0, Instructions: 1020COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485031236.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bce0136d1f93ea0fdc61434644f3dcfa4717a3b7f8e9ac44a44483c02fc0c23a
Instruction ID: 36ef378724a1e291d8a306626b48a5e02c6717d70954ed57dadf0e473040aaca
Opcode Fuzzy Hash: bce0136d1f93ea0fdc61434644f3dcfa4717a3b7f8e9ac44a44483c02fc0c23a
Instruction Fuzzy Hash: 46824A74B002049FDB44DF68C998EAABBF6FF89704F158099E506DB3A1DA71ED41CB60

Function 06A900D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485031236.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc7c41bb8e353adf342657e1ba907e336c834466028a68aabc868472f3f1615
Instruction ID: 1966654dfda3a8157bced0fa2d1cf97fd217a03fd75e83531edb1df8a1afdb98
Opcode Fuzzy Hash: ccc7c41bb8e353adf342657e1ba907e336c834466028a68aabc868472f3f1615
Instruction Fuzzy Hash: FD428930B007298FDB64AF64E49466EB7F2FFC6614B504A4CD5039B390CB79ED058BA6

Function 06AB48A8 Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f9f6532ef53d50c5bc80cbbcb7220683de72fc55f5ab7464041176c5ab44ccd
Instruction ID: 4a7ffe8e8528c934cf28f95e2c481e192ac43d047b126e11b468dea277d27446
Opcode Fuzzy Hash: 1f9f6532ef53d50c5bc80cbbcb7220683de72fc55f5ab7464041176c5ab44ccd
Instruction Fuzzy Hash: 13123674B006058FDB54EF29C984AAABBF6FF89710B1584A9E506CB767DB30EC41CB50

Function 06A9060F Relevance: .4, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485031236.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4d0300bb76ad235c4d9d8934b8b3594f8a08a3ab6e26741d5591c5d9cc992ef
Instruction ID: f69599ac823ca223a6c3230461e557c745a800badd235a0f4ab8ec46093e3d48
Opcode Fuzzy Hash: a4d0300bb76ad235c4d9d8934b8b3594f8a08a3ab6e26741d5591c5d9cc992ef
Instruction Fuzzy Hash: 4BF1AA30B103148FDB64AB64D898A6A77F2BF8A704F50855DD6029B3A1CF79DD05CBA2

Function 06AB3F50 Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a48dc35e17588eb6a759e5044d0c76f4a60fa0dd4b93ffa6ee31337a5e5afd99
Instruction ID: 853b034514843cfceeaeb60822deac7cda10bcdfa8e9ad997df369cd5d8f5738
Opcode Fuzzy Hash: a48dc35e17588eb6a759e5044d0c76f4a60fa0dd4b93ffa6ee31337a5e5afd99
Instruction Fuzzy Hash: 96E13B34F002158FDB54EF69D894AAEB7F6FF88610B149169D906EB366DB31DC01CBA0

Function 06A90687 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485031236.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6937f937e086e4cff3789bfaba26931cbf686241821b67e4ad78e32a6c66997f
Instruction ID: c5bc87dd029cfbc1cdc4172072536ec77fd73e8df13d25e17ef877a436bef4f1
Opcode Fuzzy Hash: 6937f937e086e4cff3789bfaba26931cbf686241821b67e4ad78e32a6c66997f
Instruction Fuzzy Hash: 37E18C30B103148FDF54AB64D898B6977F2BF8A704F608459E6029B3A1CF79DD45CBA2

Function 06A906FF Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485031236.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 115a57a7be18988d523bd914e2e4a4d847f4a0916b19572d5b2d41e6db721911
Instruction ID: a933163887376297793cd7bf65486c741c695dbb6e38911dfe0c046a8368572b
Opcode Fuzzy Hash: 115a57a7be18988d523bd914e2e4a4d847f4a0916b19572d5b2d41e6db721911
Instruction Fuzzy Hash: A9D16F30B103049FEF54AB64C898B6977F6BF8A705F608059E6029B3A1CF75DD45CB62

Function 06A900B7 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485031236.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 815c20a7efe526a1ba2094818a092a78f4b1ed6445d0a150321bbda9864bd490
Instruction ID: 90f3885d14ab2584b2421ac475284efe52c4414c39ab4c2f41fd3c6e47d09e55
Opcode Fuzzy Hash: 815c20a7efe526a1ba2094818a092a78f4b1ed6445d0a150321bbda9864bd490
Instruction Fuzzy Hash: 03C16F30B103049FDF449B64C999B697BF6BF8A744F20805AEA069B3A1CF75DC45CB62

Function 06A91582 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485031236.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f369d2e346d37b47985ef7495d37cda9c872e9149dccc84bf9070f05a8756c
Instruction ID: 9e344e3d02b0c3b3c79bd1765ebcc6df267a1fd27cd39979d962e115f2736fb6
Opcode Fuzzy Hash: 08f369d2e346d37b47985ef7495d37cda9c872e9149dccc84bf9070f05a8756c
Instruction Fuzzy Hash: E4C1B330B043029FEF55ABA5C894A6E77F6AF8A704F208459D5039B392DF75DC06CB61

