Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1505083
MD5:	e600b6015b0312b52214f459fcc6f3c2
SHA1:	0e763e33524e467b46d27e5f0603cd2165c47fed
SHA256:	65bb6281d63ad091f8b6b4d0c460d9d6c1631fe141fe15b23dc6d23a41e094ad
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 1360 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E600B6015B0312B52214F459FCC6F3C2)

conhost.exe (PID: 5596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 1964 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "147.45.47.36:30035", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2171722834.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2006781657.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: file.exe PID: 1360	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 1964	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 1964	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.3af5570.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.3af5570.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-05T18:38:55.239834+0200	2043234	1	A Network Trojan was detected	147.45.47.36	30035	192.168.2.5	49704	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-05T18:38:55.047106+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:00.287156+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:00.916736+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:01.199601+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:01.492078+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:01.685615+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:02.495326+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:02.704807+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:02.904579+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:03.117574+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:03.349446+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:03.668603+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:03.673695+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:04.498787+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:04.696185+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:04.892361+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:05.157040+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:05.392443+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:05.628938+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:05.969776+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:05.991356+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:06.867533+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:07.172858+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:07.782260+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:08.169907+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:08.383022+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:08.871682+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-05T18:39:00.792876+0200	2046056	1	A Network Trojan was detected	147.45.47.36	30035	192.168.2.5	49704	TCP
2024-09-05T18:39:00.792961+0200	2046056	1	A Network Trojan was detected	147.45.47.36	30035	192.168.2.5	49704	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-05T18:38:55.047106+0200	2046045	1	A Network Trojan was detected	192.168.2.5	49704	147.45.47.36	30035	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.2006781657.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "147.45.47.36:30035", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: AVP.pdb source: file.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.5:49704 -> 147.45.47.36:30035
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.5:49704 -> 147.45.47.36:30035
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 147.45.47.36:30035 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 147.45.47.36:30035 -> 192.168.2.5:49704

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 147.45.47.36:30035

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 147.45.47.36:30035

Source: Joe Sandbox View

IP Address: 147.45.47.36 147.45.47.36

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: unknown

DNS traffic detected: query: 56.126.166.20.in-addr.arpa replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.36

Source: global traffic

DNS traffic detected: DNS query: 56.126.166.20.in-addr.arpa

Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000033A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000031B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16V
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000033A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000033A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000034FC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2176637606.000000000410B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2173973312.00000000035F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2006781657.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2171722834.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000034FC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2176637606.000000000410B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2173973312.00000000035F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000034FC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2176637606.000000000410B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2173973312.00000000035F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000034FC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2176637606.000000000410B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2173973312.00000000035F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000034FC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2176637606.000000000410B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2173973312.00000000035F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000034FC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2176637606.000000000410B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000035F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000034FC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2176637606.000000000410B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2173973312.00000000035F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000034FC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2176637606.000000000410B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2173973312.00000000035F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RegAsm.exe, 00000002.00000002.2173973312.00000000034FC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2176637606.000000000410B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2173973312.00000000035F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp911D.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp914D.tmp			Jump to dropped file

System Summary

.NET source code contains very large array initializations

Source: file.exe, Hdjgt4QD24ZrUGf4jK.cs

Large array initialization: Hdjgt4QD24ZrUGf4jK: array initializer size 311296

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0302DC74	2_2_0302DC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_055A6948	2_2_055A6948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_055A7C20	2_2_055A7C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_055A0040	2_2_055A0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_055A0006	2_2_055A0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_055A7C10	2_2_055A7C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_069F67D8	2_2_069F67D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_069FA3E8	2_2_069FA3E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_069F3F50	2_2_069F3F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_069FA3D8	2_2_069FA3D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_069F6FF8	2_2_069F6FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_069F6FE8	2_2_069F6FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_07BFDEB8	2_2_07BFDEB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_07BFFCD8	2_2_07BFFCD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_07BF6C20	2_2_07BF6C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_07BFAA28	2_2_07BFAA28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_07BF19E8	2_2_07BF19E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_07BF08A0	2_2_07BF08A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_07BFE7D8	2_2_07BFE7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_07BFE7C9	2_2_07BFE7C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_07BFA6F8	2_2_07BFA6F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_07BFFCD5	2_2_07BFFCD5

Source: file.exe, 00000000.00000002.2003923944.0000000000D6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000000.2000959814.0000000000714000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVQP.exe\ vs file.exe
Source: file.exe, 00000000.00000002.2006781657.0000000003B38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePennants.exe8 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameVQP.exe\ vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/6@1/1

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5596:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\Tmp911D.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.2.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: AVP.pdb source: file.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_055AC9C0 push es; ret	2_2_055AC9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_055AD871 push es; ret	2_2_055AD880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_069FDFD1 push es; ret	2_2_069FDFE6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_069FECF2 push eax; ret	2_2_069FED01

Source: file.exe

Static PE information: section name: .text entropy: 7.978591296339034

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2AF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 30D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2F40000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 596			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 2920			Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 2460	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2508	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5304	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2173973312.0000000003426000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655LR]q4aB
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: RegAsm.exe, 00000002.00000002.2182552833.0000000005A0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll5
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: RegAsm.exe, 00000002.00000002.2176637606.0000000004540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_02AF5249 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_02AF5249

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: E9D008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000002.2003923944.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: file.exe, 00000000.00000002.2003923944.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AVP.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.3af5570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3af5570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2171722834.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2006781657.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1964, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1964, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.3af5570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3af5570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2171722834.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2006781657.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1964, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Install Root Certificate	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	0%	Avira URL Cloud	safe
147.45.47.36:30035	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
https://api.ip.sb/ip	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
https://www.ecosia.org/newtab/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17ResponseD	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
56.126.166.20.in-addr.arpa	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
147.45.47.36:30035	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	RegAsm.exe, 00000002.00000002.2173973312.00000000034FC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2176637606.000000000410B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	RegAsm.exe, 00000002.00000002.2173973312.00000000034FC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2176637606.000000000410B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2173973312.00000000035F5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14ResponseD	RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	RegAsm.exe, 00000002.00000002.2173973312.00000000033A0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21Response	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id4	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19Response	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13ResponseD	RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15Response	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6Response	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	file.exe, 00000000.00000002.2006781657.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2171722834.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9Response	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegAsm.exe, 00000002.00000002.2173973312.00000000034FC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2176637606.000000000410B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2173973312.00000000035F5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24Response	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	RegAsm.exe, 00000002.00000002.2173973312.00000000034FC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2176637606.000000000410B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2173973312.00000000035F5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1Response	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21ResponseD	RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15ResponseD	RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11ResponseD	RegAsm.exe, 00000002.00000002.2173973312.00000000033A0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	RegAsm.exe, 00000002.00000002.2173973312.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	RegAsm.exe, 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17ResponseD	RegAsm.exe, 00000002.00000002.2173973312.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.45.47.36	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1505083
Start date and time:	2024-09-05 18:38:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/6@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 109 Number of non-executed functions: 19
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:39:05	API Interceptor	20x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
147.45.47.36	file.exe	Get hash	malicious	RedLine	Browse
	FileApp.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Stealc, Vidar, Xmrig, zgRAT	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	bj6NsBOOyE.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.68.138
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.68.138
	SecuriteInfo.com.Win32.PWSX-gen.13539.31213.exe	Get hash	malicious	Stealc	Browse	147.45.41.134
	Kpmg.exe	Get hash	malicious	LummaC	Browse	147.45.44.131
	file.exe	Get hash	malicious	RedLine	Browse	147.45.47.36
	FileApp.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Stealc, Vidar, Xmrig, zgRAT	Browse	147.45.47.36
	file.exe	Get hash	malicious	RedLine	Browse	147.45.47.36
	file.exe	Get hash	malicious	Stealc	Browse	147.45.47.137
	Selenium.exe	Get hash	malicious	LummaC	Browse	147.45.44.131
	Kpmg.exe	Get hash	malicious	LummaC	Browse	147.45.44.131

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 13:16:53 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.451582224594359
Encrypted:	false
SSDEEP:	48:8SOl2dfTXd3RYrnvPdAKRkdAGdAKRFdAKRE:8SOlOw
MD5:	542B88DC1A6B3BCA4638598B553C6A8C
SHA1:	C1F4F690430EFFF6101423881348826CCE765C07
SHA-256:	CECFFC30D255EF46A4C91745482124E4760439871D69EA8625A691D67D84B241
SHA-512:	0207F218F3843A8ACFE579D1A887A9DED27FAC16CC2981639259E93DA61422F4EA6ED81062ACB0F1453235245E706A80E4F3ED8B1376AA3D32522BC96030A387
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,.....&.l.......q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDW.r....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWUl....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWUl....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWUl..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDW.r..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Temp\Tmp911D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp914D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.964230381568243
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	331'776 bytes
MD5:	e600b6015b0312b52214f459fcc6f3c2
SHA1:	0e763e33524e467b46d27e5f0603cd2165c47fed
SHA256:	65bb6281d63ad091f8b6b4d0c460d9d6c1631fe141fe15b23dc6d23a41e094ad
SHA512:	b1c1a68128c2cd75df9cb1d890358fd6bb85d9a62288468a19db3295cc25e6cb97c05fa0b5bc3b1dd2b88bd39b343ce5cd1494ca8ab56352c1e375e88fe7e464
SSDEEP:	6144:sPP5QJyXEJZq77hQ8ed1oBj32nQumiUdfg+CYnDNMhXYGenCnaW1qMJyky:cGJyX2EdQ8ed1K+Yfg+DDGYn4aW1TJyD
TLSH:	2264121AF363263ACE1A5BF594540D00C3BEEB3C7E135ADBFD9806599F95A060742B32
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f............................."... ...@....@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4522de
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D9DCC4 [Thu Sep 5 16:31:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x52290	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x54000	0x614	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x56000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x5224c	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x502e4	0x50400	4a87c615584d5bfa88120685b104945c	False	0.9756528670171339	data	7.978591296339034	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x54000	0x614	0x800	fe5ecc4b2e3bbff42730cbe7a097d641	False	0.34375	data	3.4504417414588056	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x56000	0xc	0x200	d5b902e1e7907226d81bfea7588cdad1	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x540a0	0x388	data			0.44026548672566373
RT_MANIFEST	0x54428	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-05T18:38:55.047106+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:38:55.047106+0200	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:38:55.239834+0200	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	147.45.47.36	30035	192.168.2.5	49704	TCP
2024-09-05T18:39:00.287156+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:00.792876+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	147.45.47.36	30035	192.168.2.5	49704	TCP
2024-09-05T18:39:00.792961+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	147.45.47.36	30035	192.168.2.5	49704	TCP
2024-09-05T18:39:00.916736+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:01.199601+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:01.492078+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:01.685615+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:02.495326+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:02.704807+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:02.904579+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:03.117574+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:03.349446+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:03.668603+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:03.673695+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:04.498787+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:04.696185+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:04.892361+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:05.157040+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:05.392443+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:05.628938+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:05.969776+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:05.991356+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:06.867533+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:07.172858+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:07.782260+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:08.169907+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:08.383022+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP
2024-09-05T18:39:08.871682+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49704	147.45.47.36	30035	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 5, 2024 18:38:54.354057074 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:38:54.358877897 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:38:54.358967066 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:38:54.368570089 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:38:54.373446941 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:38:55.013776064 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:38:55.047106028 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:38:55.052767038 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:38:55.239834070 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:38:55.282254934 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:00.287156105 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:00.294567108 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:00.792699099 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:00.792717934 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:00.792728901 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:00.792733908 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:00.792740107 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:00.792807102 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:00.792876005 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:00.792926073 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:00.792960882 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:00.793004036 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:00.916735888 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:00.921627045 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.108812094 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.157241106 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:01.199600935 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:01.204547882 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.204574108 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.204586983 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.204611063 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.204622030 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.204632998 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:01.204683065 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:01.204689026 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.204709053 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.204719067 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.204726934 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.209155083 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.209506035 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.209521055 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.209527969 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.209583998 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.209595919 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.209650993 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.209660053 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.487214088 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.492078066 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:01.496948957 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.682909966 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.685615063 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:01.690421104 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.878061056 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:01.922883034 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:02.495326042 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:02.500232935 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:02.687287092 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:02.704807043 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:02.709788084 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:02.896091938 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:02.904578924 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:02.909523010 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.095733881 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.117573977 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.122697115 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.308881998 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.349446058 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.354429960 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.540643930 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.594738007 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.668602943 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.673626900 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.673641920 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.673650980 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.673655033 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.673660040 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.673695087 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.673722029 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.673727989 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.673732996 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.673743963 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.673753977 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.673774004 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.673785925 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.673815012 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.673835039 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.673883915 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.678232908 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.678241968 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.678255081 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.678263903 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.678287983 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.678313017 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.678332090 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.678342104 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.678354979 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.678386927 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.678412914 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.678447962 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.678466082 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.678498030 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.678522110 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.678523064 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.678565979 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.678577900 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.678607941 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.678613901 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.678668022 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.678756952 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.678805113 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.678960085 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.679003000 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.683693886 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.683753014 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.683762074 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.683768988 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.683886051 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.684045076 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.684093952 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.684106112 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.684114933 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.684123039 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.684133053 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.684140921 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.684149027 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.684150934 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.684160948 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.684170961 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.684180021 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.684180021 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.684190989 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.684212923 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.684226990 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.684252977 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.687840939 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.687850952 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.687858105 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.687860966 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.687903881 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.687903881 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.687916040 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.687921047 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.687927008 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.687937021 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.687947035 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.687958956 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.687980890 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.687999010 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.689022064 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.689888954 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.689913034 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.689932108 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.689941883 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.689958096 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.689985037 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.689995050 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690040112 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690057039 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690064907 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690073013 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690083981 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690093040 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690154076 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690164089 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690172911 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690176964 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690242052 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690251112 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690258980 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690268040 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690279007 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690290928 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690299988 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690309048 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690335035 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690342903 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690351963 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690360069 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690427065 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690438986 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690479994 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690489054 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690496922 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690507889 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690521002 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690530062 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690537930 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.690568924 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690579891 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690587997 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690598011 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690603018 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.690639973 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690650940 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690658092 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690666914 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690696955 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690706968 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690716028 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690723896 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690732002 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690819025 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690828085 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690834999 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690843105 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.690845966 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.693665028 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.693675041 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.693694115 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.693703890 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.693742990 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.693928003 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.693937063 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.695034981 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.695044041 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.695054054 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.695120096 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.695128918 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.695138931 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.695147991 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.695188046 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.695230961 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.695240974 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.695373058 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.695507050 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.695648909 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.695708036 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.697115898 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.697171926 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.697201014 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.697309971 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.697319031 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.697329044 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.697397947 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.697438955 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.697695017 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.697705030 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.697772026 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.697825909 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.698044062 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.698052883 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.698102951 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.698112011 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.698303938 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.698312998 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.698322058 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.698331118 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.698338985 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.698348045 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699346066 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699354887 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699362993 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699371099 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699379921 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699388027 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699398994 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699407101 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699417114 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699425936 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699434042 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699443102 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699450016 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699456930 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699462891 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699465990 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699475050 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699484110 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699491978 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699505091 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699512959 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699520111 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699532032 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699541092 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699552059 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699562073 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699572086 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699579954 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699589014 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699596882 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699605942 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699614048 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.699758053 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.699815989 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.703475952 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703532934 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703573942 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703583956 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703592062 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703603983 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703650951 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703660011 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703670025 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703679085 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703686953 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703695059 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703753948 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703763008 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703772068 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703778982 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703845978 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703855038 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703869104 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703877926 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703886032 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703896046 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703903913 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.703912973 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704526901 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704535961 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704539061 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704545975 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704555035 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704562902 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704571962 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704580069 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704588890 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704596996 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704606056 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704615116 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704622030 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704632044 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704639912 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704648972 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704657078 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704664946 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704673052 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704682112 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704690933 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704699039 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704709053 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704716921 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704726934 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704735994 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704745054 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704754114 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704761982 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704771042 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.704924107 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.704993963 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.707557917 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707576036 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707586050 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707618952 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707629919 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707645893 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707670927 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707681894 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707690001 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707699060 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707740068 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707747936 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707756996 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707767963 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707776070 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707787037 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707794905 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707803011 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707887888 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707896948 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707900047 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707904100 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707911968 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.707921028 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709464073 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709474087 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709481955 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709495068 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709503889 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709511995 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709522009 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709528923 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709537029 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709546089 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709553957 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709561110 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709568977 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709577084 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709589958 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709599972 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709609032 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709618092 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709625959 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709634066 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709642887 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709651947 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709660053 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709662914 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709672928 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709681988 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709691048 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709701061 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709709883 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709718943 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.709847927 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.709908962 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.712414980 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.712425947 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.712534904 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.712543964 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.712553024 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.712560892 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.712569952 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.712583065 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.712795973 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.712806940 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.712814093 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.712831974 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.712841034 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.712847948 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.712857008 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.713078976 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.713088989 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.713095903 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.713102102 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.713262081 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.713272095 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.713282108 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.713289976 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.713298082 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.713300943 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715235949 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715245962 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715249062 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715253115 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715255976 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715265036 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715274096 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715281963 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715291977 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715298891 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715307951 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715316057 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715325117 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715333939 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715342999 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715352058 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715361118 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715368986 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715377092 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715385914 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715394974 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715403080 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715410948 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715423107 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715434074 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715442896 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715456963 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715465069 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715471983 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:03.715615988 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:03.715682983 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.016861916 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.151928902 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.151987076 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.152143002 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.152260065 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.152271986 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.152407885 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.152568102 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.152576923 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.152623892 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.152848959 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.152859926 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.152908087 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.153132915 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153165102 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153184891 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.153208971 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.153299093 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153307915 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153346062 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153351068 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.153400898 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.153431892 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153441906 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153445959 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153456926 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153466940 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153496981 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.153505087 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153512955 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.153553963 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153556108 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.153565884 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153573990 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153601885 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153604984 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.153616905 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.153657913 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.153711081 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153721094 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153723955 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153732061 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153740883 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153753042 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153772116 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.153793097 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.153804064 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.153830051 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153841019 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153847933 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153881073 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.153898001 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.153985977 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.153995991 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154000044 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154042959 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154047966 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.154052973 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154062033 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154073954 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154082060 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154089928 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.154126883 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.154376030 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154386044 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154390097 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154397964 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154407978 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154417038 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154426098 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154438972 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.154443026 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154453993 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154462099 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154469967 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.154470921 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154480934 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154489994 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.154520035 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.154527903 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154539108 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.154545069 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154556036 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154575109 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154578924 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.154601097 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154609919 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154644966 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154654026 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154661894 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154745102 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154752016 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.154762983 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154772997 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154782057 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154787064 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.154814005 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.154839993 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.154845953 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154855967 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.154906034 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.154962063 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155014992 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.155056000 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155065060 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155072927 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155081034 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155091047 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155100107 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155108929 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155109882 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.155118942 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155128956 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155138016 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155143023 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.155147076 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155158043 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.155167103 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155177116 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155185938 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155194044 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.155195951 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155206919 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155211926 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.155217886 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155235052 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155237913 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.155246019 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155253887 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155262947 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155272007 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155298948 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155308008 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155316114 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155327082 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155335903 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155344009 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155354023 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155375004 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155384064 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155391932 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155402899 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155451059 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155525923 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155535936 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155539036 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155548096 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155558109 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155582905 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155669928 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.155755043 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.156996012 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.157006979 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.157052994 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.157052994 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.157223940 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.157234907 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.157238960 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.157275915 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.157388926 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.157453060 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.157461882 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.157567978 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.157766104 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.157774925 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.157778978 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.157866001 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158008099 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158052921 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158062935 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158111095 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158166885 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158222914 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158231020 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158344984 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158392906 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158402920 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158411026 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158420086 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158437967 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158447027 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158454895 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158464909 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158476114 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158484936 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158504009 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158513069 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158576965 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158586025 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158643961 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158683062 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158691883 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158721924 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158730984 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158734083 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158765078 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158823967 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158838987 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158971071 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158979893 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158983946 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158987045 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.158996105 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159007072 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159015894 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159059048 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159069061 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159118891 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159168959 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159178972 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159199953 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159328938 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159338951 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159348011 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159357071 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159365892 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159384966 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159393072 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159434080 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159442902 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159451008 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159491062 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159547091 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159555912 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159564018 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159600973 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159617901 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159626961 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159771919 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159780979 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159789085 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159797907 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159807920 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159826040 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159840107 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159849882 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159859896 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159868956 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159878016 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159894943 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159917116 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159926891 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159934998 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159954071 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.159964085 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.160001040 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.160020113 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.160029888 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.160042048 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.160077095 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.160087109 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.160115004 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.160141945 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.160151005 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.160243034 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.160265923 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.160274982 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.160279036 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.161680937 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.161730051 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.161741018 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.161750078 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.161802053 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.161812067 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.163026094 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.163072109 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.163152933 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.163163900 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.163263083 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.163271904 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.163316965 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.163326979 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.163444996 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.163455963 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.163536072 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.163587093 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.163597107 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.163630962 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.163706064 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.163752079 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.163825035 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.163834095 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.163873911 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.163961887 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.164072037 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.164081097 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.164091110 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.164098978 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.164172888 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.164239883 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.164304018 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.164356947 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.164366007 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.164500952 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.164585114 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.164632082 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.164684057 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.164694071 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.164829016 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.164876938 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.164886951 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.164948940 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.165045023 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.165054083 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.165091038 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.165153027 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.165162086 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.165170908 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.165182114 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.165190935 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.165208101 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.165250063 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.165258884 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.165291071 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.165330887 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.165342093 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.165479898 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.165534973 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.165544033 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.165550947 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.496782064 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.498786926 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.504398108 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.690922976 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.696185112 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.701524019 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.891089916 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:04.892360926 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:04.897200108 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:05.083575964 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:05.151639938 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:05.157040119 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:05.163330078 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:05.349338055 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:05.391710043 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:05.392442942 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:05.397891045 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:05.584567070 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:05.625998974 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:05.628937960 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:05.639720917 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:05.639781952 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:05.639791965 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:05.639822960 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:05.639831066 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:05.639841080 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:05.639844894 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:05.640008926 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:05.920475006 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:05.969775915 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:05.991355896 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:05.996365070 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:06.182857037 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:06.235506058 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:06.867532969 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:07.172858000 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:07.782259941 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:07.914829969 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:07.914845943 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:07.916040897 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:08.101028919 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:08.157380104 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:08.169907093 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:08.175081015 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:08.375993967 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:08.383022070 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:08.387964010 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:08.613960981 CEST	30035	49704	147.45.47.36	192.168.2.5
Sep 5, 2024 18:39:08.657258034 CEST	49704	30035	192.168.2.5	147.45.47.36
Sep 5, 2024 18:39:08.871681929 CEST	49704	30035	192.168.2.5	147.45.47.36

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 5, 2024 18:39:25.164360046 CEST	53	57525	162.159.36.2	192.168.2.5
Sep 5, 2024 18:39:25.635520935 CEST	51129	53	192.168.2.5	1.1.1.1
Sep 5, 2024 18:39:25.642875910 CEST	53	51129	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 5, 2024 18:39:25.635520935 CEST	192.168.2.5	1.1.1.1	0x943e	Standard query (0)	56.126.166.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 5, 2024 18:39:25.642875910 CEST	1.1.1.1	192.168.2.5	0x943e	Name error (3)	56.126.166.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	0
Start time:	12:38:50
Start date:	05/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x6c0000
File size:	331'776 bytes
MD5 hash:	E600B6015B0312B52214F459FCC6F3C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2006781657.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:38:51
Start date:	05/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:38:51
Start date:	05/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xcd0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.2171722834.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.2173973312.0000000003177000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	52.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	25%
Total number of Nodes:	24
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02AF5249 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02AF51BB,02AF51AB), ref: 02AF53B8
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02AF53CB
Wow64GetThreadContext.KERNEL32(00000098,00000000), ref: 02AF53E9
ReadProcessMemory.KERNELBASE(00000088,?,02AF51FF,00000004,00000000), ref: 02AF540D
VirtualAllocEx.KERNELBASE(00000088,?,?,00003000,00000040), ref: 02AF5438
WriteProcessMemory.KERNELBASE(00000088,00000000,?,?,00000000,?), ref: 02AF5490
WriteProcessMemory.KERNELBASE(00000088,00400000,?,?,00000000,?,00000028), ref: 02AF54DB
WriteProcessMemory.KERNELBASE(00000088,?,?,00000004,00000000), ref: 02AF5519
Wow64SetThreadContext.KERNEL32(00000098,02A70000), ref: 02AF5555
ResumeThread.KERNELBASE(00000098), ref: 02AF5564

Strings

SetThreadContext, xrefs: 02AF536F
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 02AF53B7
TerminateProcess, xrefs: 02AF5447
Load, xrefs: 02AF5287
GetThreadContext, xrefs: 02AF5323
WriteProcessMemory, xrefs: 02AF535C
ResumeThread, xrefs: 02AF5385
VirtualAllocEx, xrefs: 02AF5349
ress, xrefs: 02AF52D3
aryA, xrefs: 02AF528F
ReadProcessMemory, xrefs: 02AF5336
VirtualAlloc, xrefs: 02AF5310
CreateProcessA, xrefs: 02AF52FD
GetP, xrefs: 02AF52CB

Memory Dump Source

Source File: 00000000.00000002.2004525968.0000000002AF5000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AF5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af5000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: d0a7aa1fa1424cfeb9b48a611a2c2d3188f73e5932fe098687340ce4a5b3a2d0
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 75B1E57660024AAFDB60CFA8CC80BDA77A5FF88714F158124EA0CAB341D774FA41CB94

Function 028F0CA8 Relevance: 1.8, APIs: 1, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,03AF3590,?,?,?), ref: 028F1004

Memory Dump Source

Source File: 00000000.00000002.2004382209.00000000028F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28f0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: aa2a02a440d57bae6378789daff25f5b81d4278fa33c91831377cfa0bcf7b2fe
Instruction ID: 8517bdf77a46ade98c0062514e29343cc9e72476d3317e8ef7c73f381281da06
Opcode Fuzzy Hash: aa2a02a440d57bae6378789daff25f5b81d4278fa33c91831377cfa0bcf7b2fe
Instruction Fuzzy Hash: 62B1AC79A0025A8FCB01CFA8C480AEDFBF2FF48304F558569E558E7756D334A841CBA4

Function 028F04D8 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,03AF3590,?,?,?), ref: 028F1004

Memory Dump Source

Source File: 00000000.00000002.2004382209.00000000028F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28f0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a447b62cbf482f8889cdcbbc9a6cf5c65e1c80efa50ce69ffd5704310242d3d7
Instruction ID: beec2795071d21dbdd443a3d06a5c2a01aaf2bc87cec76055b300e408ceb3a79
Opcode Fuzzy Hash: a447b62cbf482f8889cdcbbc9a6cf5c65e1c80efa50ce69ffd5704310242d3d7
Instruction Fuzzy Hash: 0421E4B5901259EFCB00DF9AC984ADEFBB4FB49310F108119EA18A7250C3756554CBE1

Analysis Process: RegAsm.exePID: 1964, Parent PID: 1360COMMON

Execution Graph

Execution Coverage:	8.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	86
Total number of Limit Nodes:	8

Executed Functions

Function 07BF6C20 Relevance: 16.2, Strings: 12, Instructions: 1183COMMON

Download Yara Rule

Strings

4c]q, xrefs: 07BF759A
(_]q, xrefs: 07BF76BC
4c]q, xrefs: 07BF75B4
$]q, xrefs: 07BF7C43
(_]q, xrefs: 07BF76D6
c]q, xrefs: 07BF75EE
Haq, xrefs: 07BF79DA
,aq, xrefs: 07BF783F
Nv\q, xrefs: 07BF6F28
$]q, xrefs: 07BF72AB
c]q, xrefs: 07BF75D4
$]q, xrefs: 07BF72C5