Function 06A91073 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485031236.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc5ac2375d45bd7721a6999f5c2e7a2897a9f02726ee3bdf97296d5c6f2bc678
Instruction ID: aa78203c0c92ca9a8f226d4d865bed7e0857f172fe7baab0ec9e9170df2e378a
Opcode Fuzzy Hash: bc5ac2375d45bd7721a6999f5c2e7a2897a9f02726ee3bdf97296d5c6f2bc678
Instruction Fuzzy Hash: 96B1B430B002029FDF55AB69D894A6A77F6EFCA704F218469E516DB3A1CF70DC01CB61

Function 06A91298 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485031236.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 627f4ae36dccfbd61531d4a98b59b4c6613de11c555912e1f73e46d54b99b284
Instruction ID: ca708c40fd8f999e1ab9f8e43ec859730b7e0ccdf384e412bd6eeb4c276b457c
Opcode Fuzzy Hash: 627f4ae36dccfbd61531d4a98b59b4c6613de11c555912e1f73e46d54b99b284
Instruction Fuzzy Hash: A061C870B043029FEF55ABA5D894B7A77F6BFC9618B208065E6029B392DF71DC01CB61

Function 06AB7D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 006abcbac70e181c0e74cc5744b0b6834a746b28f5c520121617e3bd397c348f
Instruction ID: 8ea748bd7d3ddfad53b3b846fb2b44ce28f77a185d4c92c7638d626caf5f207f
Opcode Fuzzy Hash: 006abcbac70e181c0e74cc5744b0b6834a746b28f5c520121617e3bd397c348f
Instruction Fuzzy Hash: E9513871E00358CFDB55DFA9D880BEEBBF6AF88700F14842AE415AB240DBB49941CF80

Function 06A934D8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485031236.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d7f827c3a921c0b862099b3cd394a4f30468dafb5e4ab7a2e5ff19375d0bad
Instruction ID: 682996d8ef59361edc5d86a6d1ec7eb9c1c7fe9cd8ef1de84fab2d9fc8073a77
Opcode Fuzzy Hash: 73d7f827c3a921c0b862099b3cd394a4f30468dafb5e4ab7a2e5ff19375d0bad
Instruction Fuzzy Hash: A2514835B106159FCF44DF69C88499ABBF2EF8D314B118069E906EB361DB30EC45CB60

Function 06AB7D4C Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df370c2e030fcb715fcf1d5921364fd85c380799046c640124b07dd46fd6a5ab
Instruction ID: f555e9d13a4a36c35f13f711fb021ebd69cc75155043780cb11bb017ee29f362
Opcode Fuzzy Hash: df370c2e030fcb715fcf1d5921364fd85c380799046c640124b07dd46fd6a5ab
Instruction Fuzzy Hash: 94515A70D00358DFDB55DFA9C985BDEBBF6AF88700F14842AE415AB241D7B49841CF90

Function 06AB3DE0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1005a2a6337c0f1372c3a52e78ee76cf0bb4e12bf6c7f2a5d41a881c926ad86b
Instruction ID: 26f4e560eacb333f1e10b5261e64bd53376f788322f5c267518f6b3df427e668
Opcode Fuzzy Hash: 1005a2a6337c0f1372c3a52e78ee76cf0bb4e12bf6c7f2a5d41a881c926ad86b
Instruction Fuzzy Hash: D331F2317057518FC72AB778A8505AE77EADFCA62030548AAE04ACF781CE35EC47C7A5

Function 06AB5579 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4c4810a9c46cfca0303be4617b271a6253d9cfe3d0c439abbe2305493f2525a
Instruction ID: c818d20f329d3a1cfcb919e66d5c1fc3ce93b34538059ab9a8b49204f73f6738
Opcode Fuzzy Hash: e4c4810a9c46cfca0303be4617b271a6253d9cfe3d0c439abbe2305493f2525a
Instruction Fuzzy Hash: DA318D35B01210AFCB45DF34D8949AEBBB6BF89610B058569E905CF352DB71ED05CBA0

Function 06AB84C8 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f91e3ebe025293e1351abcb9867d5dbb654fc98b0a18b6e5db9eeee8f3c31e0
Instruction ID: 2001fb7ff2b7d61d81fc659a57caf2a72c5887ad057ad2310a1dbfe38ca1e52f
Opcode Fuzzy Hash: 8f91e3ebe025293e1351abcb9867d5dbb654fc98b0a18b6e5db9eeee8f3c31e0
Instruction Fuzzy Hash: 4431AF35B002148FDB09EB7CA5642AE77E7EBCD210B14453AC606DB381DE38DD0687A5

Function 06AB5588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67001abb18decab323d755f245189660e29310560d094cc48b9f95b96f06d415
Instruction ID: 248b8b5194c0815311d0b0ddcf83eb4a8576b0dab8a870a062ee5825a5469f9e
Opcode Fuzzy Hash: 67001abb18decab323d755f245189660e29310560d094cc48b9f95b96f06d415
Instruction Fuzzy Hash: 24319A35B012119FDB49DF34D8849AEBBB6FF89210B018469EA06CF356DB71ED01CB90