Memory Dump Source

Source File: 00000002.00000002.2188497513.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7bf0000_RegAsm.jbxd

Similarity

API ID:
String ID: (_]q$(_]q$,aq$4c]q$4c]q$Haq$Nv\q$$]q$$]q$$]q$c]q$c]q
API String ID: 0-67377238
Opcode ID: f2a7b496d66d3e8e11b9199fcafe5f6bb7f401b1aaead1f588afc545e3ab85c0
Instruction ID: 524720a3058e0e423a7711ea9d6885c6b9fcd256e1b6d8978335b4f100890a7c
Opcode Fuzzy Hash: f2a7b496d66d3e8e11b9199fcafe5f6bb7f401b1aaead1f588afc545e3ab85c0
Instruction Fuzzy Hash: EC82EAB0B401158FCB59AFBD485062D6AE7FFCDB00F6049EAD14ADB394EE64CC458BA1

Function 07BFAA28 Relevance: 13.3, Strings: 10, Instructions: 762
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 07BFAFD6
4c]q, xrefs: 07BFAC59
$]q, xrefs: 07BFAFC7
$]q, xrefs: 07BFAE85
4|bq, xrefs: 07BFB3CD
4c]q, xrefs: 07BFAC3D
4c]q, xrefs: 07BFAC4F
$]q, xrefs: 07BFAE95
$]q, xrefs: 07BFAE38
$]q, xrefs: 07BFAC1D

Memory Dump Source

Source File: 00000002.00000002.2188497513.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7bf0000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q$4c]q$4c]q$4c]q$4|bq$$]q$$]q$$]q$$]q$$]q
API String ID: 0-4196629754
Opcode ID: f6ab508b513f46a15232abc2e0e65183ec567646eb82b3021b6f7467cfa09009
Instruction ID: fbcb7055219072ca3cc7c177c7fecb596f101beba5f2e43bfc6f07e25f7b1b3b
Opcode Fuzzy Hash: f6ab508b513f46a15232abc2e0e65183ec567646eb82b3021b6f7467cfa09009
Instruction Fuzzy Hash: 31526EB0B002198FDB18DF79C854AAEBBF6FF89700F1484A9E909DB364DA349D45CB51

Function 07BF08A0 Relevance: 6.6, Strings: 5, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 07BF0CB2
Haq, xrefs: 07BF0C50
Haq, xrefs: 07BF0C81
Haq, xrefs: 07BF0CF9
Haq, xrefs: 07BF0D40

Memory Dump Source

Source File: 00000002.00000002.2188497513.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7bf0000_RegAsm.jbxd

Similarity

API ID:
String ID: Haq$Haq$Haq$Haq$Haq
API String ID: 0-1792267638
Opcode ID: 2e11a2c64f470e11be43e514f8258ae45b2ace9fd6ecdacc71f7d929332d6ed1
Instruction ID: d891d0dbfc3143a79e8b6f6e9691a45cc849945ac51fce4aeeaf051a3e2b8554
Opcode Fuzzy Hash: 2e11a2c64f470e11be43e514f8258ae45b2ace9fd6ecdacc71f7d929332d6ed1
Instruction Fuzzy Hash: 68F1C4B1A00256CBDB15DF74C4502BDFBF2FF85300F2486A9D546AB252E7789A89CB90

Function 069F3F50 Relevance: 3.0, Strings: 2, Instructions: 531
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 069F41E4
k Pm^, xrefs: 069F4375

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID: $]q$k Pm^
API String ID: 0-722610573
Opcode ID: fae4eba88e2c4a7ed2a3d3b59e85c5ce84d6b760104d80fa7fb01f8dfb1bfed5
Instruction ID: 280e59202fb9ed2a80ae517b93700d5673eccc69f7ab9a0cc8876f83324fa719
Opcode Fuzzy Hash: fae4eba88e2c4a7ed2a3d3b59e85c5ce84d6b760104d80fa7fb01f8dfb1bfed5
Instruction Fuzzy Hash: DB127034F102158FCB54DF69C9849AEBBFABF88710B258169D506EB3A5DB71DC01CBA0

Function 07BFFCD8 Relevance: 2.7, Strings: 2, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

v, xrefs: 07BFFD58
1, xrefs: 07BFFD71

Memory Dump Source

Source File: 00000002.00000002.2188497513.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7bf0000_RegAsm.jbxd

Similarity

API ID:
String ID: 1$v
API String ID: 0-2456183578
Opcode ID: d892c10ffb3ce3c47140ad4c17901481819044ec58db7c9769b442660f6f3823
Instruction ID: 39c6bb743d857310467ced0c090bb8fd1da6d3dc591f901fac069899759c6255
Opcode Fuzzy Hash: d892c10ffb3ce3c47140ad4c17901481819044ec58db7c9769b442660f6f3823
Instruction Fuzzy Hash: 7891A574E01218CFDB58DFA9D844BADBBB2FF89700F1080AAD909AB355DB345945CF51

Function 07BFFCD5 Relevance: 2.7, Strings: 2, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

v, xrefs: 07BFFD58
1, xrefs: 07BFFD71

Memory Dump Source

Source File: 00000002.00000002.2188497513.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7bf0000_RegAsm.jbxd

Similarity

API ID:
String ID: 1$v
API String ID: 0-2456183578
Opcode ID: 7f6f03f8e3c817ac124617a76d37ab19ad1f0472881a47a5f26fb018aaea4148
Instruction ID: 79c9d064f213c372bad51efd189a288076ecb0745b1b0331a1a19030b83f6f89
Opcode Fuzzy Hash: 7f6f03f8e3c817ac124617a76d37ab19ad1f0472881a47a5f26fb018aaea4148
Instruction Fuzzy Hash: 7F91A374E01218CFDB58DFA9D844BADBBB2FF89700F1080AAD909A7355DB345946CF51

Function 07BF19E8 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2188497513.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7bf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e8252a3e4334d014416278323d5a35af92bdf73c70f9b7cf7c3a5e003ce49b3
Instruction ID: 6ae4c3138da264773eeb3ee1b014ba4e06513c2524368bcee129a9de83ec1427
Opcode Fuzzy Hash: 6e8252a3e4334d014416278323d5a35af92bdf73c70f9b7cf7c3a5e003ce49b3
Instruction Fuzzy Hash: 6A825CF4650226CFEB28CF28D558BA977B1FB44708F1081E8D9099B7A1E7389C4ADF51

Function 055A6948 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2182212393.00000000055A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4cccece5128bc9ee39357166d1c2703f2ebb03a63ad86019b976293a66e826a
Instruction ID: c122bb3490e72e9e10fcbbfc2f72a6cf084209d46160576f3bf9f7e96d34099a
Opcode Fuzzy Hash: f4cccece5128bc9ee39357166d1c2703f2ebb03a63ad86019b976293a66e826a
Instruction Fuzzy Hash: BC22F071905228CFDB65DF64C958BD9BBB2FF4A300F0084E9E509AB2A1DB359E84DF50

Function 069F67D8 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bd48f8531dbc83a0a0f9f96608779f8fa91dfc7d4d11903fce88b0eb8d494e1
Instruction ID: ac4dcf4a5ec9af46a7319e64a290977e4db7a8ca76595105c991b8a78bd2f9e7
Opcode Fuzzy Hash: 4bd48f8531dbc83a0a0f9f96608779f8fa91dfc7d4d11903fce88b0eb8d494e1
Instruction Fuzzy Hash: ABF1A130A103199FCB55DF68D840B9EBBF6EF84310F158569E605EB2A1DB34ED45CBA0

Function 07BFDEB8 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2188497513.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7bf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b69d7c3ed9ac59bf76bd433e9bc8ec22cffd1ba283721fad41e464af8d062961
Instruction ID: 5ef4bb83b81fce62f67849713f822ac95148119338d67620e74795d0b0597ccf
Opcode Fuzzy Hash: b69d7c3ed9ac59bf76bd433e9bc8ec22cffd1ba283721fad41e464af8d062961
Instruction Fuzzy Hash: 92E1B3B4E01219CFEB14DFA9C884A9DFBB2FF48310F6482A9D509A7255D734A985CF50

Function 069FA3D8 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff041ca90d07df485e1604ff0dff89d3092dc44d294645025eb3025a764bda2
Instruction ID: dbee47806c6a4d43470a33e610669a86ced0faa2c1899c061cfbacedfd877f17
Opcode Fuzzy Hash: 2ff041ca90d07df485e1604ff0dff89d3092dc44d294645025eb3025a764bda2
Instruction Fuzzy Hash: 6ED1D474901218CFCB54EFB4D854A9DBBB2FF8A301F2081A9D51AAB394DB359D86CF11

Function 069FA3E8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 131668e0338a07be32244d1c540ef96d5985deadd95ae5526e7b40881de5adc1
Instruction ID: fd3c2dc840b29963207020a37b2950d191a7deee85ab3adb332c5444198dfeac
Opcode Fuzzy Hash: 131668e0338a07be32244d1c540ef96d5985deadd95ae5526e7b40881de5adc1
Instruction Fuzzy Hash: B9D1D474D01218CFCB54EFB4D844A9DBBB2FF8A301F2081A9D51AAB294DB359D86CF11

Function 055A7C20 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2182212393.00000000055A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4de04fd26c6158845ba4402fb35defbd34a98107908c9868a143bfb74b561adf
Instruction ID: 95f84aaf9e919cdc2283309879499d0026f2d8d0d52a499241065ee98ea1fef0
Opcode Fuzzy Hash: 4de04fd26c6158845ba4402fb35defbd34a98107908c9868a143bfb74b561adf
Instruction Fuzzy Hash: D2C1A375E00219CFDB14DFAAD980A9DBBB6FF88300F1081A9D809AB355DB349D86CF51

Function 055A7C10 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2182212393.00000000055A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ac7fe4f0fe5db2e696bdeb6658734eca1a012bde26c142ca2f4f598f83404bd
Instruction ID: 2c997648b36a12ce98a9f52cdf0f1f108471de0f2f0faee38d1b398de0871d69
Opcode Fuzzy Hash: 6ac7fe4f0fe5db2e696bdeb6658734eca1a012bde26c142ca2f4f598f83404bd
Instruction Fuzzy Hash: 6151A975E00218CBDB18DFA6D944B9EBBB7BF88300F14C0A9981DAB269DB3459458F50

Function 069D0D80 Relevance: 20.6, Strings: 16, Instructions: 618
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 069D13A0
$]q, xrefs: 069D13AC
$]q, xrefs: 069D0F36
$]q, xrefs: 069D1461
$]q, xrefs: 069D0F86
$]q, xrefs: 069D137B
$]q, xrefs: 069D0E84
$]q, xrefs: 069D0FB8
$]q, xrefs: 069D0E02
$]q, xrefs: 069D1455
$]q, xrefs: 069D0E52
$]q, xrefs: 069D0FAC
$]q, xrefs: 069D0E78
$]q, xrefs: 069D13EB
$]q, xrefs: 069D1336
$]q, xrefs: 069D1430

Memory Dump Source

Source File: 00000002.00000002.2183363885.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_RegAsm.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2551331179
Opcode ID: 95c572d9489c2588cee8b2ed4bda57d1f79d393c982b45217ef909cb3a13a1ea
Instruction ID: 0fe82f047a1a694a711e011c51fd9a4dd223f6b03848723bcadeb759457bb83f
Opcode Fuzzy Hash: 95c572d9489c2588cee8b2ed4bda57d1f79d393c982b45217ef909cb3a13a1ea
Instruction Fuzzy Hash: 0132AF30B042059FDB559F69C894A7EBBE6BF89304B24C869E506C77A2CB75DC01CB51

Function 069D1582 Relevance: 7.8, Strings: 6, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 069D1A12
$]q, xrefs: 069D1A7C
$]q, xrefs: 069D18E3
$]q, xrefs: 069D1A57
$]q, xrefs: 069D1A88
$]q, xrefs: 069D182E

Memory Dump Source

Source File: 00000002.00000002.2183363885.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_RegAsm.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: bd111616ef252f537498c63a9d365d415683b1b4641e74bd468cc0aadb10cbea
Instruction ID: c5bc326772c65d7069fc20989be3d143901c30b2212bc897089e50da704d052b
Opcode Fuzzy Hash: bd111616ef252f537498c63a9d365d415683b1b4641e74bd468cc0aadb10cbea
Instruction Fuzzy Hash: 9BC1E534B042019FDB959BA8C894A7E7BEAEF85700F10897AE502CB7A2DF75DC05CB51

Function 069F48B8 Relevance: 1.8, Strings: 1, Instructions: 600COMMON

Download Yara Rule

Strings

+ Pm^, xrefs: 069F4DA7

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID: + Pm^
API String ID: 0-1772364228
Opcode ID: 0bbdaff59ef9b45211f2e599db54eaa97ccdef820287c66db0801566d98c5e79
Instruction ID: 00310e0385e0529c8638b6aef0ceab4fdc37e791fa1d94bfb5209316a80f3782
Opcode Fuzzy Hash: 0bbdaff59ef9b45211f2e599db54eaa97ccdef820287c66db0801566d98c5e79
Instruction Fuzzy Hash: 9E325034B106018FCB54DF39D584A6ABBFAFF88710B1584A9E506CB7A6DB34EC45CB90

Function 0302AE30 Relevance: 1.7, APIs: 1, Instructions: 207COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0302B086

Memory Dump Source

Source File: 00000002.00000002.2173213662.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3020000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 031ab3c6aa3b76a0a138b524c624258b62e404272d8b4e1dfb9aeb683af49890
Instruction ID: 9f7a99bc3c62f05934ac9f69300961f4ef1dfddd62cc141c7b108ea86fcc35f1
Opcode Fuzzy Hash: 031ab3c6aa3b76a0a138b524c624258b62e404272d8b4e1dfb9aeb683af49890
Instruction Fuzzy Hash: 14817AB0A01B158FDB64DF69D04079ABBF5FF88704F04896DD48AD7A50DB38E80ACB90

Function 055A0BFC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 055A4381

Memory Dump Source

Source File: 00000002.00000002.2182212393.00000000055A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55a0000_RegAsm.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: f84f3d3200740fa60eb4543051406c3c50663443fa94ab1209d6cf90fe439626
Instruction ID: b917253ef2eaa1bf86858379421fb0202d34e097d6df11c55dce101fa3e9816f
Opcode Fuzzy Hash: f84f3d3200740fa60eb4543051406c3c50663443fa94ab1209d6cf90fe439626
Instruction Fuzzy Hash: EC4105B5900305DFDB14CF99C488AAEBBF5FF88314F248959E519AB321D774A885CFA0

Function 03025935 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 030259F1

Memory Dump Source

Source File: 00000002.00000002.2173213662.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3020000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 37e6e27112002698ec332a56599df71fbeb76e779a43bc75481e7041c883f6b6
Instruction ID: 671731290dec39a24707d5f3b216f5729a20c4e1a48d1fb24e2233981676322c
Opcode Fuzzy Hash: 37e6e27112002698ec332a56599df71fbeb76e779a43bc75481e7041c883f6b6
Instruction Fuzzy Hash: 1241FFB0C00629CEDB24CFA9C884B9DFBF5FF49304F24806AD418AB254DB75694ACF91

Function 03024248 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 030259F1

Memory Dump Source

Source File: 00000002.00000002.2173213662.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3020000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d3eff93902f1aebaaea5654b76595769f48bd84c140365b5be73f4acff366460
Instruction ID: c2d44918a1499ea0fa88a8f0d03a77f327c695e02e6ae3d6ac4f9dff1106ece0
Opcode Fuzzy Hash: d3eff93902f1aebaaea5654b76595769f48bd84c140365b5be73f4acff366460
Instruction Fuzzy Hash: 0241FFB0C00629CBDB24CFA9C884B9DFBF5FF49304F24806AD408AB250DB756946CF95

Function 0302A858 Relevance: 1.6, APIs: 1, Instructions: 79libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0302B101,00000800,00000000,00000000), ref: 0302B312

Memory Dump Source

Source File: 00000002.00000002.2173213662.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3020000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5b24a44fc25a6328cb63352620b6d980ed320925d03363b87a2ba5baaf040f8e
Instruction ID: 9f9c275e5a321a77561a1d0e6440b4a9cc67f09872b8a6224d9a8b409689e5cc
Opcode Fuzzy Hash: 5b24a44fc25a6328cb63352620b6d980ed320925d03363b87a2ba5baaf040f8e
Instruction Fuzzy Hash: D731BDB68053988FDB11DFAAC894ADEBFF4EF49310F04845AD848A7211C6789545CFA5

Function 0302C9A0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0302D2C6,?,?,?,?,?), ref: 0302D387

Memory Dump Source

Source File: 00000002.00000002.2173213662.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3020000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8c18e0102fd252b06a95a768206d11090acc10025fec7d804e4eebabcc0d3823
Instruction ID: d989ffa06c733a5b0cbbbdd7a5156858aa9cf435f9df51777bc27b122cf2d7a8
Opcode Fuzzy Hash: 8c18e0102fd252b06a95a768206d11090acc10025fec7d804e4eebabcc0d3823
Instruction Fuzzy Hash: 3C21E6B5901258AFDB10CF9AD984ADEFFF4FB48310F14841AE918A3310D378A954CFA5

Function 0302D2F9 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0302D2C6,?,?,?,?,?), ref: 0302D387

Memory Dump Source

Source File: 00000002.00000002.2173213662.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3020000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5c9b2f0377ef8c7dbf1dcadf8b1fb7f2816d71cd8bd7145679f9b501e950afe3
Instruction ID: c18c0266a51b8b79bde4cad178f3e5c0b6e08298949bd86855deca2fda35bb6a
Opcode Fuzzy Hash: 5c9b2f0377ef8c7dbf1dcadf8b1fb7f2816d71cd8bd7145679f9b501e950afe3
Instruction Fuzzy Hash: 8D21E5B59012189FDB10CF99D584ADEBBF4FB48310F14841AE918B3210D378A944CF64

Function 0302A870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0302B101,00000800,00000000,00000000), ref: 0302B312

Memory Dump Source

Source File: 00000002.00000002.2173213662.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3020000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 468beac99163424d5945d7aeefced5f68542c28b173080ebdf92a71733e24edd
Instruction ID: e290510c93c251237597029160838f7358ff12e93cec8ba9cfb94e490dd78ae2
Opcode Fuzzy Hash: 468beac99163424d5945d7aeefced5f68542c28b173080ebdf92a71733e24edd
Instruction Fuzzy Hash: 401114B68013499FDB10CF9AC444AAEFBF4EF48310F14842AD919A7200C378A544CFA5

Function 0302B2A0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0302B101,00000800,00000000,00000000), ref: 0302B312

Memory Dump Source

Source File: 00000002.00000002.2173213662.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3020000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: df4f12dd71f94e83305a66c3e803023775813f96ddf6b90c1c43b83af0c85eb2
Instruction ID: 529ae9ed9e835fe62da515ea0bbe364a8180e97bfe2ac006fc13def6db1d80f5
Opcode Fuzzy Hash: df4f12dd71f94e83305a66c3e803023775813f96ddf6b90c1c43b83af0c85eb2
Instruction Fuzzy Hash: C11114B68003489FCB10CF9AC444ADEFFF4EF48310F14841AD919A7210C378A545CFA5

Function 07BF4AB8 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000), ref: 07BF4B26

Memory Dump Source

Source File: 00000002.00000002.2188497513.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7bf0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 07cf559657575f6bec354cbe6e6ebc561052e6e10e0256815f14a890fbd06e31
Instruction ID: e4f62dbae2f5ca00d00be4cfb8cf2368a18bfa23a6e4bd60108a76cd3166a6f4
Opcode Fuzzy Hash: 07cf559657575f6bec354cbe6e6ebc561052e6e10e0256815f14a890fbd06e31
Instruction Fuzzy Hash: 941123B6C002499FDB10DF9AC844B9EFBF4EF88720F14846AD518B7211D378A545CFA1

Function 07BF4AC0 Relevance: 1.6, APIs: 1, Instructions: 50libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000), ref: 07BF4B26

Memory Dump Source

Source File: 00000002.00000002.2188497513.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7bf0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5d69e314fa656656df285e267f3b85cf622551530477445fa91017c98792d1d2
Instruction ID: d3a76f87389db724c2837764ccf0255f399b93b3b858d55f2c9d12af32c87ed2
Opcode Fuzzy Hash: 5d69e314fa656656df285e267f3b85cf622551530477445fa91017c98792d1d2
Instruction Fuzzy Hash: 651102B6C006498FDB10DFAAC944B9EFBF4EF88720F14845AD519B7211D378A645CFA1

Function 0302B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0302B086

Memory Dump Source

Source File: 00000002.00000002.2173213662.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3020000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4e1e43361ff9ca48ec1a2bf4519ef236db4297e0a3485da297a13511c59d5007
Instruction ID: 5b34ccedee856f39418a5d50f483659e30549bc713e78ce838d862c57239c0f2
Opcode Fuzzy Hash: 4e1e43361ff9ca48ec1a2bf4519ef236db4297e0a3485da297a13511c59d5007
Instruction Fuzzy Hash: 6A110FB6C007498FCB20CF9AC484A9EFBF8AF88620F14841AD428B7210C379A545CFA5

Function 069F59D8 Relevance: 1.5, Strings: 1, Instructions: 295COMMON

Download Yara Rule

Strings

d, xrefs: 069F5C29

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 89f8b048e5c6a0c24b2323ac3c07aab7044f3c97b4a3e4a97225519b66bc1456
Instruction ID: e053e43160ba443bab31e9e2b8eddfdb81283b82807812be74712115aed6f1a9
Opcode Fuzzy Hash: 89f8b048e5c6a0c24b2323ac3c07aab7044f3c97b4a3e4a97225519b66bc1456
Instruction Fuzzy Hash: E7C15C34710602CFCB65CF28C58096ABBF6FF89310B26C999D55A8BA65D730FC56CB90

Function 069F48A8 Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

+ Pm^, xrefs: 069F4DA7

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID: + Pm^
API String ID: 0-1772364228
Opcode ID: bfdb3adee732c12f8dee1b914545448b67b2c358dcd122ef14563e7837126b8b
Instruction ID: 643d36b1100faa16fe1a5d73efcea2d75fb1cc51511cde98862b75a4a67e5891
Opcode Fuzzy Hash: bfdb3adee732c12f8dee1b914545448b67b2c358dcd122ef14563e7837126b8b
Instruction Fuzzy Hash: 0CB16A34B106048FCB54DF39C584A5ABBFAFF88700B2544A9E506DB7A2DB34ED05CBA0

Function 069D1BA0 Relevance: 1.4, Instructions: 1441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183363885.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b5ff181298172e4f0f8c8d02db708fe34c93af2701fae85f5f4ee59f388e873
Instruction ID: 07cf8bf2c45ebef9630c2c799090c236d84fbf6baae64d8c1d3ee5c2efabfeec
Opcode Fuzzy Hash: 5b5ff181298172e4f0f8c8d02db708fe34c93af2701fae85f5f4ee59f388e873
Instruction Fuzzy Hash: D5C27070B001189FCB54DF64C991EADBBB6FF88700F108499E60AAB3A1DB719E45DF61

Function 069F3DE0 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

4']q, xrefs: 069F3F25

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: a0e1fd4883804d9712efb6766395e80d93cbbf2b88b320a646d6744bba1a6110
Instruction ID: 3210434df09c87d0db88d3b40b50bd7972696d41a1647fcca3f71f2dc06c1cb0
Opcode Fuzzy Hash: a0e1fd4883804d9712efb6766395e80d93cbbf2b88b320a646d6744bba1a6110
Instruction Fuzzy Hash: 1A31C331B052514FC769AB38A8504AE7BEADFC622071544BAE449CF791DE39EC0BC7E1

Function 069F84D8 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

4']q, xrefs: 069F85B1

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 2620bdfde729be8c8ce25344c83970c16c8343c360f33a3af1042e0ccbb38c9d
Instruction ID: 95f1772452a7be13450c06f2b3e8a6487732008fb9f945e6afd615ec4135b7a4
Opcode Fuzzy Hash: 2620bdfde729be8c8ce25344c83970c16c8343c360f33a3af1042e0ccbb38c9d
Instruction Fuzzy Hash: AB318031B00214CFDB48EB79A65856E77E7EFC8200B104839E60ADF384EE39AC0687D1

Function 069F84C8 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

4']q, xrefs: 069F85B1

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 678cfe1673c407c54b6eb668737306e8a31fc1f7546c1c04c3edfe8e75677923
Instruction ID: 35aa1e930ab40d7f98a5e1f7c6d653d6e68d5917045010382158a130c5036f0b
Opcode Fuzzy Hash: 678cfe1673c407c54b6eb668737306e8a31fc1f7546c1c04c3edfe8e75677923
Instruction Fuzzy Hash: FF319330700214CFDB49AB79965857E36E7AFC9200B10487DE60ADF384EE38AC0687D2

Function 069FB358 Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

4']q, xrefs: 069FB399

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 717bbc9fd4b370f7de908f1d6b46616b6021f1a0754405f48368e30c6952ba92
Instruction ID: cf60468e8389ad082e07355168b0313e72250f0573a2aeafd5ff094ff186bc3e
Opcode Fuzzy Hash: 717bbc9fd4b370f7de908f1d6b46616b6021f1a0754405f48368e30c6952ba92
Instruction Fuzzy Hash: 0E018474D0624ADFCB45EFB8E59458C7FB2FF45200B1541A9D946A7350DB344E49CF11

Function 069FB368 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4']q, xrefs: 069FB399

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: b567d7afd257455a8db090c82440fb0928435b90f4e26539f5c305f5ce0c2cd0
Instruction ID: 8b37fc4fdca540ac4d0b55f2e1b9a465d13620d02737d55b3f1fc10858865e93
Opcode Fuzzy Hash: b567d7afd257455a8db090c82440fb0928435b90f4e26539f5c305f5ce0c2cd0
Instruction Fuzzy Hash: 52F06970E0220AAFCB04EFBCE54489CBBB6FB44200B2441A8D90AA7354DB385E09CF51

Function 069D3838 Relevance: 1.0, Instructions: 1025COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183363885.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76c0ee858461848b69f2e7e51e76fd0c81c753fbcc16a6fb32deb4e5d8c02dae
Instruction ID: cf67c22e3a55814d1c33b5631b9cd50c994d1fa49558af225bdd76280075d1c8
Opcode Fuzzy Hash: 76c0ee858461848b69f2e7e51e76fd0c81c753fbcc16a6fb32deb4e5d8c02dae
Instruction Fuzzy Hash: B5825874B502049FCB44DF68C994EAEBBF6EF89704F1580A9E506DB3A1CA71EC41CB61

Function 069D00D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183363885.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d78f3b3fd47e289eef756134fd8088c66109f0be5b6fed55f97b141b0befc4e
Instruction ID: e5636e9d27daab362a6eced60b7312f35aa4ea991b79f26e340760198cf8f87b
Opcode Fuzzy Hash: 8d78f3b3fd47e289eef756134fd8088c66109f0be5b6fed55f97b141b0befc4e
Instruction Fuzzy Hash: 51428930B406158FCB65AF78E450A6E7AA6FF85304F014A6CD5079B794CF7AAC098B92

Function 069D2070 Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183363885.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d534860fb79c47846ab90c37995d87c1ca89a6f10caa0ca87338cc0a90bfedbd
Instruction ID: f5d5a3e5282329fdfcc1da7670b3e211a2fa245d5ce3d806493faee8bd65bbb4
Opcode Fuzzy Hash: d534860fb79c47846ab90c37995d87c1ca89a6f10caa0ca87338cc0a90bfedbd
Instruction Fuzzy Hash: FB22D370B501148FCB149F24C995EAE77B6EFC8704F10C599EA0A9B7A1CFB1EE418B91