Function 06AB87A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30054c1b6a41d045d65a98d618d3463a7e4e2ed5332fb2024988e4debc0bad83
Instruction ID: 3deec4565663f4f1951f31bb454403905f04eb1d9a6be629de1f9019514b2b9d
Opcode Fuzzy Hash: 30054c1b6a41d045d65a98d618d3463a7e4e2ed5332fb2024988e4debc0bad83
Instruction Fuzzy Hash: BC41E271D01248DFDB54DFEAD940ADEFBBAAF88310F14802AE415AB250DB35A945CF90

Function 06A92ECB Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485031236.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99eefcd642c4160dc3199a466741f6685ae829dc396ffe05145d02a25466eec3
Instruction ID: 2d3827a1881b3bad8620ae12a33927b489ba638322fb57827c6c00f32272aba1
Opcode Fuzzy Hash: 99eefcd642c4160dc3199a466741f6685ae829dc396ffe05145d02a25466eec3
Instruction Fuzzy Hash: 0A312A35E206199FCB44DFA9D4849DEB7F6FF88310B21816AE815BB310EB70A905CB60

Function 06AB8796 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83bfc2394a2f42e1dfc89238ecc710d92d1b20e24c3345c83cf95dcdc868b98a
Instruction ID: 55bd88b9d7cb265d09f1cbdbc8f87cb4f833b3dad30311ccb054e45b45983cfd
Opcode Fuzzy Hash: 83bfc2394a2f42e1dfc89238ecc710d92d1b20e24c3345c83cf95dcdc868b98a
Instruction Fuzzy Hash: D331F2B1D01248DFDB54DFAAC944BDEBFBAAF48310F14802AE415AB290DB755945CF90

Function 06AB8A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0946ce9194ac5437695d16a7cb8341047defa0fc2ae659bb45af4f9a890b0fca
Instruction ID: cb5dadf5bc8cde328014d4d3017f264f9ba39a1023a3e2e9c25cfe81f49e973e
Opcode Fuzzy Hash: 0946ce9194ac5437695d16a7cb8341047defa0fc2ae659bb45af4f9a890b0fca
Instruction Fuzzy Hash: 2331E2B1D01258DFDF54DFA9D894BDEBBB9AF48310F24842AE405A7241C778A945CB90

Function 06AB6E72 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac969bf764b08ed9cfffeb7b5151fb5edcd07936db56309a7f00709bd6eeb8f3
Instruction ID: 516981d2398a4f0583736229f536e26b454a5681f7e297f2a5c67a84b68b6671
Opcode Fuzzy Hash: ac969bf764b08ed9cfffeb7b5151fb5edcd07936db56309a7f00709bd6eeb8f3
Instruction Fuzzy Hash: 8511E63220D2D52FC7564B695C60CEB7FEDDE8A250308419BF9C6C7183C428C961D7B1

Function 0132D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1468843024.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_132d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb391e40089bff5e6a97f84a759adbe4c32c9771e14e182bfa7bbc08cbec2826
Instruction ID: 5e9fa7493c746b2dd0d36c11768b4c6e137cff4743cd4b4760e53299645c526c
Opcode Fuzzy Hash: eb391e40089bff5e6a97f84a759adbe4c32c9771e14e182bfa7bbc08cbec2826
Instruction Fuzzy Hash: 9D216771504304EFEB05EF94D9C0B66BBA5FB84328F20C16DE9091F206C736E446CBA2

Function 02E6D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1469441046.0000000002E6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2e6d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf9b27b34d7c93f78c620764a37821be85734f31f5710b1e725c71e6c1a2a6ae
Instruction ID: 2e8cd377d93687b0310dc69f656a5fffe32961c93d3f0cc9e78c43b83468c018
Opcode Fuzzy Hash: bf9b27b34d7c93f78c620764a37821be85734f31f5710b1e725c71e6c1a2a6ae
Instruction Fuzzy Hash: DD212571684344DFDB54DF10D988B26BBA6EB84318F64C56DE8094B242C336D447CA61

Function 06AB8F42 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 533cae44fcaefe99241a6c2b01d2072c881b5a5fbf5609a65803ccc4300702fb
Instruction ID: cb2b10004a5af2aeb2b0e44d847abe5a3bcc65a531de7bc2cd38781ebffd76e4
Opcode Fuzzy Hash: 533cae44fcaefe99241a6c2b01d2072c881b5a5fbf5609a65803ccc4300702fb
Instruction Fuzzy Hash: 8E211574D0425ADFCF40DFA8D5846EEBBB5FF09311F1050AAE415AB392D7385A81CB90

Function 06AB8A8C Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f769f0fcebd3eca8d1cdcf2f237f4ce22eb77bced207839bd481c18463073f0d
Instruction ID: d2006051da6893ae30433304826ef967c7606d8d0ca82f163b2895c06fb6c21b
Opcode Fuzzy Hash: f769f0fcebd3eca8d1cdcf2f237f4ce22eb77bced207839bd481c18463073f0d
Instruction Fuzzy Hash: CC2115B1D01348DFDB14DFA9C894BDEBFF9AF08710F14842AE405A7241C7749945CBA0