Function 069D0598 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183363885.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5b50c9da6c6f94f1f2bbb82cdb5c1d8b9b665e2e38bae54d6c90a82dba924c
Instruction ID: 4c7834736015c2ea7a2e6f470e0aead7db1a1124812609662be2ca870c4bb76c
Opcode Fuzzy Hash: 3c5b50c9da6c6f94f1f2bbb82cdb5c1d8b9b665e2e38bae54d6c90a82dba924c
Instruction Fuzzy Hash: A502CF30B402048FDB559F78D894A2E7BB6FF89704F108969D5069B7A1CFBAEC05CB91

Function 069D0610 Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183363885.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b41aa790df2bf538fb6a1ee234e44b83c8135717fe45ca403e592945f327141
Instruction ID: 7c6786904ee6b74965a5d0b310c530160afb57fe8ba02b7408b0181a676274f5
Opcode Fuzzy Hash: 7b41aa790df2bf538fb6a1ee234e44b83c8135717fe45ca403e592945f327141
Instruction Fuzzy Hash: 5B02C330B402048FDB549F74D994A2E7BB6FF89704F108969E5069B7A1CFBAEC05CB91

Function 069D0688 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183363885.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b22c7e35978d7b37364b52981e8e5b09b3d1cbb1ade99e41103cf10e41a027e8
Instruction ID: 465c4f95ed1963eaa70cc21e63eb41f94fbff88c8c0e3d7560b51d86228e5de0
Opcode Fuzzy Hash: b22c7e35978d7b37364b52981e8e5b09b3d1cbb1ade99e41103cf10e41a027e8
Instruction Fuzzy Hash: 38E1C130B002048FDB449F74C999A2E7BB6FF89704F108569E6069B7A1CFBADC05CB91

Function 069D0700 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183363885.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87bf7281ed558d2ca002644c130045c28a135edaf8f0a7ca54c6b87b0949971
Instruction ID: d42e4eb88fb61d71b425804ed8e63ffc69c483565a450372be367a1d041f404f
Opcode Fuzzy Hash: d87bf7281ed558d2ca002644c130045c28a135edaf8f0a7ca54c6b87b0949971
Instruction Fuzzy Hash: 72D1A330B002049FDB449F64C999B697BB6FF89704F108579EA069B7A1CFBADC05CB91

Function 069D00B7 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183363885.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f058cbc26e61b0ebee2f7b908ca3e57fbc0e0d012b77e93bd83cd2298af6b03b
Instruction ID: 44249debcb76414ff179a7649e308625e44b3f53d7c0ce1160a9b0596ad5a2e3
Opcode Fuzzy Hash: f058cbc26e61b0ebee2f7b908ca3e57fbc0e0d012b77e93bd83cd2298af6b03b
Instruction Fuzzy Hash: E5C17030B002049FDB449FA4C999B697BB6FF89704F108566E606DB7A1CFBADC41CB91

Function 069F7D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449eeeed7c0908b8dcb9aa87b83f999884ece8f132ed14f8624f842cc30dc35d
Instruction ID: 2b2f0179ed82cdfb49a10a96b79b3cffe107cd52a5f074c7e92e9eed384fb530
Opcode Fuzzy Hash: 449eeeed7c0908b8dcb9aa87b83f999884ece8f132ed14f8624f842cc30dc35d
Instruction Fuzzy Hash: EA513571E10218DFDB54CFE9E980BEEBBB5BF88300F25842AD515AB654DB749941CF80

Function 069D34D8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183363885.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc441ca4f5980d418356235466f9ee56f68e031b23f04627d2f7a5035124236b
Instruction ID: cbc6dce569797ca91921ad3d7a46d63b2022ba115e834e53f1999dd1a3f41a03
Opcode Fuzzy Hash: dc441ca4f5980d418356235466f9ee56f68e031b23f04627d2f7a5035124236b
Instruction Fuzzy Hash: 46514735B101199FCB54CF69C88499EBBF6FF89310B1580A9E909EB361DB70EC05CB61

Function 069F7D4C Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 499433a76ffa52b804757daf99720d510478cee475d3027377ce928b74ec67dc
Instruction ID: bbb070a2c52a8d98f4567e7c748a0ca3b8d3e2fde85b189e72eccaf1be27f846
Opcode Fuzzy Hash: 499433a76ffa52b804757daf99720d510478cee475d3027377ce928b74ec67dc
Instruction Fuzzy Hash: 4A5156B0E10219DFDB50CFE9D980BEEBBF9AF48300F24842AE415AB650DB749841CF91

Function 069F59C8 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e33aba9d40d077d23d5fb4a5eb73c2187b2a8410484ed40bc8c566c56a7854cb
Instruction ID: 90122a773cac8bb36becaf88b0231c0dd10f20d6c1f7e41581a8ca65cb7b9070
Opcode Fuzzy Hash: e33aba9d40d077d23d5fb4a5eb73c2187b2a8410484ed40bc8c566c56a7854cb
Instruction Fuzzy Hash: 6D417C34B10606DFCB11CF58C8809AABBF6FF89310B16C999E656DB661D731F911CB90

Function 069F5579 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6a93397888e8d0d1b175beb051101281e5a811040450c854ed303c3cd9ade50
Instruction ID: 922d95e4142d4e162074a3aec7467b764f043ed13f627fab4159dc4d3cb00339
Opcode Fuzzy Hash: b6a93397888e8d0d1b175beb051101281e5a811040450c854ed303c3cd9ade50
Instruction Fuzzy Hash: 0E31B035B112109FCB15DF38D84499EBBBAFF89311B118469EA05CB3A5CB75ED05CBA0

Function 069FF920 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ae26da53d741eccc6667bf67fab7082ef0706fa7ad280f6a2e8498972558b4b
Instruction ID: 87f90b22d12057594287b3b7381590a9c2871f2d7b8dd0f209dfb1adb4d3acc1
Opcode Fuzzy Hash: 1ae26da53d741eccc6667bf67fab7082ef0706fa7ad280f6a2e8498972558b4b
Instruction Fuzzy Hash: A931D57A7093545FCB596F78E85446A3FABEF8621031504AAE606CB391EE398C06C761

Function 069F5588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6eb49e3a7ebf48d2d7bed21ddb99f46dbaa3323bc01542587cf14c2067aad5f
Instruction ID: 2d229f561586afc6470a7becce08e65dc2bf53734afe2a4ec7eb1c0a6526c089
Opcode Fuzzy Hash: c6eb49e3a7ebf48d2d7bed21ddb99f46dbaa3323bc01542587cf14c2067aad5f
Instruction Fuzzy Hash: 2631D034B102109FCB15DF38D88495EBBBAFF89300B118469EA05CB3A5CB71ED01CBA0

Function 069F87A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1d4974e50d972a9b056c2ce4b976983ffb32d56c5ff396bde88be8a0ab1fa9d
Instruction ID: 5d4bee85aca8df9c6e031c662ff3c795eb7e69eccc36b2240f8e3c85fca52312
Opcode Fuzzy Hash: e1d4974e50d972a9b056c2ce4b976983ffb32d56c5ff396bde88be8a0ab1fa9d
Instruction Fuzzy Hash: 3541F0B1D11248DFDB54DFAAD940ADEBFB6AF88310F20842AE519B7250DB34A945CF90

Function 069F8796 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 318a4f2ce44dd50629b43a3e471b68c58ba129340920407b48b2b302c3cd0d0f
Instruction ID: 236d08f84ae194e2b97369a4657f07b64b728529077fec99ab2715f47b6fde33
Opcode Fuzzy Hash: 318a4f2ce44dd50629b43a3e471b68c58ba129340920407b48b2b302c3cd0d0f
Instruction Fuzzy Hash: 923126B1D11248DFDB54DFAAC940ADEBFFAAF88310F24802AD525B7250DB345945CF90

Function 02D9D654 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2172817839.0000000002D9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2d9d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07680b2c179c35859512596530999e93bc8b5945049aa04ec0f8ff18904587cf
Instruction ID: 7a418f33c9ca4077bd59da06710f8b3d7e38e99bd4670a85352bf5e1301d4bf5
Opcode Fuzzy Hash: 07680b2c179c35859512596530999e93bc8b5945049aa04ec0f8ff18904587cf
Instruction Fuzzy Hash: F121C476504244DFDF05AF14D9C4F26BFA6FB88314F248669E9490B356C33AD816CBA1

Function 069D105C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183363885.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0048007526326923b7c4a7ca8ed77697efcd209e032cf28cbf25deaea2286211
Instruction ID: e450823a778cbefebcd2d97c5cd460c1475a84f83f0467b879cae72ddc929b50
Opcode Fuzzy Hash: 0048007526326923b7c4a7ca8ed77697efcd209e032cf28cbf25deaea2286211
Instruction Fuzzy Hash: 5221B231B042049FDB55CB6998449BABBFAFFC5214B25857AE415C76A1CB70CC11C761

Function 069F8A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcdf5646e7abd881d5f7e965e54884bbb584c735a8f4761e32ff2078fb9a3c38
Instruction ID: 1e68bcb00d066e33a8c8212731076b38ebe08d5c298135d6f9bad64fb3c9f6b8
Opcode Fuzzy Hash: fcdf5646e7abd881d5f7e965e54884bbb584c735a8f4761e32ff2078fb9a3c38
Instruction Fuzzy Hash: 243114B1D11258DFDF54CFA9D990ADEBBB9AF48310F24882AE509B7240C734A946CB90

Function 02D9D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2172817839.0000000002D9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2d9d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51c64ed5ad40ec6441ef21816d1bc59fc85b927c12f559d32812922c2147e81d
Instruction ID: 3b619bc2408e37172ae315d816ef604dcf2239b62b234e789cbabf55f0e22ece
Opcode Fuzzy Hash: 51c64ed5ad40ec6441ef21816d1bc59fc85b927c12f559d32812922c2147e81d
Instruction Fuzzy Hash: 47210371500204DFDF09EF14D9C0B26BF66FB99324F24C569E9490B31AC33AE856CAA2

Function 02D9D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2172817839.0000000002D9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2d9d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7e3f5032ff663643534ba2cb20676aba65167336d79c7f816159fd8a87da752
Instruction ID: 9cc84a4d1997a1429acb056f84de864150fe943de4d43792e4633b0b7106d4ca
Opcode Fuzzy Hash: a7e3f5032ff663643534ba2cb20676aba65167336d79c7f816159fd8a87da752
Instruction Fuzzy Hash: 0C21FF71504240DFDF45EF14DA80B26BF66FB89318F24C569E9490B356C33AD856CBA2

Function 02DAD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2172887367.0000000002DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dad000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 998e6015eb552f0305b64624dd2c5632728d80907585f3d5d40cd6e2131ff4fa
Instruction ID: 9eefdefc962d7b36920dc2228a6fbb07de47f7fe5fb621c1358d78177a02e7f4
Opcode Fuzzy Hash: 998e6015eb552f0305b64624dd2c5632728d80907585f3d5d40cd6e2131ff4fa
Instruction Fuzzy Hash: 2B212F71604200DFDB14CF24D991F26BFA6EB88314F30C969E84A4B756C33AD807CAA2

Function 069F8F42 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 248071c1e9a5c1dd656f0640f5a34d70b7bdf3ce18ccf511dcde9b6a5bb99908
Instruction ID: 2eb70303e8e8e6d2517b26c15881a0473138999b9dc7984b97b4b54bb9fe9a1d
Opcode Fuzzy Hash: 248071c1e9a5c1dd656f0640f5a34d70b7bdf3ce18ccf511dcde9b6a5bb99908
Instruction Fuzzy Hash: B7214474D1524ADFCF80CFA8D584AEEBBB5EF09321F2040AAE525A7351C7345A81DB90

Function 069F8A8C Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e95fc833dce2f941cf8139529b31681d44f28fb5c97a86676e7455d145c2ffd8
Instruction ID: 1b34e57553adf67931c3adb2aef2da6427360f19f98b91848796726d6bea45ba
Opcode Fuzzy Hash: e95fc833dce2f941cf8139529b31681d44f28fb5c97a86676e7455d145c2ffd8
Instruction Fuzzy Hash: F02126B0D112589FCB54CFA9C995BDEBFF9AF48310F14882AE505B7240D7759845CBA0

Function 069FC0BF Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f337c2da032d0406b8f44dc905d35eb292be401f009f177bfd6d6bd3e2debf12
Instruction ID: 081f684541203eb575fbd418ccea507b04c850a68878026056bd1dec55d3e42f
Opcode Fuzzy Hash: f337c2da032d0406b8f44dc905d35eb292be401f009f177bfd6d6bd3e2debf12
Instruction Fuzzy Hash: 7D1126722013944FC302DF2CE9987DB3FEADF82304F04055AE0C6CB266D6259A5AC751

Function 069F6E72 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36bae2a98f102d1099d882ddedc4abc565538718903d65458a5f12b489cc4151
Instruction ID: b462eab59469b620b3780dc40f966496e567e2b9502ed8f37afb63fb0bfb02c3
Opcode Fuzzy Hash: 36bae2a98f102d1099d882ddedc4abc565538718903d65458a5f12b489cc4151
Instruction Fuzzy Hash: E801D2621092E83FCB624A796C10CE73FEDDE8B25070940CBF9D4D6193C0298A65D7B2

Function 02DAD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2172887367.0000000002DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2dad000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7af77a603e03fa77319a7799c57176ff7626b4697d640f29f4f4196ef9c6c903
Instruction ID: 6dbea3424e7f2d5e6b72230528e22bc8b8c712eab2b971f7a4a7847b43736de3
Opcode Fuzzy Hash: 7af77a603e03fa77319a7799c57176ff7626b4697d640f29f4f4196ef9c6c903
Instruction Fuzzy Hash: FD21A7755093C08FCB02CF24D594B15BF71EB46214F28C5DAD8498F657C33A980ACB62

Function 069FBC5D Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a43111a825f38a5f6e1d52309cf8fd04c99f963eca38e16c858b7531108fec9b
Instruction ID: 03c0a89de227491a88d7592db9d1177df897cf5378bd4825f504081af0780cbf
Opcode Fuzzy Hash: a43111a825f38a5f6e1d52309cf8fd04c99f963eca38e16c858b7531108fec9b
Instruction Fuzzy Hash: B611E5722002055FC789BB38E8509AE3BABEEC1390B150469E10787750DD34AD4ECBA1

Function 02D9D64F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2172817839.0000000002D9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2d9d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1af77b3fa130e801d82a87a7fe0c5247251245d4ec94d460628ebe357439b1a
Instruction ID: 5874739f31d1c7dce7b298a4ab3f196b2df9fb33c922b98b9df6770948bd1cb9
Opcode Fuzzy Hash: c1af77b3fa130e801d82a87a7fe0c5247251245d4ec94d460628ebe357439b1a
Instruction Fuzzy Hash: A321D276404280DFCF06DF00D9C4B16BF72FB88314F24C6A9E9490B256C33AD416CB91

Function 02D9D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2172817839.0000000002D9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2d9d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d586b370810bf15e8d939e07fb0dccd80900219e7a08ccebccaf9c83e80135
Instruction ID: 0999064593039a3f96379b71c0d0a83fe9b1a4f6f78d4e94f2b8c4c78f002800
Opcode Fuzzy Hash: 07d586b370810bf15e8d939e07fb0dccd80900219e7a08ccebccaf9c83e80135
Instruction Fuzzy Hash: FE11D272404240CFCF06DF00D5C4B16BF62FB85314F24C6A9E9090B616C33AD456CBA1

Function 02D9D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2172817839.0000000002D9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2d9d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d586b370810bf15e8d939e07fb0dccd80900219e7a08ccebccaf9c83e80135
Instruction ID: cca68b824341eda0b68b8991b5d84b5b03b4ef32810a803f75b5019720d8f19f
Opcode Fuzzy Hash: 07d586b370810bf15e8d939e07fb0dccd80900219e7a08ccebccaf9c83e80135
Instruction Fuzzy Hash: C611E176404280CFCF02DF10D9C4B16BF72FB84318F24C6A9E8494B616C336D85ACBA2

Function 069F8350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35510d2cc2950617c84a33b1c8b280805c7f8a2021454629141c84a8a0150e59
Instruction ID: 357aaa7a630dc9b02197e52afec4de018d9d31a305e209268be49aa77daba22d
Opcode Fuzzy Hash: 35510d2cc2950617c84a33b1c8b280805c7f8a2021454629141c84a8a0150e59
Instruction Fuzzy Hash: C801B132B001199BDB10DAA9AC44AAFB7FEEB84211F148036E604D3240DB709D1987A0

Function 069FC499 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83aa5a738525964d384273151544ded98dff7ff026d4f439e05fad3ca426f57a
Instruction ID: 9ba4aab10b99de91b42abbad573fb3f59300d881f8b45aecb166fed20ec86727
Opcode Fuzzy Hash: 83aa5a738525964d384273151544ded98dff7ff026d4f439e05fad3ca426f57a
Instruction Fuzzy Hash: CB0104706042048FC329AF69E40465E7BE3EFCA301F118A69D14B8B758CF789C0ACB91

Function 069FBC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8c3c3d35417aaf2068861b70a026df8940881c94ae6f29a4777b5bc0fd478f2
Instruction ID: d22c1f1a0df33f6b7d86b7c3abaf87ad08c07bac06dfa003a828038629958d3e
Opcode Fuzzy Hash: e8c3c3d35417aaf2068861b70a026df8940881c94ae6f29a4777b5bc0fd478f2
Instruction Fuzzy Hash: 770171722002054F8BC8BB78E55496E7BABEFC1394B544868E20B87754DE74BD4ECBA1

Function 02D9DAB1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2172817839.0000000002D9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2d9d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c58d45ee84e7ee82696dfc83e61e4f0d82ff90168039bb9b6d2d3a28a717f5ac
Instruction ID: 9b63313babceac1e09e3aedbe9f9b0ecbeb8e34360f8d2492447c72a9f20a0b9
Opcode Fuzzy Hash: c58d45ee84e7ee82696dfc83e61e4f0d82ff90168039bb9b6d2d3a28a717f5ac
Instruction Fuzzy Hash: 7601F2311083449AEB209E19CD84B67BFA8EF55368F18C56AFD484A346C3789C40CAB1

Function 069FACB8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48083f96b0c6a6ca28f01fdc3ea7b953b3336ee3e69538d071ac46cda6ccf22e
Instruction ID: 80b1c4c4c4bea10bc37e57ef517bc3440de651a6e0234346bccc3d519aa70581
Opcode Fuzzy Hash: 48083f96b0c6a6ca28f01fdc3ea7b953b3336ee3e69538d071ac46cda6ccf22e
Instruction Fuzzy Hash: 1FF078726092505FCB622BA8AC104AE3F6ADC8224534940AEE28BC7251CA244D07C7E1

Function 069FE8B0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f30e8432a8fd64734e82da1a696608fa96bca4b443ecea007630aae0944efb68
Instruction ID: db0ed17259bc86350bb3f49618aae8edf248b83fa654ebb37eedd95cbc460fa5
Opcode Fuzzy Hash: f30e8432a8fd64734e82da1a696608fa96bca4b443ecea007630aae0944efb68
Instruction Fuzzy Hash: 4B01D1346083489FCB46EF78D8148AA3FBAEF86300B1484E9E501CB262DB36DD11C792

Function 069FC4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0285cf7092cc5bf01d2e54fe1302588d9cdb5a56f63deb189dee2d6b0d926a65
Instruction ID: a488c68a80fb6dbdbabf7d68a7050d3a01fa025ce39365cee38f603b7b0634bd
Opcode Fuzzy Hash: 0285cf7092cc5bf01d2e54fe1302588d9cdb5a56f63deb189dee2d6b0d926a65
Instruction Fuzzy Hash: 2701B5702002058FD319AF69E44465E77E7EFC5315F108A28D14B87748CF78EC0ACB91

Function 069F5508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b721dd7a831edfc010857ac06ab4c70660800a7b92564365177c75673ae6334c
Instruction ID: 4a077285aef6302600c6702e8789a4c7a2e5857f2ccf66a47db885fb8449092d
Opcode Fuzzy Hash: b721dd7a831edfc010857ac06ab4c70660800a7b92564365177c75673ae6334c
Instruction Fuzzy Hash: 5001D130A21312CFDBA88B39A504523B3EBBF94205B26883DD202C6E55DA75E880CBD0

Function 069F67C8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 258bc88df4789f9ce06c2f01d6a9bc31d30c08c8d10d07e96e959b857265ba48
Instruction ID: 067641b16a5cba68fe09e8f29bf63cfc5de87350e5ad203c704866334a53377b
Opcode Fuzzy Hash: 258bc88df4789f9ce06c2f01d6a9bc31d30c08c8d10d07e96e959b857265ba48
Instruction Fuzzy Hash: 3DF09031B513006BC7208B28EC01F967FEE9B42721F25826AF714CB1E2D7B1E80597A0

Function 069FC170 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf5ba80f7b2765c5c058c8e63c7b1f9a791cdd57f30994db78cec05c9d4fd50d
Instruction ID: 49ed331a651ed8fc9f7a10ff35c554189d186136722fad23b41a47e86e3e5516
Opcode Fuzzy Hash: cf5ba80f7b2765c5c058c8e63c7b1f9a791cdd57f30994db78cec05c9d4fd50d
Instruction Fuzzy Hash: 1A01D1B1502B058FD316DF2AE808166BBF7FB89300701862EE48AC7611DB34A90ACF81

Function 069F8F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df9fae8b38c4bdd22f006c68efb9b3097d614f0d92dd6793f9c7732fa54a846
Instruction ID: e0376c4f138f9d12e0bf08073bf8180d2bb6c8505b71c98328f36b8e3ebc29bd
Opcode Fuzzy Hash: 9df9fae8b38c4bdd22f006c68efb9b3097d614f0d92dd6793f9c7732fa54a846
Instruction Fuzzy Hash: 3401D6B4D1420AEFCB84DFA9D9456EEBFF5BB48301F2084AAE515A3340E7740A44DF90

Function 02D9DAB0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2172817839.0000000002D9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2d9d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0bbf99fba9a0a030931a57b5c33d6cebd1c59ba932426b424fe2a27116ab158
Instruction ID: ab53570630a911a4412584f721ac177bdbc8cceb73f0f4f0617215bbdf30606f
Opcode Fuzzy Hash: d0bbf99fba9a0a030931a57b5c33d6cebd1c59ba932426b424fe2a27116ab158
Instruction Fuzzy Hash: D3F0C271004344AEEB108E06CD84B62FFA8EF45769F18C45AED485B286C3789840CA70

Function 069F54F8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f895f1d33a7bb207d7ac6c89d192ca9f3c33f61d56cf27fe5c3c583516b1d8c9
Instruction ID: 73033a2fe6c9e863c5460aa55ec9f6b21d3dcf070f0661ed5fa3f868110d0d43
Opcode Fuzzy Hash: f895f1d33a7bb207d7ac6c89d192ca9f3c33f61d56cf27fe5c3c583516b1d8c9
Instruction Fuzzy Hash: 01F04630515341DFCBA5CF21D840A63BBBBAF82214F4A48ADF04186C22C7B1E888CBA0

Function 069F6EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7620dfd3362541a7a67ddcef16afb5e8e56e456b1077ac7187809afcf6f96f0b
Instruction ID: d63be014ed0d93ffcb396008541c19296249531f906a800bab90ebed4aa10fd2
Opcode Fuzzy Hash: 7620dfd3362541a7a67ddcef16afb5e8e56e456b1077ac7187809afcf6f96f0b
Instruction Fuzzy Hash: 15F037722041E83F8F515E9A5C10CFB7FEDDA8E161B084156FFD8D2281C429CD21ABB0

Function 069FADE9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e00ae92fb371f1c4e5468a259430a9a85b616e52e88c78981798b376c2fe2877
Instruction ID: 43f21bc4730f60c0dfced29016b3800d7b87551ab47b5408d4ae87db0f4c7f40
Opcode Fuzzy Hash: e00ae92fb371f1c4e5468a259430a9a85b616e52e88c78981798b376c2fe2877
Instruction Fuzzy Hash: D5F082313051006FC7643A6DE854BDBBEDBEFCA751F40406DE20F83282CA621C0587B9

Function 069F8341 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4112ea34c5b63f221d212fadd3c7fae0d33b7375ad8f24ac5d3a4472a2d6ad08
Instruction ID: c2219a0d3720f96ae7bdd70ddaa23dd8e7d2080455cd4de4e67c85ffa9e424c9
Opcode Fuzzy Hash: 4112ea34c5b63f221d212fadd3c7fae0d33b7375ad8f24ac5d3a4472a2d6ad08
Instruction Fuzzy Hash: 07F0A772F101155B9B509A689D48AFE7BBEAB841617090026DA14D3100E734851E87A0

Function 069F8FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b09b44375372666c00d670f7258b680d21506c564b9a272de77d5d1ec2cab4f
Instruction ID: e3d372d61d6a1bd0ab1db4ae8f0f7b86ff434c08894bc2a48f9cb1492e89d6ad
Opcode Fuzzy Hash: 9b09b44375372666c00d670f7258b680d21506c564b9a272de77d5d1ec2cab4f
Instruction Fuzzy Hash: E4F0CDB0C18149EFDB80CFA4C9055BEBFB0EF1A301F0441D6E446E7750E6398A01EB80

Function 069FAC60 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f163123aab093aa3d0ebae64d92daffe455a2b82925c44b05c0bb87e44e6148d
Instruction ID: 703e691e9c7e06d25dbaa89c525f78113748282767b8615b5b1d7a3861a086da
Opcode Fuzzy Hash: f163123aab093aa3d0ebae64d92daffe455a2b82925c44b05c0bb87e44e6148d
Instruction Fuzzy Hash: CCF082716092A41FC7177738A8244EE3F6ADE86611709009AE247CB292CE284E46C7F6

Function 069FFF50 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 210f7e14ddc63eb9eda04facd027d2804613590253a2f65e1923a306907fa7a1
Instruction ID: 9b44a4a994649f223a2f100aeb1f8f32498b450d8565ca47ccc9be4165491c17
Opcode Fuzzy Hash: 210f7e14ddc63eb9eda04facd027d2804613590253a2f65e1923a306907fa7a1
Instruction Fuzzy Hash: A3F0E5B1952244DFCB82DFA4E9106ECBB75DB02300B2047A6D404D7691C7340F18DF81

Function 069FADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140d1292ae5801845de7da84c8872e032af751b794da112994e63136b2021269
Instruction ID: ca299eddcfc3d9f15a497dabbf3c3e11ec14accd977c95df73398b8ade2e2707
Opcode Fuzzy Hash: 140d1292ae5801845de7da84c8872e032af751b794da112994e63136b2021269
Instruction Fuzzy Hash: 91E06D313011006FC7543A5AE448A9FBADBEBCA351F104028E20FC3281CA615C0587B5

Function 069FC180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d48d9c48f76264ded1e3a8ba7b2c82d3a8f2dcfb3f5a68f3a63bdbe7c271d53
Instruction ID: 2cc4f55a2038846f62311dec0869515956503e26d9c4e3d644793c8355c0b09a
Opcode Fuzzy Hash: 4d48d9c48f76264ded1e3a8ba7b2c82d3a8f2dcfb3f5a68f3a63bdbe7c271d53
Instruction Fuzzy Hash: 58F09074501B068FD715DF26E408526BBF6FB88300B00C62EE94B83A10DB74A90ACF84

Function 069F5698 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de96b18b0f0879269b3b28895d79dab5bc91e973fdef2ac65ac461ba1666fa20
Instruction ID: 6364d1e3f09551d34a75cd719fee5f8160192ca3786d843a50be025ab6043c97
Opcode Fuzzy Hash: de96b18b0f0879269b3b28895d79dab5bc91e973fdef2ac65ac461ba1666fa20
Instruction Fuzzy Hash: 72E06DB250D210AFD340DB35AC058977BA9EBA2220F12886EF044C7141E631D840C7A5

Function 069FC120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1a98c6ea3d5a37e93610629bd963e8f058e968a951b0c0f7d114664932309d1
Instruction ID: 36f5a56d78ab330a1efa0cde2c59925e6861522e77cb0cedc24983bbf606da7c
Opcode Fuzzy Hash: c1a98c6ea3d5a37e93610629bd963e8f058e968a951b0c0f7d114664932309d1
Instruction Fuzzy Hash: A5E0A9302017658FC710AB2DE408BAE7BEADF81304F040569E2478B641CBAAAC06CB91

Function 069FCC38 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4e48bad6a17c6cc1c38f836350c63890f8eea7c4b73e5f2a130dd93d6fcaeb
Instruction ID: 29b1fcb1c3a81f3a254304199ba992ad4ac6d1ea0c6b03d4780f2419dc0f96df
Opcode Fuzzy Hash: 3e4e48bad6a17c6cc1c38f836350c63890f8eea7c4b73e5f2a130dd93d6fcaeb
Instruction Fuzzy Hash: B0E0D8722062414FC7419F1DF8406C97B96DF51210B02C066D849DB751CA7D0C09CB91

Function 069FB500 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dcb595710a1d5117be1dda40868cf356f0614d2ae55172d1131b9d37c384c73
Instruction ID: 57fd9595f9eec860e023c56d2b5d763e7ccbde05d86848ecdb4e8d384f5878da
Opcode Fuzzy Hash: 2dcb595710a1d5117be1dda40868cf356f0614d2ae55172d1131b9d37c384c73
Instruction Fuzzy Hash: E2F039B6D0120DEFCB01DFB8DA488CEBBB5EB44200F1082A6E845E3240EA304B55DB80

Function 069FCE88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e78dc414fc359d704b1f1f3b059708e6e27d4108132162acce1fbfdc5732ccc
Instruction ID: 8f1895149fe2e989e48a600d234a3d36df0e6eb6e3b5bb44e8fb52eb776e02e7
Opcode Fuzzy Hash: 2e78dc414fc359d704b1f1f3b059708e6e27d4108132162acce1fbfdc5732ccc
Instruction Fuzzy Hash: 13E026F4106382AFCB42EB28B4114583B61DB4120031180EAEC8ADB301D92C9D0AC7C1

Function 069FE1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a95d6c0ae9b843380ce8f99b756d4b2bad83daac925da42ddc5aa094edd29d9
Instruction ID: 64e79309142727ccc8c09d5aca146ca822effc8df3da61bd5e99e6594beba2a3
Opcode Fuzzy Hash: 1a95d6c0ae9b843380ce8f99b756d4b2bad83daac925da42ddc5aa094edd29d9
Instruction Fuzzy Hash: 6CE048B1D49245EFCB41DFA8ED4089D7BB5DB4220172042D6E809D72A1D5344F15C751

Function 069FE8F8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed3771f9a410904eec273b114001b04b5f6241dd9318d9f23cf61db19d9ab10d
Instruction ID: a9e171fdf252b608975e746b9921b115354338a4abe127c09a27c39a252436e1
Opcode Fuzzy Hash: ed3771f9a410904eec273b114001b04b5f6241dd9318d9f23cf61db19d9ab10d
Instruction Fuzzy Hash: 73E0C23E1142049FC7428F14C8008843F7ABF0AA0030540C5F1808F272C222D820DB62

Function 069FF910 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ae141d4e911325c7333133267cc42fa084934d503ef7761834f48c606fd346
Instruction ID: ee12dbe3e662452a8926190eb7419633bc224022f1d2f190601de8d7f49c017b
Opcode Fuzzy Hash: b4ae141d4e911325c7333133267cc42fa084934d503ef7761834f48c606fd346
Instruction Fuzzy Hash: 3CE02B2A7083255FC7596AADE4202D77BAB5AD621031B80ABD381CB206CE324C0AC381

Function 069FFF60 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18e859fe84ef5723c35fc5a9329b7f1a28f1dbeb44bfc4d497209172b8a61ed
Instruction ID: fcc531c2f6957b9b11fe6fb9c4cf0de30fe6bb3e21eb3b999a66e7bd29001f1b
Opcode Fuzzy Hash: b18e859fe84ef5723c35fc5a9329b7f1a28f1dbeb44bfc4d497209172b8a61ed
Instruction Fuzzy Hash: 54E086B0941108EFCB40EFB8E915A9DB7B9EB01304F1046B8D80493250DB756E14DB51

Function 069FAC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7578660279a145d7014d601d5999cf3e9fb68e4c021718a9f10fbb446bfbb857
Instruction ID: 14d60378dd56d44e24ecbb83df8e5fe46bec4dd57f511246ff6f481a9218d5cf
Opcode Fuzzy Hash: 7578660279a145d7014d601d5999cf3e9fb68e4c021718a9f10fbb446bfbb857
Instruction Fuzzy Hash: C0D01731301129678B0A3669F4188AE7BABEAC9662704002AF70BC3280CE659D0687E5

Function 069FB510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32076fe2e9c05e27a38db91ea3c3fc0c977e44f6bec71da64acf91a41e22311c
Instruction ID: fad5a65853bc6f99ac879f1a42645eb94a3fbef6784c0faa2c64fc9254424d85
Opcode Fuzzy Hash: 32076fe2e9c05e27a38db91ea3c3fc0c977e44f6bec71da64acf91a41e22311c
Instruction Fuzzy Hash: 54E09275D0120DEFCB40DFE8E9448DDBBB9FB48200F1082AAD909A3200EB316B56DF80

Function 069FE280 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe6699f7632537023ed318e6eb2f3e54ab79d011b3185c7ae5cb841b49063cb9
Instruction ID: 7e151e2a40ba746bfd8a491663d6746a9d6b9873bd7711636c9ae6fb7a0133b5
Opcode Fuzzy Hash: fe6699f7632537023ed318e6eb2f3e54ab79d011b3185c7ae5cb841b49063cb9
Instruction Fuzzy Hash: 0EE01A715015178BCA54EE18F906A4573A6E748344F118469DC46276A4CB6D2E4DCBC0

Function 069FE210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a8d5bf58b7253c1bbc91ec7bc620d472d6fb50ba876b72ccada4a4c645a75
Instruction ID: c79d1643f58e45b0c7fa7090ce2ce54bb5aa39b4e9b73cef8586f3b83a8ec600
Opcode Fuzzy Hash: d30a8d5bf58b7253c1bbc91ec7bc620d472d6fb50ba876b72ccada4a4c645a75
Instruction Fuzzy Hash: 0FD012B1A0110CFF8B40EFA8E90195D77F9DB44205B1081E99409E3200DA355E04DB90

Function 069FF8EA Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f1c18e5a6189f81bcfb60c8ad809e7e4759d19064cbc5184d925a962b203dc0
Instruction ID: f93caf2abd56e0a25d9dee3304208b6723d4c1f69124339795a284bf58a6fe70
Opcode Fuzzy Hash: 0f1c18e5a6189f81bcfb60c8ad809e7e4759d19064cbc5184d925a962b203dc0
Instruction Fuzzy Hash: 38C012B37001200F47D47A5C701016D65D3C7C85A2359406EE60EC3388DD714C418740

Function 069F3721 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877d9a0ad8f829cce3e6586f6f41e21e942398e938f9bc70928324e18b226497
Instruction ID: 74e90c33072583cbf8106c90af3c637855300b63daca0ac6cea030d84d64fe9c
Opcode Fuzzy Hash: 877d9a0ad8f829cce3e6586f6f41e21e942398e938f9bc70928324e18b226497
Instruction Fuzzy Hash: 29C08C3214A3903FC71207202C05DE37E3A1BD2700F060187F3848A09382A20534DBF3

Function 069FDFD1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36cf734c3db0778b6900d9d95b9eb915dd76ef09413e951259d8547eba7adaab
Instruction ID: 351780aaa66c859ecdece4722ecf94604e23088d83c7c97ea2f7a341cd700269
Opcode Fuzzy Hash: 36cf734c3db0778b6900d9d95b9eb915dd76ef09413e951259d8547eba7adaab
Instruction Fuzzy Hash: 84B092676CB3805ED7120A289C0998A3A2A4BA7E2171400DFFA82DE0A6C211044B83A6

Non-executed Functions

Function 07BFA6F8 Relevance: 5.3, Strings: 4, Instructions: 268COMMON

Download Yara Rule

Strings

Haq, xrefs: 07BFA93B
Haq, xrefs: 07BFA96C
Haq, xrefs: 07BFA9E4
Haq, xrefs: 07BFA9B3

Memory Dump Source

Source File: 00000002.00000002.2188497513.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7bf0000_RegAsm.jbxd

Similarity

API ID:
String ID: Haq$Haq$Haq$Haq
API String ID: 0-3862180702
Opcode ID: 8b335ea1073efbfd52ef18125d28a8bf7e5246136743201dd325cf998635b8a8
Instruction ID: 852a2e2e8f9809a08bc213845e7cb735ed725193627e0fbdacd52a875637638b
Opcode Fuzzy Hash: 8b335ea1073efbfd52ef18125d28a8bf7e5246136743201dd325cf998635b8a8
Instruction Fuzzy Hash: 81A1B1B1B002128BDB199F79C4542BEBBF2EF86700F14C5B9D509EB291EB38D945CB90

Function 07BFE7D8 Relevance: 1.0, Instructions: 991COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2188497513.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7bf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ccd530c8de06304bcbff168ffb57b9eba0c65cc4616caec9ccc4103fed79fc8
Instruction ID: 05674fa8d124a17591c712b37201bb3b2263e48f7620d5a63717b01785265cd8
Opcode Fuzzy Hash: 0ccd530c8de06304bcbff168ffb57b9eba0c65cc4616caec9ccc4103fed79fc8
Instruction Fuzzy Hash: 8BA282B4A01229CFEB64DF68C984BDDBBB2BB48300F5482E5D509A7365D770AE85CF50

Function 069F6FE8 Relevance: .8, Instructions: 789COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5c55042524f07a528198ef4d742a7cca3d7023141ef454fdce1721d871c5d0b
Instruction ID: 6de3c91d268f52d0cb22ec78ebdf52edc71ef695bc870b023ca2d9afe6c03266
Opcode Fuzzy Hash: e5c55042524f07a528198ef4d742a7cca3d7023141ef454fdce1721d871c5d0b
Instruction Fuzzy Hash: AB6210B06002019FD789DF19D45871A7ADAEF85308F24C4AC910E8F3D6DBBADD0B8B95

Function 069F6FF8 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cde1cae94cf0aed9ab273b34bbbb8b1c97bbb0ab72e997e708fc09ea8bc2e05
Instruction ID: 664e67699a5119db4c24ff2aac99c69751b39d719b44fb941b753edf7767ded0
Opcode Fuzzy Hash: 5cde1cae94cf0aed9ab273b34bbbb8b1c97bbb0ab72e997e708fc09ea8bc2e05
Instruction Fuzzy Hash: C06220B06002019FD789DF19D45871A7ADAEF85308F24C4AC910E8F3D6DBBADD0B8B95

Function 055A0040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2182212393.00000000055A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f7a9c51c24626a51c1033f237901815cc6d19ce00dac647194103b6a6398359
Instruction ID: 3b81a0f59d619ff8ffe6ddce9af25824ad6f2d3e9284ed6b51e2629ef4a89c8d
Opcode Fuzzy Hash: 8f7a9c51c24626a51c1033f237901815cc6d19ce00dac647194103b6a6398359
Instruction Fuzzy Hash: F31285F04037468ED722EF66ED4C1897BB1BB86318F90421AD2656F2E9DBBC154ACF44

Function 0302DC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2173213662.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3020000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42003f1395fcd2a2d3357b5d73d43c3a1163866eab1a1935485326475cb549ef
Instruction ID: 132b707c4633b0198201c37f7b0db947e45147fe91226ceef2b852452ce00ef9
Opcode Fuzzy Hash: 42003f1395fcd2a2d3357b5d73d43c3a1163866eab1a1935485326475cb549ef
Instruction Fuzzy Hash: 6DA17E36E01626CFCF05DFB4C8405DEBBB2FF84300B2545AAE815AB265DB75E945CB80

Function 055A0006 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2182212393.00000000055A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_55a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31f624274b478df1a506a1643f8bd031ed6cb9d4275a41a0ddaa8c8bdce13d8e
Instruction ID: e4428269ea3e51df26275bf5914c2bc0d548577f19dc3aed947f6a2cec1c050b
Opcode Fuzzy Hash: 31f624274b478df1a506a1643f8bd031ed6cb9d4275a41a0ddaa8c8bdce13d8e
Instruction Fuzzy Hash: D6C105F08037468FD722EF26EC481897BB1BB86328F55421BD1616B2E9DBBC154ACF44

Function 07BFE7C9 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2188497513.0000000007BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7bf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201066634b6243acc48f030089af11ccc087a4f4841ea501c5a62b82805c6115
Instruction ID: e65b68f38a8c464610cd7391f550bb101983588df7b2347b1a7dee0253460f43
Opcode Fuzzy Hash: 201066634b6243acc48f030089af11ccc087a4f4841ea501c5a62b82805c6115
Instruction Fuzzy Hash: 774112B1D016589FEB18CFAAC9487DDFBF2AF88300F14C16AD508A7265DB745989CF50

Function 069FE2C7 Relevance: 46.6, Strings: 37, Instructions: 387COMMON

Download Yara Rule

Strings

DJj, xrefs: 069FE720
DJj, xrefs: 069FE658
DJj, xrefs: 069FE798
DJj, xrefs: 069FE6D0
DJj, xrefs: 069FE7EE
DJj, xrefs: 069FE40C
DJj, xrefs: 069FE543
DJj, xrefs: 069FE3E7
DJj, xrefs: 069FE748
DJj, xrefs: 069FE3C2
DJj, xrefs: 069FE56B
DJj, xrefs: 069FE630
DJj, xrefs: 069FE309
DJj, xrefs: 069FE39D
DJj, xrefs: 069FE819
DJj, xrefs: 069FE431
DJj, xrefs: 069FE608
DJj, xrefs: 069FE5BB
DJj, xrefs: 069FE378
DJj, xrefs: 069FE5E3
DJj, xrefs: 069FE680
DJj, xrefs: 069FE7C3
DJj, xrefs: 069FE32E
DJj, xrefs: 069FE4F3
DJj, xrefs: 069FE6F8
DJj, xrefs: 069FE844
DJj, xrefs: 069FE2E4
DJj, xrefs: 069FE456
DJj, xrefs: 069FE353
DJj, xrefs: 069FE593
DJj, xrefs: 069FE6A8
DJj, xrefs: 069FE47B
DJj, xrefs: 069FE4A3
DJj, xrefs: 069FE51B
DJj, xrefs: 069FE770
DJj, xrefs: 069FE4CB
DJj, xrefs: 069FE86F

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID: DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj
API String ID: 0-2673088322
Opcode ID: cc6b8fb3d3717a9597bee7eb0d6d3aaef4f5e7693db08c3f2d91bb8626791b22
Instruction ID: 4506470cad703a64eb5d4358f649681bab1c3b2f8924a2a3e901eaac0ada468d
Opcode Fuzzy Hash: cc6b8fb3d3717a9597bee7eb0d6d3aaef4f5e7693db08c3f2d91bb8626791b22
Instruction Fuzzy Hash: DCD1B1307006106BC7096AA5AC93E6DB257FBC6700B94483CD2294F7E9DFB96C1A87D6

Function 069FE2D8 Relevance: 46.6, Strings: 37, Instructions: 383COMMON

Download Yara Rule

Strings

DJj, xrefs: 069FE720
DJj, xrefs: 069FE658
DJj, xrefs: 069FE798
DJj, xrefs: 069FE6D0
DJj, xrefs: 069FE7EE
DJj, xrefs: 069FE40C
DJj, xrefs: 069FE543
DJj, xrefs: 069FE3E7
DJj, xrefs: 069FE748
DJj, xrefs: 069FE3C2
DJj, xrefs: 069FE56B
DJj, xrefs: 069FE630
DJj, xrefs: 069FE309
DJj, xrefs: 069FE39D
DJj, xrefs: 069FE819
DJj, xrefs: 069FE431
DJj, xrefs: 069FE608
DJj, xrefs: 069FE5BB
DJj, xrefs: 069FE378
DJj, xrefs: 069FE5E3
DJj, xrefs: 069FE680
DJj, xrefs: 069FE7C3
DJj, xrefs: 069FE32E
DJj, xrefs: 069FE4F3
DJj, xrefs: 069FE6F8
DJj, xrefs: 069FE844
DJj, xrefs: 069FE2E4
DJj, xrefs: 069FE456
DJj, xrefs: 069FE353
DJj, xrefs: 069FE593
DJj, xrefs: 069FE6A8
DJj, xrefs: 069FE47B
DJj, xrefs: 069FE4A3
DJj, xrefs: 069FE51B
DJj, xrefs: 069FE770
DJj, xrefs: 069FE4CB
DJj, xrefs: 069FE86F

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID: DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj
API String ID: 0-2673088322
Opcode ID: b29582576c47c473673e08be3f99cc7906511ee01a4a2f8a65ff98c1f5dc33f9
Instruction ID: 1357d9086c4299bd4e9e1002de8a8ab7f7f8f92c85895adf2d97dff949b346ca
Opcode Fuzzy Hash: b29582576c47c473673e08be3f99cc7906511ee01a4a2f8a65ff98c1f5dc33f9
Instruction Fuzzy Hash: D0D1A0307006106BC7096AA5AC93E6DB157FBCA700B94483CD2394F7E9DFB96C1A87D6

Function 069FCC7F Relevance: 16.4, Strings: 13, Instructions: 148COMMON

Download Yara Rule

Strings

DJj, xrefs: 069FCC9C
DJj, xrefs: 069FCDC4
DJj, xrefs: 069FCD30
DJj, xrefs: 069FCE33
DJj, xrefs: 069FCE58
DJj, xrefs: 069FCCC1
DJj, xrefs: 069FCCE6
DJj, xrefs: 069FCD55
DJj, xrefs: 069FCD0B
DJj, xrefs: 069FCD7A
DJj, xrefs: 069FCD9F
DJj, xrefs: 069FCDE9
DJj, xrefs: 069FCE0E

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID: DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj
API String ID: 0-2750564404
Opcode ID: 5b80d3edde7bdcab7ccbe933fac574881d5480cdb65854dcaa7b8a3caf4559d9
Instruction ID: 5b9f3a8a8331032a0f5aa76a66959273048a083cb23f8676be8d766da4445dd1
Opcode Fuzzy Hash: 5b80d3edde7bdcab7ccbe933fac574881d5480cdb65854dcaa7b8a3caf4559d9
Instruction Fuzzy Hash: AD41D2303002102FC7056EA5AC82E2D7657FBC6700B44493CE2294FBDACFBD6D1A879A

Function 069FCC90 Relevance: 16.4, Strings: 13, Instructions: 143COMMON

Download Yara Rule

Strings

DJj, xrefs: 069FCC9C
DJj, xrefs: 069FCDC4
DJj, xrefs: 069FCD30
DJj, xrefs: 069FCE33
DJj, xrefs: 069FCE58
DJj, xrefs: 069FCCC1
DJj, xrefs: 069FCCE6
DJj, xrefs: 069FCD55
DJj, xrefs: 069FCD0B
DJj, xrefs: 069FCD7A
DJj, xrefs: 069FCD9F
DJj, xrefs: 069FCDE9
DJj, xrefs: 069FCE0E

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID: DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj
API String ID: 0-2750564404
Opcode ID: 9c071757c71383f1551f15607a370cd23f859df4ab65f88ec906548cadfbcb6a
Instruction ID: 5da22d40719fcb672f968626b9b1be6be71560dbc3bd5a0bb61c3fdb33d9a4e9
Opcode Fuzzy Hash: 9c071757c71383f1551f15607a370cd23f859df4ab65f88ec906548cadfbcb6a
Instruction Fuzzy Hash: 3041A3303006106BD7056EA5AC82E2D765BFBC6700B54493CE2294FBD9CFBD6D19879A

Function 069FCED1 Relevance: 10.1, Strings: 8, Instructions: 101COMMON

Download Yara Rule

Strings

DJj, xrefs: 069FCF5B
DJj, xrefs: 069FCEEC
DJj, xrefs: 069FCFEF
DJj, xrefs: 069FCFCA
DJj, xrefs: 069FCF11
DJj, xrefs: 069FCF36
DJj, xrefs: 069FCF80
DJj, xrefs: 069FCFA5

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID: DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj
API String ID: 0-1413404143
Opcode ID: 59d657ce0b60d3fd61b7a4de7246a0f89b9545a897257d899a72de3fc96c56ab
Instruction ID: f1a768915a5fe8ac80187fb18ad14fed8d7e49283d40b098e952154d83be886b
Opcode Fuzzy Hash: 59d657ce0b60d3fd61b7a4de7246a0f89b9545a897257d899a72de3fc96c56ab
Instruction Fuzzy Hash: CA31B4307002112FC7066EA5AC82E3D7657FBC6700B54493CE2298FB99CFBD6D198796

Function 069FCEE0 Relevance: 10.1, Strings: 8, Instructions: 93COMMON

Download Yara Rule

Strings

DJj, xrefs: 069FCF5B
DJj, xrefs: 069FCEEC
DJj, xrefs: 069FCFEF
DJj, xrefs: 069FCFCA
DJj, xrefs: 069FCF11
DJj, xrefs: 069FCF36
DJj, xrefs: 069FCF80
DJj, xrefs: 069FCFA5

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID: DJj$DJj$DJj$DJj$DJj$DJj$DJj$DJj
API String ID: 0-1413404143
Opcode ID: 257ec437783a686371634d36f3dabf456ab619fccf52337b4f5db586af77c73d
Instruction ID: 710a6a37ad7f529f3e8688b77b6f25a56f99ffb6281f8214a55b693cec64bb7c
Opcode Fuzzy Hash: 257ec437783a686371634d36f3dabf456ab619fccf52337b4f5db586af77c73d
Instruction Fuzzy Hash: 892195307002112BC7056AA5AC82E3D755BFBC6700F94493CE2294FB99CFBD6C1987DA

Function 069FC968 Relevance: 8.8, Strings: 7, Instructions: 88COMMON

Download Yara Rule

Strings

DJj, xrefs: 069FCA7A
DJj, xrefs: 069FC9FF
DJj, xrefs: 069FC9AD
DJj, xrefs: 069FC9D6
DJj, xrefs: 069FC984
DJj, xrefs: 069FCA51
DJj, xrefs: 069FCA28

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID: DJj$DJj$DJj$DJj$DJj$DJj$DJj
API String ID: 0-2797143638
Opcode ID: cf468ff43288c56b4a68bae825c8070021a4255fdd19a675ce4c270c7ea7a61d
Instruction ID: 23a9766b4276584fbde24a183824fc332329f79112c1a2899f580dc8d0e2ebd8
Opcode Fuzzy Hash: cf468ff43288c56b4a68bae825c8070021a4255fdd19a675ce4c270c7ea7a61d
Instruction Fuzzy Hash: 8B31D6303012426BCB053FA5EC41D6D7B57FB9A700B184178E21A8F7E8CEB85D5ADB92

Function 069FC978 Relevance: 8.8, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

DJj, xrefs: 069FCA7A
DJj, xrefs: 069FC9FF
DJj, xrefs: 069FC9AD
DJj, xrefs: 069FC9D6
DJj, xrefs: 069FC984
DJj, xrefs: 069FCA51
DJj, xrefs: 069FCA28

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID: DJj$DJj$DJj$DJj$DJj$DJj$DJj
API String ID: 0-2797143638
Opcode ID: 19d8ea0af624bdfca9b76247645e0ff371e69c76d7c140448b4d8922b867dda2
Instruction ID: f2679586f8ce5d65665b98f5d70bf2cda3d407372670cc5246752e297d8eac9a
Opcode Fuzzy Hash: 19d8ea0af624bdfca9b76247645e0ff371e69c76d7c140448b4d8922b867dda2
Instruction Fuzzy Hash: EB21D8303011126BCB053FA5EC82C6D7B57FB9A700B544178E21A8F7A8CEBC5D5ADB92

Function 069FD538 Relevance: 7.6, Strings: 6, Instructions: 79COMMON

Download Yara Rule

Strings

DJj, xrefs: 069FD554
DJj, xrefs: 069FD60D
DJj, xrefs: 069FD5C3
DJj, xrefs: 069FD579
DJj, xrefs: 069FD59E
DJj, xrefs: 069FD5E8

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID: DJj$DJj$DJj$DJj$DJj$DJj
API String ID: 0-1343131794
Opcode ID: 51e42f2bd18d35c83a7b40737907056259408753424248008e3a28e1e4cae867
Instruction ID: 0215f7347a109fac4dede77b39c36b36455c24dfe97dc9a37ebada4834239e46
Opcode Fuzzy Hash: 51e42f2bd18d35c83a7b40737907056259408753424248008e3a28e1e4cae867
Instruction Fuzzy Hash: 3621F8307002102FC7066EA5AC92E2D6657EBC6700F444A3CD1298FB99CFBE5D1A87A6

Function 069FD548 Relevance: 7.6, Strings: 6, Instructions: 73COMMON

Download Yara Rule

Strings

DJj, xrefs: 069FD554
DJj, xrefs: 069FD60D
DJj, xrefs: 069FD5C3
DJj, xrefs: 069FD579
DJj, xrefs: 069FD59E
DJj, xrefs: 069FD5E8

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID: DJj$DJj$DJj$DJj$DJj$DJj
API String ID: 0-1343131794
Opcode ID: 1ed12baa697bb1b8fcbb582b59a61d26f8f16992828b6954be55c0be6eec2202
Instruction ID: a88410bf6564d28637d085cb6bbf8519580e1cc54353282834032ce9b493e5a3
Opcode Fuzzy Hash: 1ed12baa697bb1b8fcbb582b59a61d26f8f16992828b6954be55c0be6eec2202
Instruction Fuzzy Hash: 6611C9307002102FC7056EA5AC82E2DB65BEBC6700F50493CD2294FB99CFBE6D1987E6

Function 069FED10 Relevance: 5.2, Strings: 4, Instructions: 241COMMON

Download Yara Rule

Strings

(_]q, xrefs: 069FED7A
(_]q, xrefs: 069FEDF9
(_]q, xrefs: 069FEEFA
(_]q, xrefs: 069FEF79

Memory Dump Source

Source File: 00000002.00000002.2183385235.00000000069F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69f0000_RegAsm.jbxd

Similarity

API ID:
String ID: (_]q$(_]q$(_]q$(_]q
API String ID: 0-2651352888
Opcode ID: ab0b18b848b8588912f11eb7502a14464f95e60fb166ed85500976895b35f769
Instruction ID: a93708358b10c6b356f70d1b45505e39fa0b878abc49e21d18b8c1d850cfdb08
Opcode Fuzzy Hash: ab0b18b848b8588912f11eb7502a14464f95e60fb166ed85500976895b35f769
Instruction Fuzzy Hash: 8991BD74B04204AFDB45AF68C4545AE7BB2EFC6300F2584AAE906DF391EA35DD06CBD1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

C:\Users\user\AppData\Local\Temp\Tmp911D.tmp

C:\Users\user\AppData\Local\Temp\Tmp914D.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
file.exe

Function 02AF5249 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 028F0CA8 Relevance: 1.8, APIs: 1, Instructions: 284
COMMON

Function 028F04D8 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Function 07BFAA28 Relevance: 13.3, Strings: 10, Instructions: 762
COMMON

Function 07BF08A0 Relevance: 6.6, Strings: 5, Instructions: 392
COMMON

Function 069F3F50 Relevance: 3.0, Strings: 2, Instructions: 531
COMMON

Function 07BFFCD8 Relevance: 2.7, Strings: 2, Instructions: 201
COMMON

Function 07BFFCD5 Relevance: 2.7, Strings: 2, Instructions: 188
COMMON

Function 069D0D80 Relevance: 20.6, Strings: 16, Instructions: 618
COMMON

Function 069D1582 Relevance: 7.8, Strings: 6, Instructions: 338
COMMON