Function 02E6D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1469441046.0000000002E6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2e6d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b211bd9499a7c8e5b0b1a481ca705789aeadeddc278f585f98a0b4e6edb5f0
Instruction ID: ae23dc64dea4bae149998ea441182dbfcccb4dccd470a9db797dee6a10fb982f
Opcode Fuzzy Hash: d6b211bd9499a7c8e5b0b1a481ca705789aeadeddc278f585f98a0b4e6edb5f0
Instruction Fuzzy Hash: 9321A4755493C08FCB12CF20D994715BF72EF46218F28C5EAD8498F667C33A980ACB62

Function 06AB8C58 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 010e84faecef0e10c7a1947d0542a11e67b98c2959be10e9578c780217559a02
Instruction ID: fed0a5d24c0db92f120a97e9a8eba7b1d28839254ca43e8937bc230f3235db77
Opcode Fuzzy Hash: 010e84faecef0e10c7a1947d0542a11e67b98c2959be10e9578c780217559a02
Instruction Fuzzy Hash: 0E21D375E012189FCB48DFA9E8486DDBBF5BF89300F10512AE405B3350DB381945CB54

Function 0132D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1468843024.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_132d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6a0fc9ea90b81d590695a3b1a0d9a1954ef52919f9a685501d906818d82db64
Instruction ID: 38022cfc23c1d547a1875c2dca636dc01b138e454b2c349b55d4d13cf4e8ec15
Opcode Fuzzy Hash: d6a0fc9ea90b81d590695a3b1a0d9a1954ef52919f9a685501d906818d82db64
Instruction Fuzzy Hash: DE110372404280CFDB12DF44D9C4B56BF71FB84328F24C6A9D8095B617C33AE456CBA1

Function 06AB8350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a9ed82257e99a4063963fef84ba1e089e84174a7b6d1d6f4efb337da4e2e129
Instruction ID: b641e54f785b2735399748353cd64658414bdc849dd55cad46968b50a94997d3
Opcode Fuzzy Hash: 9a9ed82257e99a4063963fef84ba1e089e84174a7b6d1d6f4efb337da4e2e129
Instruction Fuzzy Hash: 9B017131B001199BDB10EAA9AC44AAFF7FEFB88651B144036E605D3240DB30AD1687A1

Function 06ABBC6B Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 194f74657b367ea669c1db0b5498b56ce15a75aa2fc680526faf2cee30a93d06
Instruction ID: bee9b1945b28fca322ca048fa6145ffc0b9f8408d93a58b51cf07bd7ccc1a6a9
Opcode Fuzzy Hash: 194f74657b367ea669c1db0b5498b56ce15a75aa2fc680526faf2cee30a93d06
Instruction Fuzzy Hash: 6801DF353502069FC684F738E4546AE37E3FFC4168314882CD3079BA40CE38BD4A8BAA

Function 06ABBC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6303467bd0b1b02a873ed30dc97c1b43b8009d52c4d8c4e62015336084bf4ea5
Instruction ID: 447018c0fe6ac4b67b2450a6f9262285ef81d2423baad3a102dde1e5c2777049
Opcode Fuzzy Hash: 6303467bd0b1b02a873ed30dc97c1b43b8009d52c4d8c4e62015336084bf4ea5
Instruction Fuzzy Hash: 9201BC3534020A5BC684F738E4546AE37E3FEC4168344882CD3078B600DE38BC4A8BAA

Function 0132DAC5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1468843024.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_132d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d042bbf7ff2d1dec59bddbac112667bb1b06da26898d732f129dae814d5db0b
Instruction ID: 16193df145d2142e23b2040b81ce6d0f4a4e2fe95b8da93526a7642cc6b7b524
Opcode Fuzzy Hash: 5d042bbf7ff2d1dec59bddbac112667bb1b06da26898d732f129dae814d5db0b
Instruction Fuzzy Hash: CA012B31108354AFF7205B55CDD4B67BBDCDF41239F18C46AED080E642C3749440CAB1

Function 06ABC4A3 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2da3a329f514f4faf958343b351945156988f2c89fd0bfbaa47adb82d89190b9
Instruction ID: 2f97a08e8c1171c1e4200bd62ec270aa04138dfd1603ff9867120ce4812b6694
Opcode Fuzzy Hash: 2da3a329f514f4faf958343b351945156988f2c89fd0bfbaa47adb82d89190b9
Instruction Fuzzy Hash: 390192352006048BD324EF65E44876E77E3FFC9325B148A28D54B87A44CF78AC0A8FA6

Function 06ABC4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1d2da6d347973d8a975597f1af00e72da078cfb0e6555d81ad2be8304d58671
Instruction ID: 4fef2837f53b77c041a694bdaa0b8a8b9f462410ce8e91f5d1d3a5123877f72a
Opcode Fuzzy Hash: e1d2da6d347973d8a975597f1af00e72da078cfb0e6555d81ad2be8304d58671
Instruction Fuzzy Hash: 64019E352007088BD324EF65D44866E77E7FFC9725B148A28D14B87A44CF78AC0A8FA6

Function 06AB5508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57217e70dff079090328e17f683371f617cb331938f739ebf2bfcf51c7089b0e
Instruction ID: 87a36c3775d967f4dfb2c9df0d42566091d9fa011036286f5bb0887ea4407669
Opcode Fuzzy Hash: 57217e70dff079090328e17f683371f617cb331938f739ebf2bfcf51c7089b0e
Instruction Fuzzy Hash: 5F01D630E01301CFD7A5AF35E4006A773FBBF84216704993CD0038A906DA71E480CF94

Function 06AB67C8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 001a86884ee969add72febf99aac04269f4485241cf93d6d07e1512daff37f27
Instruction ID: c290e347bae212711509194ec3220b364ee6e561b58e0fdd2592b0eb75d8eae2
Opcode Fuzzy Hash: 001a86884ee969add72febf99aac04269f4485241cf93d6d07e1512daff37f27
Instruction Fuzzy Hash: CEF02B317443006FC7209BA8AC40FD67FDA9B82B20F049125F210CF1E2D7B1E8458790

Function 06AB8F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73f14f07fe7ad4138bf4c201c7cd3c380d4b64c04550871606988b0573a8ce04
Instruction ID: f098a2ee96d54c7f4648cf1f403500aca164e08bd4ebd680fc61965cd0fdb7ce
Opcode Fuzzy Hash: 73f14f07fe7ad4138bf4c201c7cd3c380d4b64c04550871606988b0573a8ce04
Instruction Fuzzy Hash: 970104B4D04209DFCB44DFA9D5446EEBBF9BF48300F1090AAD414A3341E7380A40CF91

Function 0132DAC4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1468843024.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_132d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ee60db07b9b44bc0ce2e959fd60ac75103f0df6bb6f3a103fe625c8b64b42d
Instruction ID: 15085036955913ce47b97a7183bf51396bbadc4a19486482f45d9d89fe082c1e
Opcode Fuzzy Hash: 37ee60db07b9b44bc0ce2e959fd60ac75103f0df6bb6f3a103fe625c8b64b42d
Instruction Fuzzy Hash: 9FF06272408354AEE7218E1ADDC4B62FFD8EF41639F28C55AED485B686C3789844CAB1

Function 06AB3EC8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60eadc5960fb3cd0af89064b663dcff10b8bbe104e4c694929ce7392f0c00147
Instruction ID: cf9d04512bbb71e4cf573d707a942353b432b47f5f0d8cb8bda42a3c2d598008
Opcode Fuzzy Hash: 60eadc5960fb3cd0af89064b663dcff10b8bbe104e4c694929ce7392f0c00147
Instruction Fuzzy Hash: 44F090303002155BDA1AF769F450AAE73EBEBC96203108929D00A9B740EF74ED4687A9

Function 06AB6EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b43561884e565f37b10378753587b17a6c4376f04d23e07de70db000e7404c1
Instruction ID: dda6e3eb6be17967ba2038b98dfe2d9a9235efc9a64616fd2f283e51e904e05a
Opcode Fuzzy Hash: 2b43561884e565f37b10378753587b17a6c4376f04d23e07de70db000e7404c1
Instruction Fuzzy Hash: F2F037722041E83F8B555E9A5C10CFB7FEDDA8E1617084156FFD9D2241C42DC921ABB0

Function 06ABB365 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b9eeaa6d96b172e40cf4027f74a8d6fe8f98fedb646ad66ed8da99060a9e34e
Instruction ID: 3f639b26bcdcd85bd515ec39a5848a6305e75712fb1134873b33aea7026957ae
Opcode Fuzzy Hash: 4b9eeaa6d96b172e40cf4027f74a8d6fe8f98fedb646ad66ed8da99060a9e34e
Instruction Fuzzy Hash: F5011D78901219EFCB04EFB8E4546EC7BF2FB84214B1445A9D846E7710DB345E84CB55

Function 06AB8341 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d9d6fd658aa4936ef043bcaff8fc37c599ac41f22e690623e90ab0fc0e4f15a
Instruction ID: c88a46918a3f4c83c1a382316a32a1b6d217801785fe8171d79475c029595da1
Opcode Fuzzy Hash: 2d9d6fd658aa4936ef043bcaff8fc37c599ac41f22e690623e90ab0fc0e4f15a
Instruction Fuzzy Hash: 10F0A772F001158B9B10AAACAC486FEBBAEAB882507090037D614D7100F734881A83B0

Function 06AB8FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b7fd379afd9e458c0a2fd75e09a667ab67be84d18cc171ed1c9e895bf4f9de
Instruction ID: c8cbd8e7e072d722396a0ce190c8ff7e1c74f67718b51b358a903e26f00a933e
Opcode Fuzzy Hash: e7b7fd379afd9e458c0a2fd75e09a667ab67be84d18cc171ed1c9e895bf4f9de
Instruction Fuzzy Hash: F5F0A9B5C08149DFDB40DBB4C8051EEBFB8EF1A201F0051DAE406E7352E6394A41DB51

Function 06ABACB8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50302e0f684af2112cd03071265f80d73e35b99a1a82c57a3de0505c98c18398
Instruction ID: 7fd843f31610bb21e8aafe90303d439caa64890f3341fd879feb82db1b6a4d1d
Opcode Fuzzy Hash: 50302e0f684af2112cd03071265f80d73e35b99a1a82c57a3de0505c98c18398
Instruction Fuzzy Hash: F9F0E2B27091B05FD756276868240AD3BB6E9C766130840DFD287CB262CA288907C7B5

Function 06ABB368 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e535f094b0ed1cb7f427629435d61717bfb7ec94d514b88a54b727c2fc6a97
Instruction ID: 20be62386e4a973833592c8456e932d34f090873de4804a2095c796c13a817ea
Opcode Fuzzy Hash: 76e535f094b0ed1cb7f427629435d61717bfb7ec94d514b88a54b727c2fc6a97
Instruction Fuzzy Hash: 58F03C78A01209EFCB04EFB8E4546AC7BF2FB84214F1485A9D846E7710DB345E84CB55

Function 06ABADF1 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5be64b8c9be7109453f85ab63dca8d49e1a12db41f1905d18c87a6bac523dc1
Instruction ID: 1850e037ac7e60cef12bb31d1df3c8995183e6667c96a63fba199d6586f461f8
Opcode Fuzzy Hash: f5be64b8c9be7109453f85ab63dca8d49e1a12db41f1905d18c87a6bac523dc1
Instruction Fuzzy Hash: 0BE02272300011AFC7106B69A958AEF7BDBEBCE361B00443CE20FD3240CA28180587B4

Function 06ABC11B Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f1d4328382c67c343a994c692a8371ba52d8c02de85be0e4f8d13114a60dc9a
Instruction ID: 9958e0a8e3d6ff1a5efc81f4a13b7a6ec44ecdbb90425ef3cd26f786acbf783d
Opcode Fuzzy Hash: 7f1d4328382c67c343a994c692a8371ba52d8c02de85be0e4f8d13114a60dc9a
Instruction Fuzzy Hash: 5AF0A7302047649FC311EB69E4047EF7FEADF85664F08051EE186C7A41DBA5AC458BA6

Function 06ABC17B Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 828f41077a484ff310877c45883b1453c4176bc40ce8f09549405c0e98e232d9
Instruction ID: 5f09a0915633d5c21fe0e2f2c579e186fd38a75f6975d9d24383676726c491e0
Opcode Fuzzy Hash: 828f41077a484ff310877c45883b1453c4176bc40ce8f09549405c0e98e232d9
Instruction Fuzzy Hash: A8F06279901701CFD725DF26D508666BBF7FB88301700861EE48B82A10DB34A549CF84

Function 06ABADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af697d4f410b9070e73ce7e672ff89336d0b50ce2f15753b2afa9b71279077bc
Instruction ID: c27f1d71bcac02c615c6dd07e224a52575cda1cab8283ec1a3a917c8a9362ede
Opcode Fuzzy Hash: af697d4f410b9070e73ce7e672ff89336d0b50ce2f15753b2afa9b71279077bc
Instruction Fuzzy Hash: B7E092713041116BC7106B6AA448AAE7BDEEBCE665B10443CE20FD3241CA69580587B9

Function 06AB5698 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7446f22745e2e1ae55a779bdd960fc6ef6f5817fed4c4a1a49d11e508d52f506
Instruction ID: 5519f891a3f9419c304960394e8750695fda57d633dbac08a238419018005a6e
Opcode Fuzzy Hash: 7446f22745e2e1ae55a779bdd960fc6ef6f5817fed4c4a1a49d11e508d52f506
Instruction Fuzzy Hash: 0FE06DB250D310AFC345DB24AC04897BBADEB91220B06886EE484CB181E671D840CBA5

Function 06ABC180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a85596c3e09579f045beb3dbc5546a9f29e4176a492b8f5977d325df59183021
Instruction ID: 5012275859d3bb3d02122ea1e15ee9e185d734669b23bc7a4c8ef1fe4697abc8
Opcode Fuzzy Hash: a85596c3e09579f045beb3dbc5546a9f29e4176a492b8f5977d325df59183021
Instruction Fuzzy Hash: 95F09078900B01CFD715DF26E408662BBFAFF88310700C62EE48A83A10DB74A589CF84

Function 06ABB500 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7d023e4098d277309505232d58c1ef32dc55c950c7030ed91b9b5c0bb6cf3dc
Instruction ID: 062edadf890e61217e20b0506709abb78aad3028e170005a221fde6f56900272
Opcode Fuzzy Hash: f7d023e4098d277309505232d58c1ef32dc55c950c7030ed91b9b5c0bb6cf3dc
Instruction Fuzzy Hash: BDF03935D0120DEFCB01DFB4D9589DDBFB9EB48200F1442A6D885E3254EB309B89CB80

Function 06ABC120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4024bcb09e1eea1c5eedd61b9ed8aed28c63ddd915fdaa8c17faf77c0f1a08d8
Instruction ID: f64c9cda3ee492aeb9e6f4f24f313181aade1d8e2bc8594a0749c4f2598cee63
Opcode Fuzzy Hash: 4024bcb09e1eea1c5eedd61b9ed8aed28c63ddd915fdaa8c17faf77c0f1a08d8
Instruction Fuzzy Hash: D0E065302007559FC711E769E4087AE7BEADF85624F08052DD287C7A41DBA6AC458BA6

Function 06ABE280 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91cb793b06638e10c3f4d56f2889bc25035ecf196f5960e91775311995a8e467
Instruction ID: 4bca50b4ff54661f892fd8cc7b85fbac2a82cc5a0073a804348f91851d6e07e1
Opcode Fuzzy Hash: 91cb793b06638e10c3f4d56f2889bc25035ecf196f5960e91775311995a8e467
Instruction Fuzzy Hash: 1FE026392016415FD749B721BD116863BA2E7CA210F1240A2D40A8BBE1C63C4EC787E3

Function 06ABE1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2956572c98f29daadfb2b4bc27bf13a07b4c4cfe895b1218b740ea255bf3677f
Instruction ID: 102403eb05fe73313dd05868090d35506cfaccc5166acf3d8cf388ad2517bb2f
Opcode Fuzzy Hash: 2956572c98f29daadfb2b4bc27bf13a07b4c4cfe895b1218b740ea255bf3677f
Instruction Fuzzy Hash: 5AE04871A09259FFCB01DB64A84059D77B1DA8621472046D6D809D7291D6744F158761

Function 06ABAC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da06aa1ab7456d9dae45ce341202acd19acc4aee7a63b82aa632166bbcc928dd
Instruction ID: bb3c440f2eccd0740aa78b5f4aed5366f1e7a8eddeca57b933afe9591489f0bc
Opcode Fuzzy Hash: da06aa1ab7456d9dae45ce341202acd19acc4aee7a63b82aa632166bbcc928dd
Instruction Fuzzy Hash: CBD05B71300139578A453769B4584AE77ABEBC7671304442DE607C3240CE655D0287F9

Function 06ABB510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c386f417474a305a13667e7c2cb9ada0d3e64b3eedc2b6b19f24ea4f301ce241
Instruction ID: d92f40a45c4e98daafaa75e5decdedadfc9fe88b24cae065cfd2e91ffdc24c1f
Opcode Fuzzy Hash: c386f417474a305a13667e7c2cb9ada0d3e64b3eedc2b6b19f24ea4f301ce241
Instruction Fuzzy Hash: 2AE09279D0020CEFCB40DFE4E9459DDBBB9EB48200F1482AAD909E3200EB306B55DF80

Function 06ABCC43 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c258959ea6f9ef73718c4069f4da90d4273abd65bed8b4ff253c1afc157a8acd
Instruction ID: be62f0e27def7d60fa0286ca801c330b1b4e98f02c1fc88155f59ae06e914782
Opcode Fuzzy Hash: c258959ea6f9ef73718c4069f4da90d4273abd65bed8b4ff253c1afc157a8acd
Instruction Fuzzy Hash: 54D012392015659BC651EA16F401AD93395E7C5225F208124D00E97B80CA385CC78BE6

Function 06ABCE93 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14dd13f2e5d176409542a17cb51012b049cacdafad76e3d3e6a7581560b32380
Instruction ID: 2edacce3ed5cb5ffe2c1ea64fbc2c119f91a3d46af9411a177f07fe8abce1c88
Opcode Fuzzy Hash: 14dd13f2e5d176409542a17cb51012b049cacdafad76e3d3e6a7581560b32380
Instruction Fuzzy Hash: E3E01278101265DBD650FB15F544ACA37A5EBC5228B204524DC4A97B80C7389C878B95

Function 06ABE210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0361baabfb2e8d61b151df20e2b8ac818107eeabfb4dd8123895e6af01d55d4
Instruction ID: 8c89ea722efba135484d95f71b85af185c3998edc672eeda13e222aada0f635b
Opcode Fuzzy Hash: a0361baabfb2e8d61b151df20e2b8ac818107eeabfb4dd8123895e6af01d55d4
Instruction Fuzzy Hash: 00D05EB1A0120CFFCB40EFA9E94099DB7F9EB84214B2085A9D50DE3300EA316F009BA5

Function 06ABF8E0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f262060e76b7427880a01d6581fa933e7110083d09a6a8fbc4655f99b436c03f
Instruction ID: 11f8326cb52f7d3b7882d2a88c6c334f279ef91c549f8e0afd71e504dad41ef5
Opcode Fuzzy Hash: f262060e76b7427880a01d6581fa933e7110083d09a6a8fbc4655f99b436c03f
Instruction Fuzzy Hash: 04D0225BB4402007C306729C702023C6AC3E3D81C7BC2412ED607C7388CC264C220381

Function 06AB3721 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e88d66e8973bdafe8873781e15630a67b506cb9766ea3c69ae8e65a839ce6d41
Instruction ID: c7927f7e00149018e5a5c2c770055434761f47006ccf8819604c60fab7f85a69
Opcode Fuzzy Hash: e88d66e8973bdafe8873781e15630a67b506cb9766ea3c69ae8e65a839ce6d41
Instruction Fuzzy Hash: CFC0123100A3803FC70206202C01EE73E265B92B00B060282B2859B49282A2166892B2

Function 06ABE8FF Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d36f17fd7fa6a840becd3b9a84ff69c85cac95a788e14cd928148a7d764544a9
Instruction ID: ee4be670ae167bba4c0f301e616e6d87d5a45ff5996e51e49b8dcd1474b2f83d
Opcode Fuzzy Hash: d36f17fd7fa6a840becd3b9a84ff69c85cac95a788e14cd928148a7d764544a9
Instruction Fuzzy Hash: F2D0C939254104EFC741EF50D6548643B66BF99210744448EF5894F671C632D925DB00

Function 06ABE908 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf81d6e8626c98955923d90005f7ec899d15137b314f5ea82be49f64a0b67b62
Instruction ID: 9fe68578960da7fa5beda8faa40f395ae2f4455b935a7dd9edeae13dbd261aa1
Opcode Fuzzy Hash: bf81d6e8626c98955923d90005f7ec899d15137b314f5ea82be49f64a0b67b62
Instruction Fuzzy Hash: 3AC00236260208EFCB41EF99D844C557BB9BF59B147509099FA454F631C732E921EB50

Function 06ABDFD1 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b0b4e6e5bfbf8e60625d4089aaa17128fea72ff402e09e6a469819cb27ad8fe
Instruction ID: b348f83d54839a27632c695de785a35f9d0b122575e2f9d5f6c3dc44bbcb4597
Opcode Fuzzy Hash: 8b0b4e6e5bfbf8e60625d4089aaa17128fea72ff402e09e6a469819cb27ad8fe
Instruction Fuzzy Hash: 15C04C3554B2E08AEB12AB60C81D5447F31AF9661576501CAA6858B076D6254419C751

Non-executed Functions

Function 06AB6FE8 Relevance: .8, Instructions: 787COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc57570608525279deaf474e5d1b0c664b24cc3cfe4f68b7ce3d8c2ac96e99e8
Instruction ID: fee6a7ec36521135c7b14c5431080b4603cf4d27c8bec441a3b128f05cfe3c1b
Opcode Fuzzy Hash: cc57570608525279deaf474e5d1b0c664b24cc3cfe4f68b7ce3d8c2ac96e99e8
Instruction Fuzzy Hash: 036222B06002019FE749EF19D45475ABBD6EF88308F24C55CC10A9F396DBBAD90B8F99

Function 06AB6FF8 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1485055432.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15e612c7975de73dabd1cc308f7125071abcb091bc19debc1c4c0e5bfc5249f5
Instruction ID: b4fa2be02416cb365fa75142d2efcd68d500cab5cc013d40dea22c2299b72736
Opcode Fuzzy Hash: 15e612c7975de73dabd1cc308f7125071abcb091bc19debc1c4c0e5bfc5249f5
Instruction Fuzzy Hash: 616222B06002019FE749EF19D45475ABBD6EF88308F24C45CC10A9F396DBBAD90B8F99

Function 05700040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1483532186.0000000005700000.00000040.00000800.00020000.00000000.sdmp, Offset: 05700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5700000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c2670758ea90c216842151e27676bfd57b2ce7bc0386711e66c38116ff6098
Instruction ID: f99e1b5f892a66f04026f5ec941a66637c2602c7d6f4deea81e11d7aafeb8e96
Opcode Fuzzy Hash: 11c2670758ea90c216842151e27676bfd57b2ce7bc0386711e66c38116ff6098
Instruction Fuzzy Hash: D71270B04127458FE320EF69ED4D2897BB1BBC6728F904209D2656F2E9DBBC154ACF44

Function 02F3DC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1469751574.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9efa5c0dc907ebaa1c8ac0d35143698f8444a10ae467d30d303835d884a7260
Instruction ID: 0d51e28dadcd6c5491ec0088d78873580ad0f4870b978b2a42221d34a3517279
Opcode Fuzzy Hash: e9efa5c0dc907ebaa1c8ac0d35143698f8444a10ae467d30d303835d884a7260
Instruction Fuzzy Hash: 6DA16C32E00209CFCF06DFB5C98059EB7B2FF84350B15456AEA06AB265DB75E955CF80

Function 05700007 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1483532186.0000000005700000.00000040.00000800.00020000.00000000.sdmp, Offset: 05700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5700000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc1df0e98bd7884df388df649e0446700dde9df0290666fbff6e40daeb2c1b3e
Instruction ID: 15be0115fd94e712bb2f64b3ccc812324b39479ac9c6ee3ca3519e85b1ab679f
Opcode Fuzzy Hash: cc1df0e98bd7884df388df649e0446700dde9df0290666fbff6e40daeb2c1b3e
Instruction Fuzzy Hash: 2CC1F4B08127458FD720EF68EC4928A7BB1FBC6728F554209D1616F2E9DBBC148ACF44

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

C:\Users\user\AppData\Local\Temp\Tmp23FB.tmp

C:\Users\user\AppData\Local\Temp\Tmp240B.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
file.exe

Function 03372129 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 03120AD7 Relevance: 1.8, APIs: 1, Instructions: 262
COMMON

Function 031204B0 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Function 06AB0040 Relevance: 9.3, Strings: 5, Instructions: 3078
COMMON

Function 06A90597 Relevance: 1.7, Strings: 1, Instructions: 462
COMMON

Function 02F3AE30 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Function 05700AA8 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 05701CE4 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 05700BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 02F34248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 02F35935 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Function 02F3C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 02F3D2F9 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 02F3B2A0 Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON