Edit tour

Windows Analysis Report
#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Overview

General Information

Sample name:	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe renamed because original name is a hash value
Original sample name:	11.12.2024.exe
Analysis ID:	1576072
MD5:	1edaba9f8d91ad001893722fe5c3ec3b
SHA1:	1bc10e6c9ba39c6dcce671e83479db4c22c3d00a
SHA256:	717a77357b194172da9212b29de15aa4405c3503dedddc2457dc97e196aedb93
Tags:	exeuser-adrian__luca
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected RedLine Stealer

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe (PID: 7300 cmdline: "C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe" MD5: 1EDABA9F8D91AD001893722FE5C3EC3B)

#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe (PID: 7468 cmdline: "C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe" MD5: 1EDABA9F8D91AD001893722FE5C3EC3B)

#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe (PID: 7476 cmdline: "C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe" MD5: 1EDABA9F8D91AD001893722FE5C3EC3B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["87.120.120.86:1912"], "Bot Id": "LOGS", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.1470193472.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1320945991.0000000003B69000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1320945991.0000000004783000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000004.00000002.1476017854.00000000032A0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe PID: 7300	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe PID: 7300	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe PID: 7476	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe PID: 7476	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.478c128.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.478c128.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
4.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T14:08:11.440191+0100	2043234	1	A Network Trojan was detected	87.120.120.86	1912	192.168.2.11	49709	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T14:08:10.983002+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49709	87.120.120.86	1912	TCP
2024-12-16T14:08:16.488182+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49709	87.120.120.86	1912	TCP
2024-12-16T14:08:20.426775+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49709	87.120.120.86	1912	TCP
2024-12-16T14:08:20.868039+0100	2043231	1	A Network Trojan was detected	192.168.2.11	49709	87.120.120.86	1912	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T14:08:16.883722+0100	2046056	1	A Network Trojan was detected	87.120.120.86	1912	192.168.2.11	49709	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T14:08:10.983002+0100	2046045	1	A Network Trojan was detected	192.168.2.11	49709	87.120.120.86	1912	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.1320945991.0000000004783000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": ["87.120.120.86:1912"], "Bot Id": "LOGS", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for submitted file

Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Joe Sandbox ML: detected

Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4x nop then jmp 08192453h	4_2_08192220
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4x nop then jmp 08190D0Dh	4_2_08190CEC
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4x nop then jmp 08194671h	4_2_08194659

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.11:49709 -> 87.120.120.86:1912
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.11:49709 -> 87.120.120.86:1912
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 87.120.120.86:1912 -> 192.168.2.11:49709
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 87.120.120.86:1912 -> 192.168.2.11:49709

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 87.120.120.86:1912

Source: global traffic

TCP traffic: 192.168.2.11:49709 -> 87.120.120.86:1912

Source: Joe Sandbox View

ASN Name: UNACS-AS-BG8000BurgasBG UNACS-AS-BG8000BurgasBG

Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.86

Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1470599338.00000000012BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purl.oen
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp, #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.000000000324A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp, #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.000000000324A000.00000004.00000800.00020000.00000000.sdmp, #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.000000000324A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000000.00000002.1320945991.0000000004783000.00000004.00000800.00020000.00000000.sdmp, #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000000.00000002.1320945991.0000000003B69000.00000004.00000800.00020000.00000000.sdmp, #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp, #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1470193472.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_00D0D74C	0_2_00D0D74C
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_0556CECC	0_2_0556CECC
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_0556E170	0_2_0556E170
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_05565060	0_2_05565060
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_0556CEC8	0_2_0556CEC8
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_05564AB0	0_2_05564AB0
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_05564AAA	0_2_05564AAA
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06BBB698	0_2_06BBB698
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06BB94AB	0_2_06BB94AB
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06BB5608	0_2_06BB5608
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06BB5606	0_2_06BB5606
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06BB7720	0_2_06BB7720
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06BB51C3	0_2_06BB51C3
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06BB6E48	0_2_06BB6E48
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06BB5A40	0_2_06BB5A40
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C66458	0_2_06C66458
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C655D9	0_2_06C655D9
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C642F0	0_2_06C642F0
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C6D280	0_2_06C6D280
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C6BC58	0_2_06C6BC58
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C6DB80	0_2_06C6DB80
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C64BA0	0_2_06C64BA0
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C6C648	0_2_06C6C648
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C6C638	0_2_06C6C638
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C63793	0_2_06C63793
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C68748	0_2_06C68748
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C68739	0_2_06C68739
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C68540	0_2_06C68540
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C68530	0_2_06C68530
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C642DF	0_2_06C642DF
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C64293	0_2_06C64293
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C6C241	0_2_06C6C241
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C6C250	0_2_06C6C250
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C6D270	0_2_06C6D270
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C66371	0_2_06C66371
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C67331	0_2_06C67331
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C6633A	0_2_06C6633A
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C67338	0_2_06C67338
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C65039	0_2_06C65039
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C6E120	0_2_06C6E120
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C6E130	0_2_06C6E130
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C6BF00	0_2_06C6BF00
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C6BF10	0_2_06C6BF10
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C6BC48	0_2_06C6BC48
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C68BA8	0_2_06C68BA8
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C6DB7E	0_2_06C6DB7E
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C6C820	0_2_06C6C820
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C689C8	0_2_06C689C8
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C689D8	0_2_06C689D8
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C6C9F9	0_2_06C6C9F9
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4_2_02F2DC74	4_2_02F2DC74
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4_2_0565EE58	4_2_0565EE58
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4_2_05658850	4_2_05658850
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4_2_05650040	4_2_05650040
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4_2_05650006	4_2_05650006
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4_2_05658840	4_2_05658840
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4_2_08190040	4_2_08190040
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4_2_081949E0	4_2_081949E0
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4_2_081932D0	4_2_081932D0
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4_2_08193D70	4_2_08193D70
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4_2_08190DA0	4_2_08190DA0
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4_2_08193730	4_2_08193730
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4_2_081977B8	4_2_081977B8
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4_2_081949CF	4_2_081949CF
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4_2_081932C0	4_2_081932C0
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4_2_08190D90	4_2_08190D90
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4_2_08193722	4_2_08193722

Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000000.00000002.1320945991.00000000043D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000000.00000002.1324251884.0000000006E50000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000000.00000000.1299466133.00000000006EE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameDahv.exe4 vs #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000000.00000002.1320945991.00000000047EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000000.00000002.1320945991.0000000004783000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000000.00000002.1325422670.000000000A3C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000000.00000002.1320945991.0000000003B69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1470193472.0000000000446000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Binary or memory string: OriginalFilenameDahv.exe4 vs #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, dDW1LF02XoC9q5fjGG.cs	Security API names: _0020.SetAccessControl
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, dDW1LF02XoC9q5fjGG.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, dDW1LF02XoC9q5fjGG.cs	Security API names: _0020.AddAccessRule
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, Tcg4fD9EiyEb1mLOcm.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, dDW1LF02XoC9q5fjGG.cs	Security API names: _0020.SetAccessControl
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, dDW1LF02XoC9q5fjGG.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, dDW1LF02XoC9q5fjGG.cs	Security API names: _0020.AddAccessRule
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, Tcg4fD9EiyEb1mLOcm.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/1@0/1

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Mutant created: NULL

Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

ReversingLabs: Detection: 68%

Source: unknown	Process created: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe "C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe"
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process created: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe "C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe"
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process created: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe "C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe"
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process created: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe "C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe"	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process created: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe "C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe"	Jump to behavior

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, dDW1LF02XoC9q5fjGG.cs	.Net Code: sDFyT6Umb3 System.Reflection.Assembly.Load(byte[])
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, dDW1LF02XoC9q5fjGG.cs	.Net Code: sDFyT6Umb3 System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_055642F8 push eax; iretd	0_2_05564321
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06BBCEC3 pushfd ; iretd	0_2_06BBCEC9
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06BB6E38 push ss; iretd	0_2_06BB6E3A
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06BBCCFB pushad ; iretw	0_2_06BBCCFD
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06BBCAA8 pushad ; iretd	0_2_06BBCAA9
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C6D047 push es; retf	0_2_06C6D048
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C6D04B push CC06C6CCh; retf	0_2_06C6D051
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 0_2_06C6E05B pushfd ; ret	0_2_06C6E061
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4_2_0565AA61 push 00000005h; ret	4_2_0565AA70
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Code function: 4_2_0565D442 push eax; ret	4_2_0565D451

Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Static PE information: section name: .text entropy: 7.7292642453168146

Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, TF8Zd83Bo31VTCSwxM.cs	High entropy of concatenated method names: 'vnQYsOYNy9', 'KVLYk7mAM8', 'dLKYhvmhFE', 'ToString', 'ebnYUEY8P4', 'Il1YGKcXdK', 'fnp1pg3c3iQJ5dBbxlS', 'pfSIr43rhMgAo63DCIP', 'mAxjWG3IiHrqKBP63KZ'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, L1B7607ONDylby8T6g.cs	High entropy of concatenated method names: 'H7SZxM6TIZ', 'buuZ4gdhEE', 'DCPbNKU7Ja', 'tE1bc4nsPC', 'knVbaol6Jn', 'vGdb39R3Jk', 'GBFbwrwTMd', 'Em6bI0dtYT', 'KVZbKbtyWi', 'xfdbnq4Yxs'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, BkMYk8GR983uAaY6oQ.cs	High entropy of concatenated method names: 'yr3AOSrpHu', 'PvkAJtyk4V', 'QqsAAnAl4R', 'BD4ALWJBDb', 'FrgApJ9qZ2', 'IRGAR5CUWC', 'Dispose', 'Kd5D1e9HGt', 'wI1DFj4kQ6', 'sQDDb4qofQ'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, kfVQvRsxBAmX482kwE.cs	High entropy of concatenated method names: 'ToString', 'aONdjFSufa', 'xNDdVjsxXg', 'cRqdNuRoEk', 'vOddcafmr3', 'EUPdaTAVJu', 'fi5d3HYi6L', 'lyjdwPfvS2', 'iF0dIpiuXI', 'jqIdKY8h56'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, lUqVK5UOGci6aE1qvE.cs	High entropy of concatenated method names: 'pXHJBNhN5J', 'VBoJqgFn2l', 'SYfDEkeDxX', 'u8BDCYKZkK', 'vYHJjDIeq5', 'ftgJ8LBgZ1', 'JeTJ5N4QQ7', 'uIqJH3BLfb', 'zxWJtiCT7P', 'osHJsJTVcb'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, St4tIVMteTExDuJRF0.cs	High entropy of concatenated method names: 'xJUYf4dmAg', 'pFCYFZN2jO', 'wXMYZJgsdP', 'CLLYuV5uDH', 'r9tY04waPU', 'RLwZhladpM', 'yhBZUgtOtQ', 'KZ1ZGstBot', 'dy3ZB64ysW', 'Ha4ZPV2uCF'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, KMM71TCy30IpbrGmWYt.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'MYovAbRZ4x', 'xtmviH3FRU', 'zZpvLNsfVl', 'x9pvv4paQY', 'TX0vpO0CJe', 'MAjvedLLi7', 'qpqvRowKTW'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, fKp7w9mlmS8NVDuo7w.cs	High entropy of concatenated method names: 'jeIbSfmaUT', 'MfJbWuriMo', 'A4mb9OGwpg', 'dTUbmnPZ5F', 'WU8bOAvjt6', 'UGGbdHkfdF', 'YuNbJTMFbW', 'fKwbDHPAHj', 'TOFbAjI0K8', 'agAbidKEJJ'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, f245yVXgGWalDkBZ4r.cs	High entropy of concatenated method names: 'aQqTeQyS7', 'TjgS82tZv', 'vPXWlKRWx', 'xU54Ei7rv', 'yJWmRJm9H', 'jW57y9U66', 'Kmqx3pIoEgNiILXfd2', 'STq8BUcMfJpn757wpF', 'LU2DWtZSL', 'K6TiUry5Y'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, uGsfYozkvYiWUDlun9.cs	High entropy of concatenated method names: 'qRUiWrGV9w', 'xFfi9ggLQY', 'jGPimAyuNO', 'ODhiM695tK', 'mN2iVA14vm', 'cO0icrVa6n', 'Y3AialqKDh', 'RqjiRvYd19', 'SeJigXyS4t', 'cQAilPduSe'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, Klmmkj5aaF7sCwwumg.cs	High entropy of concatenated method names: 'PU269lNLvs', 'RZA6mTRXob', 'nCw6M6AeIc', 'sNG6VTLstT', 'lDl6cLh4bw', 'RrL6atSNq5', 'ttE6watYWl', 'oMn6IqAyCu', 'E8q6n66DmF', 'cGi6joEZXr'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, dDW1LF02XoC9q5fjGG.cs	High entropy of concatenated method names: 'peSofwJyQF', 'TMQo1DiE9N', 'LKhoFMkgEB', 'g8GobX2xSf', 'PSXoZUB5FE', 'WX3oY9oktX', 'w5Touwd7P0', 'S3Yo02sOvD', 'NDLo2n6mX8', 'pUAorYOpXC'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, lVMhJgCXY6pmsZO50lm.cs	High entropy of concatenated method names: 'ToString', 'PO8L90gtNy', 'DafLmTpxpc', 'iLxL7vrWRW', 'Up9LMxhrpP', 'ob3LVg16RR', 'QgMLNqqZeX', 'u4ALcEqXGV', 'XnOcUsMlGt76BC0nDCD', 'XSbkxkMe46bx1qlUwAp'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, Tcg4fD9EiyEb1mLOcm.cs	High entropy of concatenated method names: 'facFHYbm32', 'zEqFteDRYs', 'stoFsQyCND', 'K9JFkViIru', 'eZ7FhOTayH', 'FDOFUFDDLA', 'QToFGfniiX', 'zReFBYf3rI', 'kvTFPgM8Sb', 'CPSFq1e1tV'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, ercLL1wOUFkZuencyt.cs	High entropy of concatenated method names: 'fHeu1D305i', 'aUMubSgjul', 'BU5uYyLPar', 'DA4Yq9j6B5', 'QwXYzUWcgJ', 'zDauEvYS8w', 'KLCuCkqW4q', 'SImuXea4RI', 'K1fuox0aBB', 'fiFuy0Qn6n'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, WmKC83VwcNtx1Ueiel.cs	High entropy of concatenated method names: 'N6q9e83ku2DYVVtpOHg', 'aBMjXl30WRIdribQNKp', 'Nw5YDf5c51', 'HONYAUGYeZ', 'yNkYi8IccM', 'rKOG523mcfs9y09gB2D', 'EuNppr3t6frDPPC7Bc6', 'pdh9X73GBZFffJ0SIwM'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, k7qlpRCEDugtlWdIrLL.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'y0nijZceji', 'Kiqi8JkbFV', 'MyOi5koexW', 'DdqiH3nXhF', 'hjTityCoNB', 'SptisnTAb1', 'xBqikLXRPu'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, wa43RMCCZUnCudQOc4A.cs	High entropy of concatenated method names: 'l3iiq7xts6', 'Wk5izYUAZ1', 'v8qLEILu0p', 'VMgLCfZqQQ', 'TkOLX9ENRo', 'vtjLobdG9l', 'yhoLyfEFbB', 'WPBLfwo1rH', 'DJXL1GgCpt', 'GTdLF5Hodl'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, D8AnSFKRX8s4l6TgC4.cs	High entropy of concatenated method names: 'KRHugsrmQw', 'Wi9ulnNwV7', 'Ou2uT1FG8g', 'SmtuSLgXw4', 'jhDuxPHRkY', 'vLiuW8ITv6', 'K01u4xGns4', 'vJJu9n7SZh', 'liUum5nF5Y', 'uZAu7E2R9e'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, KeWauMPGbecEnuvVG4.cs	High entropy of concatenated method names: 'y3wAMYPE5U', 'JnJAVooTjM', 'LorANwNu14', 'wccAciCPY9', 'iLeAaE5LAB', 'iPjA3OLccd', 'VBnAw6VloL', 'xYwAIVWckN', 'jWVAK4wP8a', 'T4aAnrEYul'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, lATcx2yfTGXsZ86JZQ.cs	High entropy of concatenated method names: 'QmkCucg4fD', 'aiyC0Eb1mL', 'DlmCrS8NVD', 'jo7CQwI1B7', 'd8TCO6gtt4', 'RIVCdteTEx', 'zdGSvDA8aVHnkYApdt', 'soJssn44rMNpP4FOxm', 'UOVCCTkYJe', 'bi0Coc17iG'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, AM0NM7HoRiQpNfhHxf.cs	High entropy of concatenated method names: 'i2AOnCIyUv', 'bJNO81IhXn', 'o7nOHKm5FB', 'bFbOtUiQ5P', 'NWXOVDOa4N', 'OtdONI4hv9', 'srbOc3uBm3', 'eIBOaJchEQ', 'HCPO3Z8bkF', 'f7uOwN0rEQ'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, wVclCxFw43B2sapMI1.cs	High entropy of concatenated method names: 'Dispose', 'P3uCPAaY6o', 'QivXVEACOS', 'mHLZn8sHbW', 'nFhCq1iShB', 'Y69Czd4CmQ', 'ProcessDialogKey', 'v53XEeWauM', 'VbeXCcEnuv', 'HG4XXiM2QD'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, nZfxsJkDltaZSCCFPH.cs	High entropy of concatenated method names: 'tvmJrvgX7M', 'nt3JQGMG46', 'ToString', 'pDtJ105lqu', 'tqXJF2PHcf', 'gJYJbEO4yQ', 'i0lJZJb9NO', 'P6sJYuYQ43', 'kTFJuGSZhZ', 'BAfJ0QdAI1'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.a3c0000.3.raw.unpack, sM2QD1qyjWDaunQ57P.cs	High entropy of concatenated method names: 'QNFibqn8Tp', 'FQTiZgMET6', 'XemiYG30qQ', 'LkfiuOX48c', 'NQKiATw2Hm', 'R62i0CD50I', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, TF8Zd83Bo31VTCSwxM.cs	High entropy of concatenated method names: 'vnQYsOYNy9', 'KVLYk7mAM8', 'dLKYhvmhFE', 'ToString', 'ebnYUEY8P4', 'Il1YGKcXdK', 'fnp1pg3c3iQJ5dBbxlS', 'pfSIr43rhMgAo63DCIP', 'mAxjWG3IiHrqKBP63KZ'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, L1B7607ONDylby8T6g.cs	High entropy of concatenated method names: 'H7SZxM6TIZ', 'buuZ4gdhEE', 'DCPbNKU7Ja', 'tE1bc4nsPC', 'knVbaol6Jn', 'vGdb39R3Jk', 'GBFbwrwTMd', 'Em6bI0dtYT', 'KVZbKbtyWi', 'xfdbnq4Yxs'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, BkMYk8GR983uAaY6oQ.cs	High entropy of concatenated method names: 'yr3AOSrpHu', 'PvkAJtyk4V', 'QqsAAnAl4R', 'BD4ALWJBDb', 'FrgApJ9qZ2', 'IRGAR5CUWC', 'Dispose', 'Kd5D1e9HGt', 'wI1DFj4kQ6', 'sQDDb4qofQ'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, kfVQvRsxBAmX482kwE.cs	High entropy of concatenated method names: 'ToString', 'aONdjFSufa', 'xNDdVjsxXg', 'cRqdNuRoEk', 'vOddcafmr3', 'EUPdaTAVJu', 'fi5d3HYi6L', 'lyjdwPfvS2', 'iF0dIpiuXI', 'jqIdKY8h56'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, lUqVK5UOGci6aE1qvE.cs	High entropy of concatenated method names: 'pXHJBNhN5J', 'VBoJqgFn2l', 'SYfDEkeDxX', 'u8BDCYKZkK', 'vYHJjDIeq5', 'ftgJ8LBgZ1', 'JeTJ5N4QQ7', 'uIqJH3BLfb', 'zxWJtiCT7P', 'osHJsJTVcb'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, St4tIVMteTExDuJRF0.cs	High entropy of concatenated method names: 'xJUYf4dmAg', 'pFCYFZN2jO', 'wXMYZJgsdP', 'CLLYuV5uDH', 'r9tY04waPU', 'RLwZhladpM', 'yhBZUgtOtQ', 'KZ1ZGstBot', 'dy3ZB64ysW', 'Ha4ZPV2uCF'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, KMM71TCy30IpbrGmWYt.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'MYovAbRZ4x', 'xtmviH3FRU', 'zZpvLNsfVl', 'x9pvv4paQY', 'TX0vpO0CJe', 'MAjvedLLi7', 'qpqvRowKTW'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, fKp7w9mlmS8NVDuo7w.cs	High entropy of concatenated method names: 'jeIbSfmaUT', 'MfJbWuriMo', 'A4mb9OGwpg', 'dTUbmnPZ5F', 'WU8bOAvjt6', 'UGGbdHkfdF', 'YuNbJTMFbW', 'fKwbDHPAHj', 'TOFbAjI0K8', 'agAbidKEJJ'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, f245yVXgGWalDkBZ4r.cs	High entropy of concatenated method names: 'aQqTeQyS7', 'TjgS82tZv', 'vPXWlKRWx', 'xU54Ei7rv', 'yJWmRJm9H', 'jW57y9U66', 'Kmqx3pIoEgNiILXfd2', 'STq8BUcMfJpn757wpF', 'LU2DWtZSL', 'K6TiUry5Y'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, uGsfYozkvYiWUDlun9.cs	High entropy of concatenated method names: 'qRUiWrGV9w', 'xFfi9ggLQY', 'jGPimAyuNO', 'ODhiM695tK', 'mN2iVA14vm', 'cO0icrVa6n', 'Y3AialqKDh', 'RqjiRvYd19', 'SeJigXyS4t', 'cQAilPduSe'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, Klmmkj5aaF7sCwwumg.cs	High entropy of concatenated method names: 'PU269lNLvs', 'RZA6mTRXob', 'nCw6M6AeIc', 'sNG6VTLstT', 'lDl6cLh4bw', 'RrL6atSNq5', 'ttE6watYWl', 'oMn6IqAyCu', 'E8q6n66DmF', 'cGi6joEZXr'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, dDW1LF02XoC9q5fjGG.cs	High entropy of concatenated method names: 'peSofwJyQF', 'TMQo1DiE9N', 'LKhoFMkgEB', 'g8GobX2xSf', 'PSXoZUB5FE', 'WX3oY9oktX', 'w5Touwd7P0', 'S3Yo02sOvD', 'NDLo2n6mX8', 'pUAorYOpXC'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, lVMhJgCXY6pmsZO50lm.cs	High entropy of concatenated method names: 'ToString', 'PO8L90gtNy', 'DafLmTpxpc', 'iLxL7vrWRW', 'Up9LMxhrpP', 'ob3LVg16RR', 'QgMLNqqZeX', 'u4ALcEqXGV', 'XnOcUsMlGt76BC0nDCD', 'XSbkxkMe46bx1qlUwAp'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, Tcg4fD9EiyEb1mLOcm.cs	High entropy of concatenated method names: 'facFHYbm32', 'zEqFteDRYs', 'stoFsQyCND', 'K9JFkViIru', 'eZ7FhOTayH', 'FDOFUFDDLA', 'QToFGfniiX', 'zReFBYf3rI', 'kvTFPgM8Sb', 'CPSFq1e1tV'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, ercLL1wOUFkZuencyt.cs	High entropy of concatenated method names: 'fHeu1D305i', 'aUMubSgjul', 'BU5uYyLPar', 'DA4Yq9j6B5', 'QwXYzUWcgJ', 'zDauEvYS8w', 'KLCuCkqW4q', 'SImuXea4RI', 'K1fuox0aBB', 'fiFuy0Qn6n'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, WmKC83VwcNtx1Ueiel.cs	High entropy of concatenated method names: 'N6q9e83ku2DYVVtpOHg', 'aBMjXl30WRIdribQNKp', 'Nw5YDf5c51', 'HONYAUGYeZ', 'yNkYi8IccM', 'rKOG523mcfs9y09gB2D', 'EuNppr3t6frDPPC7Bc6', 'pdh9X73GBZFffJ0SIwM'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, k7qlpRCEDugtlWdIrLL.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'y0nijZceji', 'Kiqi8JkbFV', 'MyOi5koexW', 'DdqiH3nXhF', 'hjTityCoNB', 'SptisnTAb1', 'xBqikLXRPu'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, wa43RMCCZUnCudQOc4A.cs	High entropy of concatenated method names: 'l3iiq7xts6', 'Wk5izYUAZ1', 'v8qLEILu0p', 'VMgLCfZqQQ', 'TkOLX9ENRo', 'vtjLobdG9l', 'yhoLyfEFbB', 'WPBLfwo1rH', 'DJXL1GgCpt', 'GTdLF5Hodl'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, D8AnSFKRX8s4l6TgC4.cs	High entropy of concatenated method names: 'KRHugsrmQw', 'Wi9ulnNwV7', 'Ou2uT1FG8g', 'SmtuSLgXw4', 'jhDuxPHRkY', 'vLiuW8ITv6', 'K01u4xGns4', 'vJJu9n7SZh', 'liUum5nF5Y', 'uZAu7E2R9e'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, KeWauMPGbecEnuvVG4.cs	High entropy of concatenated method names: 'y3wAMYPE5U', 'JnJAVooTjM', 'LorANwNu14', 'wccAciCPY9', 'iLeAaE5LAB', 'iPjA3OLccd', 'VBnAw6VloL', 'xYwAIVWckN', 'jWVAK4wP8a', 'T4aAnrEYul'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, lATcx2yfTGXsZ86JZQ.cs	High entropy of concatenated method names: 'QmkCucg4fD', 'aiyC0Eb1mL', 'DlmCrS8NVD', 'jo7CQwI1B7', 'd8TCO6gtt4', 'RIVCdteTEx', 'zdGSvDA8aVHnkYApdt', 'soJssn44rMNpP4FOxm', 'UOVCCTkYJe', 'bi0Coc17iG'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, AM0NM7HoRiQpNfhHxf.cs	High entropy of concatenated method names: 'i2AOnCIyUv', 'bJNO81IhXn', 'o7nOHKm5FB', 'bFbOtUiQ5P', 'NWXOVDOa4N', 'OtdONI4hv9', 'srbOc3uBm3', 'eIBOaJchEQ', 'HCPO3Z8bkF', 'f7uOwN0rEQ'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, wVclCxFw43B2sapMI1.cs	High entropy of concatenated method names: 'Dispose', 'P3uCPAaY6o', 'QivXVEACOS', 'mHLZn8sHbW', 'nFhCq1iShB', 'Y69Czd4CmQ', 'ProcessDialogKey', 'v53XEeWauM', 'VbeXCcEnuv', 'HG4XXiM2QD'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, nZfxsJkDltaZSCCFPH.cs	High entropy of concatenated method names: 'tvmJrvgX7M', 'nt3JQGMG46', 'ToString', 'pDtJ105lqu', 'tqXJF2PHcf', 'gJYJbEO4yQ', 'i0lJZJb9NO', 'P6sJYuYQ43', 'kTFJuGSZhZ', 'BAfJ0QdAI1'
Source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.46226c8.1.raw.unpack, sM2QD1qyjWDaunQ57P.cs	High entropy of concatenated method names: 'QNFibqn8Tp', 'FQTiZgMET6', 'XemiYG30qQ', 'LkfiuOX48c', 'NQKiATw2Hm', 'R62i0CD50I', 'Next', 'Next', 'Next', 'NextBytes'

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe PID: 7300, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Memory allocated: D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Memory allocated: 2B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Memory allocated: 29B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Memory allocated: 7880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Memory allocated: 8880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Memory allocated: 8A30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Memory allocated: 9A30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Memory allocated: A450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Memory allocated: B450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Memory allocated: C450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Memory allocated: 2EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Memory allocated: 3110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Memory allocated: 2F60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Window / User API: threadDelayed 892			Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Window / User API: threadDelayed 3731			Jump to behavior

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe TID: 7320	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe TID: 7752	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe TID: 7500	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696503903~
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696503903
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696503903
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696503903o
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696503903z
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696503903}
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696503903h
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903x
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696503903]
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696503903u
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.0000000004245000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696503903\|UE
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696503903}
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696503903t
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696503903n
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696503903
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696503903
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696503903z
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696503903p
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696503903n
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696503903s
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696503903p
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696503903~
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696503903
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696503903
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696503903d
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696503903o
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696503903j
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696503903f
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696503903
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696503903t
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696503903t
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696503903s
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696503903x
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696503903f
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696503903
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903^
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696503903x
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696503903x
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696503903x
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696503903
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696503903h
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696503903
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696503903
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696503903u
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696503903
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696503903\|UE
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696503903
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903^
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903}
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1470697223.0000000001423000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696503903]
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903x
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696503903
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696503903
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696503903
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696503903d
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696503903
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696503903t
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1480775618.000000000427A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696503903
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696503903j
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903}
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000034F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Memory written: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process created: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe "C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe"			Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Process created: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe "C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe"			Jump to behavior

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Queries volume information: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Queries volume information: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.478c128.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.478c128.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1470193472.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1320945991.0000000003B69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1320945991.0000000004783000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe PID: 7476, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000032A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\walletsLR_q
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000032A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $_q1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.000000000328E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1490273140.00000000065B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\.jsonf'$
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000032A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR_q
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1490273140.00000000065B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\.jsonf'$
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000032A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $_q%appdata%`,_qdC:\Users\user\AppData\Roaming`,_qdC:\Users\user\AppData\Roaming\Binance
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000032A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR_q
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000032A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $_q&%localappdata%\Coinomi\Coinomi\walletsLR_q,A
Source: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000032A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $_q5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1476017854.00000000032A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe PID: 7476, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.478c128.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.478c128.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1470193472.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1320945991.0000000003B69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1320945991.0000000004783000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe PID: 7476, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.Leonem
#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe	100%	Joe Sandbox ML

Name	Source	Malicious	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23ResponseD	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.000000000324A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12Response	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id2Response	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp, #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21Response	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id4	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id7	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://purl.oen	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1470599338.00000000012BE000.00000004.00000020.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19Response	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15Response	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6Response	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ip.sb/ip	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000000.00000002.1320945991.0000000004783000.00000004.00000800.00020000.00000000.sdmp, #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000000.00000002.1320945991.0000000003B69000.00000004.00000800.00020000.00000000.sdmp, #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp, #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1470193472.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/sc	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1ResponseD	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9Response	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id20	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id22	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24Response	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1Response	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id11	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16Response	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id13	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id14	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id17	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id18	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5Response	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10Response	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8Response	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/envelope/	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id3ResponseD	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.000000000324A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23Response	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.0000000003111000.00000004.00000800.00020000.00000000.sdmp, #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/D	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe, 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
87.120.120.86	unknown	Bulgaria		25206	UNACS-AS-BG8000BurgasBG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576072
Start date and time:	2024-12-16 14:07:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe renamed because original name is a hash value
Original Sample Name:	11.12.2024.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 72 Number of non-executed functions: 33
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 23.218.208.109, 4.175.87.197
Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Simulations

Behavior and APIs

Time	Type	Description
08:08:02	API Interceptor	27x Sleep call for process: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
87.120.120.86	po4877383.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNACS-AS-BG8000BurgasBG	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	87.120.127.228
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, Vidar, XWorm, Xmrig	Browse	87.120.127.228
	9coH9ASP3h.exe	Get hash	malicious	AveMaria, UACMe	Browse	87.120.121.160
	Estado.de.cuenta.xls	Get hash	malicious	AveMaria, UACMe	Browse	87.120.121.160
	https://0388net.cc	Get hash	malicious	Unknown	Browse	87.120.125.144
	https://0388net.cc	Get hash	malicious	Unknown	Browse	87.120.125.144
	tqkdMdv2zO.doc	Get hash	malicious	XenoRAT	Browse	87.120.121.160
	file.exe	Get hash	malicious	AveMaria, UACMe	Browse	87.120.121.160
	uRxH0oSpKL.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse	87.120.121.160
	Estado.de.cuenta.xls	Get hash	malicious	AveMaria, UACMe	Browse	87.120.121.160

Process:	C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.719380943526991
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe
File size:	901'120 bytes
MD5:	1edaba9f8d91ad001893722fe5c3ec3b
SHA1:	1bc10e6c9ba39c6dcce671e83479db4c22c3d00a
SHA256:	717a77357b194172da9212b29de15aa4405c3503dedddc2457dc97e196aedb93
SHA512:	4a050691f669fc3285da0dd8a01c7c2243cc969e84539e5df337860b5f07c34026708d4bc8bb6982abfcec5b5471f493c94b24b1e94af6a66af37c67181e9758
SSDEEP:	24576:tMaciw+uNtabUA/F9bXtFRF+z84My9GrkiTVqgooDmMV:tRciw+uibUKZ9FRM8QsjD9V
TLSH:	5815D0C03B3AB702DE6CB9348536EDBC62591E68B00478E3AEDD3B5776991139A0DF44
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?Yg..............0.................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	32642092d4f29244

Static PE Info

General

Entrypoint:	0x4dc596
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67593F0B [Wed Dec 11 07:28:11 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
push ebx
add byte ptr [ecx+00h], bh
jnc 00007F59548DF702h
je 00007F59548DF702h
add byte ptr [ebp+00h], ch
add byte ptr [edx+00h], dl
add byte ptr [esi+00h], ah
insb
add byte ptr [ebp+00h], ah
arpl word ptr [eax], ax
je 00007F59548DF702h
imul eax, dword ptr [eax], 006E006Fh
add byte ptr [ecx+00h], al
jnc 00007F59548DF702h
jnc 00007F59548DF702h
add byte ptr [ebp+00h], ch
bound eax, dword ptr [eax]
insb
add byte ptr [ecx+00h], bh
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
add byte ptr [edi+00h], ch
popad
add byte ptr [eax+eax+00h], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xdc544	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xde000	0x14a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xda5dc	0xda600	492eb4b5ebc2e76862629f48e459ecce	False	0.8871547653119634	data	7.7292642453168146	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xde000	0x14a8	0x1600	ab6fe1d307969a86c7e19393b4804928	False	0.36487926136363635	data	4.861695082225112	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe0000	0xc	0x200	e89a7be98e0e2265070550f62c71d5b9	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xde118	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.3726547842401501
RT_GROUP_ICON	0xdf1c0	0x14	data	1.1
RT_GROUP_ICON	0xdf1d4	0x14	data	1.05
RT_VERSION	0xdf1e8	0x2be	data	0.4672364672364672

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T14:08:10.983002+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49709	87.120.120.86	1912	TCP
2024-12-16T14:08:10.983002+0100	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.11	49709	87.120.120.86	1912	TCP
2024-12-16T14:08:11.440191+0100	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	87.120.120.86	1912	192.168.2.11	49709	TCP
2024-12-16T14:08:16.488182+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49709	87.120.120.86	1912	TCP
2024-12-16T14:08:16.883722+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	87.120.120.86	1912	192.168.2.11	49709	TCP
2024-12-16T14:08:20.426775+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49709	87.120.120.86	1912	TCP
2024-12-16T14:08:20.868039+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.11	49709	87.120.120.86	1912	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 14:08:09.467008114 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:09.634052992 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:09.634155035 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:09.651900053 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:09.772037029 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:10.882627964 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:10.936947107 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:10.983001947 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:11.102843046 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:11.440191031 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:11.483802080 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:16.488182068 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:16.607944012 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:16.883495092 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:16.883570910 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:16.883584976 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:16.883641005 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:16.883722067 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:16.883735895 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:16.883779049 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:18.861124039 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:18.981125116 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:18.981209040 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:18.981271029 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:18.981282949 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:18.981295109 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:18.981343985 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:18.981348038 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:18.981354952 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:18.981404066 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:18.981450081 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:18.981472015 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:18.981502056 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:18.981529951 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:18.981555939 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:18.981587887 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:18.981606007 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:18.981646061 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.103141069 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.103169918 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.103229046 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.103255033 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.103285074 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.103293896 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.103322983 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.103346109 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.105886936 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.105948925 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.105981112 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.106040001 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.107367039 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.107412100 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.107419968 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.107434988 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.107465982 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.107489109 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.108969927 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.109030962 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.109081030 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.109128952 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.110610008 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.110682011 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.223072052 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.223115921 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.223154068 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.223181963 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.223239899 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.223303080 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.223330021 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.223340988 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.223395109 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.225789070 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.225845098 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.225872040 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.225918055 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.225923061 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.225961924 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.227149010 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.227199078 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.227216959 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.227262974 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.227356911 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.227401972 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.227435112 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.227443933 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.227485895 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.227494955 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.227588892 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.227639914 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.227674961 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.227726936 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.228776932 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.228787899 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.228836060 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.228856087 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.228879929 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.228899002 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.228924036 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.228946924 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.228982925 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.228996992 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.229024887 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.229083061 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.229094982 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.229134083 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.230421066 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.230463028 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.230469942 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.230501890 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.230530977 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.230540991 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.230581045 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.343372107 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.343452930 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.343601942 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.343647957 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.343666077 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.343671083 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.343683958 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.343720913 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.343734026 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.343772888 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.343781948 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.343811035 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.343858004 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.343869925 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.343904018 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.343916893 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.343955994 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.343996048 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.344006062 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.344043970 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.344131947 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.344149113 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.344409943 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.344459057 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.344638109 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.344690084 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.344969988 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.345098019 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.345207930 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.345216990 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.345762968 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.345829010 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.345942020 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.345952034 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.346065998 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.346077919 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.346254110 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.346263885 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.346328020 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.346951962 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.347042084 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.347171068 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.347207069 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.347332954 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.347408056 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.347543001 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.347630978 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.347757101 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.347765923 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.347875118 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.347887039 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.347932100 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.347949028 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.348129988 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.348215103 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.348226070 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.348414898 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.348426104 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.348464966 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.348659039 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.348671913 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.348817110 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.348848104 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.349023104 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.349031925 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.349170923 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.349194050 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.349343061 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.349386930 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.349508047 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.349529982 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.349757910 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.349766970 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.349895000 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.349904060 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.350564003 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.350573063 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.350589991 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.350600004 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.350622892 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.350631952 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.350641012 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.350651026 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.463613033 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.463630915 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.463939905 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.463949919 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.464174986 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.464184999 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.464365959 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.464378119 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.464577913 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.464587927 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.464757919 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.464776039 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.464915037 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.464932919 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.465013981 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.465056896 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.465172052 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.465197086 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.465321064 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.465370893 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.465756893 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.465843916 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.468092918 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.468126059 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.468141079 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.468178988 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.468310118 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.468375921 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.468447924 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.468528986 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.468669891 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.468750000 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.468884945 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.468959093 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.469156027 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.469176054 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.469255924 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.469273090 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.469356060 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.469369888 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.469508886 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.469537973 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.469643116 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.469698906 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.469775915 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.469882011 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.469995975 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.470077991 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.470154047 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.470176935 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.470254898 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.470380068 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.470480919 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.470494032 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.470571041 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.470582962 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.470675945 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.470685959 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.470798969 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.470865965 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.471005917 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.471029997 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.471102953 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.471126080 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.471236944 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.471292019 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.471396923 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.471441031 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.471569061 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.471581936 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.471710920 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.471750021 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.471880913 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.471894979 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.472012997 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.472243071 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.472618103 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.472672939 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.585938931 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.585969925 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.585982084 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.585994959 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.586023092 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.586036921 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.586049080 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.586061954 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.586075068 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.586088896 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.586112022 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.586127043 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.586183071 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.586198092 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.586286068 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.586483002 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.586499929 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.586539984 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.586627960 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.586658955 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.586767912 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.586781979 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.586937904 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.586951017 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.587084055 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.587100029 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.587198973 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.587219954 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.587280035 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.587321997 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.587337971 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.587399960 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.587492943 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.587516069 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.587649107 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.587693930 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.587842941 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.587857962 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.587938070 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.587950945 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.587984085 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.587996960 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.588109970 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.588120937 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.588320971 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.588444948 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.588534117 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.588543892 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.588660002 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.588705063 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.588855982 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.588866949 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.589355946 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.589411020 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.589849949 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.589942932 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.592389107 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.592422962 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.592459917 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.592482090 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.592557907 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.592719078 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.592731953 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.592753887 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.592832088 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.593044043 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.593055010 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.593082905 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.593152046 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.593209982 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.593235016 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.593389034 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.593444109 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.593472958 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.593482971 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.593518019 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.593528032 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.593631983 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.593648911 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.593904018 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.593914986 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.593926907 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.593941927 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.594007969 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.594180107 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.594326019 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.594427109 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.594438076 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.594517946 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.594528913 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.594635010 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.594661951 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.594773054 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.594824076 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.594958067 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.594966888 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.595149994 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.595175982 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.595308065 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.595365047 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.595473051 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.595495939 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.595609903 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.595647097 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.595762014 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.595793009 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.595899105 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.595987082 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.596142054 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.596163034 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.596530914 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.596609116 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.709903955 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.709934950 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.710021019 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.710032940 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.710153103 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.710264921 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.710360050 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.710396051 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.710556984 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.710606098 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.710666895 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.710684061 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.710738897 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.710815907 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.710884094 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.710913897 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.711210966 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.711221933 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.711389065 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.711514950 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.711592913 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.711709976 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.711733103 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.711745977 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.711930037 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.711941004 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.712068081 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.712151051 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.712277889 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.712354898 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.712404013 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.712451935 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.712583065 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.712645054 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.712728977 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.712778091 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.713022947 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.713064909 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.713265896 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.713289976 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.713409901 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.713439941 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.713490009 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.713550091 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.713758945 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.713838100 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.713937998 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.713956118 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.714138031 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.714175940 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.714431047 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.714452982 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.714598894 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.714610100 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.714929104 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.715020895 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.716485023 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.716495991 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.716506004 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.716579914 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.716644049 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.716654062 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.716707945 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.716749907 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.716856956 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.716897964 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.716980934 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.717019081 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.717195034 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.717209101 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.717295885 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.717307091 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.717380047 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.717469931 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.717586040 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.717619896 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.717768908 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.717792034 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.717896938 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.717906952 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.717986107 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.718022108 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.718261957 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.718286037 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.718381882 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.718391895 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.718404055 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.718441010 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.718544960 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.718633890 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.718667984 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.718677044 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.718792915 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.718827009 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.718935013 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.718969107 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.719155073 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.719202042 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.719285965 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.719357967 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.719405890 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.719434977 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.719585896 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.719598055 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.719659090 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.719681978 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.719748020 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.719873905 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.719926119 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.719944000 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.720200062 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.720274925 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.835026026 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.835073948 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.835120916 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.835165977 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.835268974 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.835303068 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.835366011 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.835416079 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.835520983 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.835760117 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.835802078 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.835895061 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.835915089 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.835978985 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.835993052 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.836066008 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.836090088 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.836189985 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.836255074 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.836508036 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.836533070 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.836663961 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.836678982 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.836743116 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.836802959 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.836975098 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.836999893 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.837327957 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.837413073 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.837523937 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.837564945 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.837645054 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.837677002 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.837738037 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.837795019 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.837893963 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.837914944 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.838028908 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.838042021 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.838268995 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.838315010 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.838397980 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.838440895 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.838491917 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.838545084 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.838654995 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.838666916 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.838680029 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.838762999 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.838836908 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.838912010 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.839052916 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.839179039 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.839222908 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.840079069 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:19.840296030 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.840310097 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.840384960 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.840411901 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.840517998 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.840529919 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.840605021 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.840616941 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.840821028 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.840835094 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.841046095 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.841114044 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.841264963 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.841303110 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.841430902 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.841459990 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.841577053 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.841587067 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.841743946 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.841777086 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.842014074 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.842027903 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.842128038 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.842261076 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.842452049 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.842612028 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.842755079 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.842775106 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.842849970 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.842925072 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.842977047 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.842993021 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.843116999 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.843130112 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.843238115 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.843276024 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.843358994 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.843368053 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.960439920 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.960614920 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.960656881 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.960670948 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.960720062 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.960777998 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.960809946 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.960824966 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.960926056 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.961009979 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.961034060 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.961101055 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.961182117 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.961218119 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.961288929 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.961342096 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.961460114 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.961596966 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.961733103 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.961889982 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.961975098 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.962018967 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.962049961 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.962156057 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.962191105 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:19.962217093 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:20.425679922 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:20.426774979 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:20.546590090 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:20.816140890 CET	1912	49709	87.120.120.86	192.168.2.11
Dec 16, 2024 14:08:20.858817101 CET	49709	1912	192.168.2.11	87.120.120.86
Dec 16, 2024 14:08:20.868038893 CET	49709	1912	192.168.2.11	87.120.120.86

Target ID:	0
Start time:	08:08:02
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe"
Imagebase:	0x610000
File size:	901'120 bytes
MD5 hash:	1EDABA9F8D91AD001893722FE5C3EC3B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1320945991.0000000003B69000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1320945991.0000000004783000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:08:03
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe"
Imagebase:	0x50000
File size:	901'120 bytes
MD5 hash:	1EDABA9F8D91AD001893722FE5C3EC3B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:08:03
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe"
Imagebase:	0xcf0000
File size:	901'120 bytes
MD5 hash:	1EDABA9F8D91AD001893722FE5C3EC3B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000004.00000002.1470193472.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000004.00000002.1476017854.00000000031A6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1476017854.00000000032A0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.7%
Total number of Nodes:	246
Total number of Limit Nodes:	19

Executed Functions

Function 0556CECC Relevance: 6.9, Strings: 5, Instructions: 623
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hcq, xrefs: 0556E85B
Hcq, xrefs: 0556E9A3
Hcq, xrefs: 0556E741
Hcq, xrefs: 0556E7D4
Hcq, xrefs: 0556E8E5

Memory Dump Source

Source File: 00000000.00000002.1323727612.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5560000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: Hcq$Hcq$Hcq$Hcq$Hcq
API String ID: 0-1692708840
Opcode ID: ed5ad273c1be48d25bc0835f680c27edddb7a5b1d13842ace47be618dd1d666f
Instruction ID: e838cc508e9aa95733a938e522a8556413cd001c090b26634b4155d7a2ddc14e
Opcode Fuzzy Hash: ed5ad273c1be48d25bc0835f680c27edddb7a5b1d13842ace47be618dd1d666f
Instruction Fuzzy Hash: A4328F30E00298CFDB54DF68C8557AEBBB6BF84304F1485AAD00AAB395DB349D45CFA1

Function 06C64293 Relevance: 4.0, Strings: 3, Instructions: 247
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te_q, xrefs: 06C64359
Te_q, xrefs: 06C64560
z^I, xrefs: 06C644B1

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: Te_q$Te_q$z^I
API String ID: 0-645441871
Opcode ID: e889d929330b72ca0922e4d4770230375e3ba9d924abf4873b4ed1f67a367d48
Instruction ID: 2eafd305187987867f18e277f3a441be91469252bbef077c4808e2e581dac826
Opcode Fuzzy Hash: e889d929330b72ca0922e4d4770230375e3ba9d924abf4873b4ed1f67a367d48
Instruction Fuzzy Hash: 2CA10770E002198FDB48CFAAC9846DEFBF2EF89310F24D52AE455AB254D7349945CF68

Function 06C642DF Relevance: 4.0, Strings: 3, Instructions: 225
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te_q, xrefs: 06C64359
Te_q, xrefs: 06C64560
z^I, xrefs: 06C644B1

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: Te_q$Te_q$z^I
API String ID: 0-645441871
Opcode ID: 7b8b957ab851a05447940567353ccbd3d8c4f36f593b8e9bf627d444494e149f
Instruction ID: dc85518c9c3b24314adc7d216072e0a2f704a6933a4923362b7ec4efb341ac9d
Opcode Fuzzy Hash: 7b8b957ab851a05447940567353ccbd3d8c4f36f593b8e9bf627d444494e149f
Instruction Fuzzy Hash: 2E91D374E142198FDB48CFAAC9846DEFBF2EF89300F24D52AE415AB264D7349905CF64

Function 06C642F0 Relevance: 4.0, Strings: 3, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te_q, xrefs: 06C64359
Te_q, xrefs: 06C64560
z^I, xrefs: 06C644B1

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: Te_q$Te_q$z^I
API String ID: 0-645441871
Opcode ID: 25faaf322ddfc8584381120e2cdd85bdac4bc4516b394ee355e3ab806cd0ffb9
Instruction ID: 577fd57c5a6958719eb7c9557f3b48e64ca0704f48a9b11373299da375f8ff32
Opcode Fuzzy Hash: 25faaf322ddfc8584381120e2cdd85bdac4bc4516b394ee355e3ab806cd0ffb9
Instruction Fuzzy Hash: 4C91B2B4E002198FDB48CFAAC5856DEFBF2EF89300F24D42AE515AB264D73499058F58

Function 06C66371 Relevance: 2.9, Strings: 2, Instructions: 388
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ry, xrefs: 06C6672B
ry, xrefs: 06C66724

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: ry$ry
API String ID: 0-883804406
Opcode ID: 44c7043820ba15650423507bc942568fbb1c9da1e881f45c39271a7dc1c53fa8
Instruction ID: a669893a91723d5d5b2d39e09030e779bccd143878c0dfcc56fb88fe9d885ea3
Opcode Fuzzy Hash: 44c7043820ba15650423507bc942568fbb1c9da1e881f45c39271a7dc1c53fa8
Instruction Fuzzy Hash: 08F1E171909246CFC754CFAAC4904AEFFF2BF8A310F24865AD095AB391D3749582CFA5

Function 06C6633A Relevance: 2.9, Strings: 2, Instructions: 377
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ry, xrefs: 06C6672B
ry, xrefs: 06C66724

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: ry$ry
API String ID: 0-883804406
Opcode ID: 84dc9dc4f879fc1c7f673ee908969a3118f954e55499f9003fff82eb1ba8c3f9
Instruction ID: 2eda7c7cf26aae92073b560be9631df1d9ea212d2d078a3f8dde7ba7ebd53b65
Opcode Fuzzy Hash: 84dc9dc4f879fc1c7f673ee908969a3118f954e55499f9003fff82eb1ba8c3f9
Instruction Fuzzy Hash: FAF1DF71905246CFD754CFAAC4904AEFFF2BF89310F24865AE095AB391D3349982CFA5

Function 06C66458 Relevance: 2.8, Strings: 2, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ry, xrefs: 06C6672B
ry, xrefs: 06C66724

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: ry$ry
API String ID: 0-883804406
Opcode ID: 2af09b06a6d49687c271f4bd06aa84f6958c0f5ebdbdf7d9cb2a64bf69568d1b
Instruction ID: 83b364169d267a8a049aa7cb5fd35658e4465997bfd0de337b823f541e641a9c
Opcode Fuzzy Hash: 2af09b06a6d49687c271f4bd06aa84f6958c0f5ebdbdf7d9cb2a64bf69568d1b
Instruction Fuzzy Hash: C7C128B0D1521ADFDB44CFA7C4958AEFBB2FF88300B108559E515AB314D734AA42CF99

Function 06C6D280 Relevance: 2.7, Strings: 2, Instructions: 224
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

UC;", xrefs: 06C6D46E
TuA, xrefs: 06C6D3F0

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: TuA$UC;"
API String ID: 0-2071649361
Opcode ID: 3564ca0846a74fff7f8341de105ab3170839595e1fd9a39d3ca36a8f214361e1
Instruction ID: 2f5f3668178d0bbd37eaf7267b0033ec895e6a89a6ef26b45b5f58fb7556e937
Opcode Fuzzy Hash: 3564ca0846a74fff7f8341de105ab3170839595e1fd9a39d3ca36a8f214361e1
Instruction Fuzzy Hash: 9E911B71E14209DFDB48CFE6E4845AEFBB2FF85310F10942AE416A7264D734A942CF48

Function 06C6D270 Relevance: 2.7, Strings: 2, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

UC;", xrefs: 06C6D46E
TuA, xrefs: 06C6D3F0

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: TuA$UC;"
API String ID: 0-2071649361
Opcode ID: 1b5d56b04449480a8cd83ff1a4dae164b73ab2f8efa3622b96f3d03d6a80e7cf
Instruction ID: 66a903a3d60c7fd4510b4e86c135a19e668361519246829a994167d48bae3f8d
Opcode Fuzzy Hash: 1b5d56b04449480a8cd83ff1a4dae164b73ab2f8efa3622b96f3d03d6a80e7cf
Instruction Fuzzy Hash: 51911B71E1520ADFDB48CFA6E4C45AEFBB2EF85310F10D42AE416A7264D734A942CF48

Function 06C6BC48 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

5=6, xrefs: 06C6BD86

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: 5=6
API String ID: 0-2897083178
Opcode ID: 393772f85554860e1d706532a61ef11bb5e1430f685f824f5f609a4a0fde4e70
Instruction ID: 623b8cfc23303f43047c5f5c0f7242126ff0847abbfd19af4edb911969fdcb76
Opcode Fuzzy Hash: 393772f85554860e1d706532a61ef11bb5e1430f685f824f5f609a4a0fde4e70
Instruction Fuzzy Hash: C3713A74E0520AAFCB44DFA6D9804AEFBB2FF89341B10D52AD516E7254DB389A01CF94

Function 06C6BC58 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

5=6, xrefs: 06C6BD86

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: 5=6
API String ID: 0-2897083178
Opcode ID: 3313f18fc8ec465134a6ce89192c16a4712b50f2fa5632ff6aaa5f0a14660eef
Instruction ID: aa5fbe2eb2c361d869431a654b3c5cd72d2922e0a69ad7a54a9837a680f3ae0d
Opcode Fuzzy Hash: 3313f18fc8ec465134a6ce89192c16a4712b50f2fa5632ff6aaa5f0a14660eef
Instruction Fuzzy Hash: 04614A74E0520AAFCB44DFA6D8804AEFBB2FF89341F10D52AD116E7254DB389A01CF94

Function 06C64BA0 Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

-2m, xrefs: 06C64CC3

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: -2m
API String ID: 0-2686427999
Opcode ID: 90e37ac6e71655c9abd1161c9a67b3ef59445fb4617ab67c278292b5a6f8d7f1
Instruction ID: dc3d71be5a0d61b8a40a01a8931e67ba5f94d89fd1c9ace1264f2f5f2519f31e
Opcode Fuzzy Hash: 90e37ac6e71655c9abd1161c9a67b3ef59445fb4617ab67c278292b5a6f8d7f1
Instruction Fuzzy Hash: 59512BB0E052099FDB08DFAAD5806AEFBF2EF89301F24D06AD419B7254D7345944CB68

Function 06BBB698 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 293f24ad03f4f9b6da7d486c02aae7804326617f5d5acd639100b65179c841eb
Instruction ID: dd150386e159d85b7f592695fb3c1a895c0e162634155be1fd3c10f4af220a90
Opcode Fuzzy Hash: 293f24ad03f4f9b6da7d486c02aae7804326617f5d5acd639100b65179c841eb
Instruction Fuzzy Hash: 8AC15BB1B007048FDB69DB79C8507BA77E6EF88700F1494ADD14A9B291CF75E901CBA1

Function 0556CEC8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1323727612.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5560000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b12e64710cc2110181154426875253014131eff59bf4e677d8e54ff8b359d4ad
Instruction ID: a17a56aba38593ef817eea1cadbe67f5a2d6ce73581565009bc1e49627aea2a0
Opcode Fuzzy Hash: b12e64710cc2110181154426875253014131eff59bf4e677d8e54ff8b359d4ad
Instruction Fuzzy Hash: CCC17D35E012999FCF15CF69C98179EBBB2BF88300F14C1AAD449AB255EB30E985CF51

Function 0556E170 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1323727612.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5560000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 065ea8b422da59816a645e8a2dce58daaad0004721cc1eedea9b1cdf4e4bd7e5
Instruction ID: 5ff56e42852aa2eafbbee11e9657ac1e63bbdbaa6c75abc27607f934ce4b3f0f
Opcode Fuzzy Hash: 065ea8b422da59816a645e8a2dce58daaad0004721cc1eedea9b1cdf4e4bd7e5
Instruction Fuzzy Hash: 40C16C35E012999FCF15CF64C981B9EBBB2BF88300F14C1AAD449AB255EB30E985CF51

Function 06C6DB80 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93e1e4030083a251d39d6a19e15a886bb0d74a5a757aef9416930c86c689a9b
Instruction ID: 2a11f40e103d5faf5db082a73b4ced14e992e7c88a944291c33391015e2d9e78
Opcode Fuzzy Hash: b93e1e4030083a251d39d6a19e15a886bb0d74a5a757aef9416930c86c689a9b
Instruction Fuzzy Hash: 47B1F671E0520D9FDB58DFA6D98059EFBB2FF88300F20D42AE016AB254D735AA06CF54

Function 06C6DB7E Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 093c28f7b6caeff527fb891275fbb28613ed11b4c514079fa51cb6351184a1a9
Instruction ID: bc147adfac558ca9eb330a83c701c507d3dfa01ab93b1c482728454bb408a125
Opcode Fuzzy Hash: 093c28f7b6caeff527fb891275fbb28613ed11b4c514079fa51cb6351184a1a9
Instruction Fuzzy Hash: A2A10571E0520D9FDB58DFA6D98059EFBB2FF88300F20D42AE01AA7254D775AA02CF54

Function 06BB94AB Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24fb3068a3a630e6c42e0a1ce41cd4a491e131aab873cf1e752118ee0403ed46
Instruction ID: f7ad179f4b4884d999e07b668595e4cd9869a2a555c97bb8fd2e7600a05f9eee
Opcode Fuzzy Hash: 24fb3068a3a630e6c42e0a1ce41cd4a491e131aab873cf1e752118ee0403ed46
Instruction Fuzzy Hash: BC710BB1D456198FEB68DF66C8407E9B7B6AF8A300F14D1EAC50DA6250EBB04A85CF40

Function 06C655D9 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3745bcede55159e84f91d618edb0f3fb201b8c16f7c3eead988a48af81e7b8c6
Instruction ID: 2029b877794af59f61760f26f86d4246bcda2aee45b4b910569a3951ff5ef360
Opcode Fuzzy Hash: 3745bcede55159e84f91d618edb0f3fb201b8c16f7c3eead988a48af81e7b8c6
Instruction Fuzzy Hash: BA310AB1E016188BDB18CF97D9446DEBBB3EFC9310F14C06AE509AB264DB355945CF50

Function 00D0D1C8 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00D0D256
GetCurrentThread.KERNEL32 ref: 00D0D293
GetCurrentProcess.KERNEL32 ref: 00D0D2D0
GetCurrentThreadId.KERNEL32 ref: 00D0D329

Memory Dump Source

Source File: 00000000.00000002.1318640846.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 08e156fe83a3c8718381aede9ab38e5e0afb39e16ca3c390f6b4fd7036303430
Instruction ID: 7de80508d19d11c5f2b48705023e7cbc8cc2777b19090d9d1e8567e3e6304d53
Opcode Fuzzy Hash: 08e156fe83a3c8718381aede9ab38e5e0afb39e16ca3c390f6b4fd7036303430
Instruction Fuzzy Hash: 445154B09002098FDB54DFAAD548BEEBBF1FF89314F24845AE009A73A1D7749984CF65

Function 00D0D1D8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00D0D256
GetCurrentThread.KERNEL32 ref: 00D0D293
GetCurrentProcess.KERNEL32 ref: 00D0D2D0
GetCurrentThreadId.KERNEL32 ref: 00D0D329

Memory Dump Source

Source File: 00000000.00000002.1318640846.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7cf595ae84d19a7d62a036de85dbfa189bd05807d65978f54d6abbc1503b221b
Instruction ID: 51a21fc5fad123f346ad0c2f31e16feeb79568f57f90f8d5728972cc38db76bf
Opcode Fuzzy Hash: 7cf595ae84d19a7d62a036de85dbfa189bd05807d65978f54d6abbc1503b221b
Instruction Fuzzy Hash: 4F5135B09003099FDB54DFAAD548BAEBBF1BF89314F24845AE009A73A0D774A944CF65

Function 06BB836D Relevance: 1.7, APIs: 1, Instructions: 247processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06BB85AE

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 359135a11af3467d875b2b6e6cf618de5290c1d4357aa6cb73df1c7583573a73
Instruction ID: a7ceb89c495d80c078735f8c1edd2de90b13137f189da8a763b9a5ce21dfae46
Opcode Fuzzy Hash: 359135a11af3467d875b2b6e6cf618de5290c1d4357aa6cb73df1c7583573a73
Instruction Fuzzy Hash: 22A17BB1D00219CFDB60CF68C841BEEBBB6FF48314F0495AAD849A7250DBB59985CF91

Function 06BB8378 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06BB85AE

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: ccf9a087672019aa18fa676956f40c4b467132f02ae8580504549443906a878c
Instruction ID: b891fa1e2eb9c0a714611b5e83e13b37b2a65968f06ad3d7c443c92a84eeb55e
Opcode Fuzzy Hash: ccf9a087672019aa18fa676956f40c4b467132f02ae8580504549443906a878c
Instruction Fuzzy Hash: 3E917CB1D00219CFDB60CF68C841BEDBBB6FF48314F0495A9D849A7250DBB59985CF91

Function 00D0B209 Relevance: 1.7, APIs: 1, Instructions: 212COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00D0B47E

Memory Dump Source

Source File: 00000000.00000002.1318640846.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: df27b8f1a0e4df7b6312f2c5a92924dcea3fba09b665642f68bb22bd9c8d0fe5
Instruction ID: 5370fafdde70b27f8a9f426b0a73c421c36c29a95cac6ab425a4ac0766ff7d0e
Opcode Fuzzy Hash: df27b8f1a0e4df7b6312f2c5a92924dcea3fba09b665642f68bb22bd9c8d0fe5
Instruction Fuzzy Hash: 32818670A04B458FD724CF69C05179ABBF1FF88314F14892EE08ADBA91D734E949CBA0

Function 00D0449C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00D059A9

Memory Dump Source

Source File: 00000000.00000002.1318640846.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 20a783bdf8a036683771a6e244df6170592aeeac594a905a25d7c18eddc80c28
Instruction ID: eba2ae73302dbda1f2ea8fcd630171dae8a300c411a618c036538f19b18db288
Opcode Fuzzy Hash: 20a783bdf8a036683771a6e244df6170592aeeac594a905a25d7c18eddc80c28
Instruction Fuzzy Hash: AE41F1B0C0071DCFDB24DFAAD844B8EBBB5BF48304F20816AD408AB295DB756945CFA0

Function 00D058ED Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00D059A9

Memory Dump Source

Source File: 00000000.00000002.1318640846.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 142f624a32dd82169584ab5b34db0e02c865ff6ae8e832e1de1dbdaf5c70fe32
Instruction ID: e15805e9d02c02e5472f9358e9a489f6a196b183712301aaa3b55df65c904872
Opcode Fuzzy Hash: 142f624a32dd82169584ab5b34db0e02c865ff6ae8e832e1de1dbdaf5c70fe32
Instruction Fuzzy Hash: AB41F1B0C00619CFDB24DFA9D884B8EBBB5BF48304F24816AD408AB295DB756945CFA0

Function 0556EAA8 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1323727612.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5560000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 9427efe121643c6299e3d58a45379213a71e01120e781aa4b96d3abd36d8c1cb
Instruction ID: 85d2a75e582f594e0537043e0031da7e9b55ea052133ee9ec1dba8b7adc1e542
Opcode Fuzzy Hash: 9427efe121643c6299e3d58a45379213a71e01120e781aa4b96d3abd36d8c1cb
Instruction Fuzzy Hash: 5B319872904389AFCB11DFAAD800A9EBFF8FF49310F14805AF954A7221C335A854DFA1

Function 06BB81D9 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06BB8260

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 61f608785b4706efefe6f1856ecb02ad972f327690c3cb8d8460819612d63404
Instruction ID: 8f4aeca697578046cdbb332efc6d3d800c1ac076b5b4bad52466aa3f94fe0040
Opcode Fuzzy Hash: 61f608785b4706efefe6f1856ecb02ad972f327690c3cb8d8460819612d63404
Instruction Fuzzy Hash: 1E2148B1C002899FCB20DFA9C945AEEBFB5FF48310F14845AD959A7251C7789905CBA1

Function 06BB80EB Relevance: 1.6, APIs: 1, Instructions: 70injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06BB8180

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 17874a74473a1582d95f43aaf30e2addcc5b628015f1e37d8fb5a94eee55c678
Instruction ID: 0f63d45245e967cd0ea93fc549b5e59040fa80085c7fccec645d397a7e96283c
Opcode Fuzzy Hash: 17874a74473a1582d95f43aaf30e2addcc5b628015f1e37d8fb5a94eee55c678
Instruction Fuzzy Hash: F22166B1D003199FCB10DFA9C981BEEBBF5FF48310F14842AE919A7240C7789945CBA0

Function 06BB80F0 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06BB8180

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e05ec740cde1064e4f61cac43d88ede77b70f6d9e2cdb583ecb72759650f5de5
Instruction ID: 95aefedd9e8a664d42d506b281d5ce8c3d37b03f45ada6aa398bd7cd22f1aede
Opcode Fuzzy Hash: e05ec740cde1064e4f61cac43d88ede77b70f6d9e2cdb583ecb72759650f5de5
Instruction Fuzzy Hash: 4F2136B1D003599FCB10DFA9C885BEEBBF5FF48310F14842AE919A7240C778A945CBA0

Function 06BB7F50 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06BB7FD6

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d0f621fb84f3d07317ec181bfea160051ee01c3c0b1856ca0c0cc3b03441a233
Instruction ID: 8ec2409504a7861ffe286d7ae783f19e11bbf5ba27d40ca3f414ef7420d2ca92
Opcode Fuzzy Hash: d0f621fb84f3d07317ec181bfea160051ee01c3c0b1856ca0c0cc3b03441a233
Instruction Fuzzy Hash: 84216AB1D002488FCB10DFA9C485BEEBBF4EF88314F10842AD459A7240CB789945CFA1

Function 00D0D822 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D0D8AF

Memory Dump Source

Source File: 00000000.00000002.1318640846.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a236489cfa67c91eacd2d309492242fc1709aa89947d46f57443fcfae2c29db8
Instruction ID: 5ada1fe93352a26886a34e57fbd8c18bb85322187567341a694056e376b0acb1
Opcode Fuzzy Hash: a236489cfa67c91eacd2d309492242fc1709aa89947d46f57443fcfae2c29db8
Instruction Fuzzy Hash: 032114B5D002499FDB10CFAAD584AEEBFF5FB48320F14805AE918A7350D379A945CFA0

Function 06BB81E0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06BB8260

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 32993aafe8770f96a8b7b69aab05d0d738f56c4abb31cca5162bdafcc2560796
Instruction ID: 35b67d8d7794fff07b3edce8cbc5c91b0602b37f5b0979fe822b481048dcfca0
Opcode Fuzzy Hash: 32993aafe8770f96a8b7b69aab05d0d738f56c4abb31cca5162bdafcc2560796
Instruction Fuzzy Hash: 852139B1C003499FCB10DFAAC981AEEFBF5FF48310F10842AE519A7240C7759945CBA1

Function 06BB7F58 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06BB7FD6

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: fc0254663dd0e83f13c9f3f67f0a135d81f49371d0d960538e9ba54cbcefd329
Instruction ID: f2af197a15ee677889331657fc677731bb11f280bd614fc6df07ca5922f89be3
Opcode Fuzzy Hash: fc0254663dd0e83f13c9f3f67f0a135d81f49371d0d960538e9ba54cbcefd329
Instruction Fuzzy Hash: D72138B1D002498FDB50DFAAC585BEEBBF4EF88314F10842AD419A7240CB78A945CFA5

Function 00D0D828 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D0D8AF

Memory Dump Source

Source File: 00000000.00000002.1318640846.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b724bfeac38518fe278c56da14d8af14b91c7e0b5635695a1573b846ea771ed4
Instruction ID: cd6b94ab858e407f937031f69e681d82efbf998b3ec6674e233ae9b8bbc0111d
Opcode Fuzzy Hash: b724bfeac38518fe278c56da14d8af14b91c7e0b5635695a1573b846ea771ed4
Instruction Fuzzy Hash: 3A21C4B5D002489FDB10CFAAD584ADEBFF5FB48310F14845AE918A7350D374A954CFA5

Function 06C6B468 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 06C6B4E3

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c3b98cddd58c7ca3172cbc47bafc00ead8dc37c5b5c0800800c97e7b23dc677b
Instruction ID: b1c0e5616dc917f8f7597a879d35acc0c98b5b3a8163687ceb63029284918601
Opcode Fuzzy Hash: c3b98cddd58c7ca3172cbc47bafc00ead8dc37c5b5c0800800c97e7b23dc677b
Instruction Fuzzy Hash: 092138B68002499FCB10CF9AC884BDEFBF4FB48310F108429E858A7241D374A944CFA5

Function 0556CF14 Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,0556EAC2,?,?,?,?,?), ref: 0556EB67

Memory Dump Source

Source File: 00000000.00000002.1323727612.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5560000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 04bf8f59f7020b9382a5f445686ba769da4f5db0fb00c8e34057d6edfc3e317e
Instruction ID: d4cbe95bd4f9844d597d3a48191ba382d58fd7f57d38bab621e3dee3c32c3b2b
Opcode Fuzzy Hash: 04bf8f59f7020b9382a5f445686ba769da4f5db0fb00c8e34057d6edfc3e317e
Instruction Fuzzy Hash: 141167B580024D9FDB10CFAAD845BEEBFF8FB48310F14841AE915A7210C375A954CFA4

Function 06C6B470 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 06C6B4E3

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 17ee22675d63ca6a56122e99d82251c6c91ebc86a1a0dbc54541a4bd997ab2c5
Instruction ID: f8ba14c92636e6e0c28dba164c300ec789130cd9533d3c67a683d846ffab7e46
Opcode Fuzzy Hash: 17ee22675d63ca6a56122e99d82251c6c91ebc86a1a0dbc54541a4bd997ab2c5
Instruction Fuzzy Hash: E62129B5D002499FCB10DF9AC484BDEFBF4FB48310F10842AE958A7251D375A944CFA5

Function 06BB802B Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06BB809E

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a087a7c762ed2ebf125779b08a659cefd87e0f78baf57dce38f696317a724208
Instruction ID: cfd71d95d0ebf1b06f62c5ac69e3e452d72c30143b04408b506ed2db89aecbe9
Opcode Fuzzy Hash: a087a7c762ed2ebf125779b08a659cefd87e0f78baf57dce38f696317a724208
Instruction Fuzzy Hash: F9116772C002488FCB20DFA9C945AEFBFF5EF88320F14881AE919A7250C7759955CFA1

Function 06BB8030 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06BB809E

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2fbfd95290b869ba410914bd9689aec5252a28a76bc57fbbf39101af2ee4d4f7
Instruction ID: eb25962edd74791f536c509cf796eb29a2299a37aba08af9366c5b5280b48340
Opcode Fuzzy Hash: 2fbfd95290b869ba410914bd9689aec5252a28a76bc57fbbf39101af2ee4d4f7
Instruction Fuzzy Hash: A2113772D002499FCB20DFAAC845AEEBFF5EF88324F10841AE519A7250C775A944CFA1

Function 06BB7669 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06BB76D2

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 578dc0e8b784bb7cad3eb7a8ab82948e8f43f311555c614245f964ed1c052b9c
Instruction ID: db6eecfd04c592c863198f87c33fe2de8cffe3f024bfbf32fe302762585355c9
Opcode Fuzzy Hash: 578dc0e8b784bb7cad3eb7a8ab82948e8f43f311555c614245f964ed1c052b9c
Instruction Fuzzy Hash: 7D1158B1D002488FCB24DFA9C5457EEFBF5AB88314F10846AD419B7240CA756945CBA4

Function 06BB7670 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06BB76D2

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 52119cf35b33294dc541da4af9de92e602dbefec94166b85b677c93ffbd0f679
Instruction ID: 4dd8c602b2256e9835f32870eaf05fb72e0fe3ea326b2b97eafa9c8135361259
Opcode Fuzzy Hash: 52119cf35b33294dc541da4af9de92e602dbefec94166b85b677c93ffbd0f679
Instruction Fuzzy Hash: A6113AB1D042498FCB20DFAEC4457EEFFF4EB88324F10845AD419A7240CB75A945CBA5

Function 06BB7C34 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06BBA7B5

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 49f91c99fee14bdb2b9145c142e727212d54589b5b54f62c78e7c1469f32625a
Instruction ID: f8d951a7e02900fbd81b1b8236df90fe701534ed88b7c9aca31087e4c1b9d716
Opcode Fuzzy Hash: 49f91c99fee14bdb2b9145c142e727212d54589b5b54f62c78e7c1469f32625a
Instruction Fuzzy Hash: 091106B5C043489FDB50DF9AD985BEEBFF8EB48314F108459E518A7204D3B5A944CFA1

Function 00D0B418 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00D0B47E

Memory Dump Source

Source File: 00000000.00000002.1318640846.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1b56f940ed980ea74a2258751921793a374e4763d433e7b9caff7ddb51765d19
Instruction ID: d38e3b200f928816169651e2f5fd5fd15396c7794cc46c941c63664a99aa772b
Opcode Fuzzy Hash: 1b56f940ed980ea74a2258751921793a374e4763d433e7b9caff7ddb51765d19
Instruction Fuzzy Hash: AD110FB6C042498FCB10CF9AD444B9EFBF4EB88328F14841AD418A7350C379A645CFA1

Function 06BBA751 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06BBA7B5

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3b8b6ce6b07d717c65e3e4c9f825c86eaceafee5681d0e18a374a43bb1a79d51
Instruction ID: 02aa81eb0ee1e0ff03e7383135178c7221c0361f0de6092c7967b7580c01dde7
Opcode Fuzzy Hash: 3b8b6ce6b07d717c65e3e4c9f825c86eaceafee5681d0e18a374a43bb1a79d51
Instruction Fuzzy Hash: 541103B5804348DFDB10CF9AD985BEEBFF8EB48314F14884AE559A7240C3B5A584CFA1

Function 0556DA58 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0556DAB8

Memory Dump Source

Source File: 00000000.00000002.1323727612.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5560000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 0aca26347c15314461d79d52fe61baae13af03b44df514684bd02599cd5ee2ea
Instruction ID: f1d076a3f62fcae434d4699490147d69e0adac8bc6e294f4adcb33230a5363a4
Opcode Fuzzy Hash: 0aca26347c15314461d79d52fe61baae13af03b44df514684bd02599cd5ee2ea
Instruction Fuzzy Hash: C91163B68043488FCB20DFA9C645BDEBBF0FB48320F24841AD458A7740C378A645CFA0

Function 0556DA60 Relevance: 1.3, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0556DAB8

Memory Dump Source

Source File: 00000000.00000002.1323727612.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5560000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 9d31d72ddc2393c1eb8957d45a23df1af4273040c40ac266a7d65e0c31cfe02f
Instruction ID: d280f94dc959e2dc1ca3690b08fa52c3ac2b66ef920413c7e37fc9005caf6341
Opcode Fuzzy Hash: 9d31d72ddc2393c1eb8957d45a23df1af4273040c40ac266a7d65e0c31cfe02f
Instruction Fuzzy Hash: 961145B68043498FCB10DF9AC545BDEBBF4FB48320F14841AD518A7740D378A544CFA5

Function 00CBD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1316604899.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cbd000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 689c5197cb1b40c1f70e687ce9ba6298838bf0641742ec6c4cfe388aad2c88ff
Instruction ID: 1b0f8651cd6354da49d8f008ddfcfba6a033cfd0a44965fb87a422bdaa78cd92
Opcode Fuzzy Hash: 689c5197cb1b40c1f70e687ce9ba6298838bf0641742ec6c4cfe388aad2c88ff
Instruction Fuzzy Hash: 13210475604204DFCB14EF18E9C4B66BF65FB88314F24C5ADE80A4B296D33AD807CA61

Function 00CBD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1316604899.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cbd000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0706b9f70d31fbe1cf1b45db7f0b31f9e5d739980d86dcf1e7dc0c34db78cddc
Instruction ID: f6d2d37cf96a932281dab464a37457909fc462179ab9e36300bc1cff67493184
Opcode Fuzzy Hash: 0706b9f70d31fbe1cf1b45db7f0b31f9e5d739980d86dcf1e7dc0c34db78cddc
Instruction Fuzzy Hash: BD212675504284EFDB05DF14D9C0B66BBA5FB88314F20C5ADE80A4B296D336DC46CB62

Function 00CBD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1316604899.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cbd000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17af92a021706ca3015a6297eeb3344a90dd55b2edbcd4dbd7d1955e0134e184
Instruction ID: f9ace10b9d3b1dbc0a8ce3caf00aadfe9eb1d96b839398119b27b4b190dafe30
Opcode Fuzzy Hash: 17af92a021706ca3015a6297eeb3344a90dd55b2edbcd4dbd7d1955e0134e184
Instruction Fuzzy Hash: F1219F755093C08FCB02DF24D994715BF71EB46314F29C5EAD8498F2A7C33A980ACB62

Function 00CBD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1316604899.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cbd000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction ID: f4d4f62628b3b31526736ea9df2c9bd06e61e8dd07607bab777bf951bc6772cf
Opcode Fuzzy Hash: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction Fuzzy Hash: 8B11BB75504280DFCB02CF10C5C4B15BBA1FB84314F24C6A9D84A4B296D33AD84ACB62

Function 00CAD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315820040.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cad000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e750290c02fed22dda8120d7a6978f1b038ddf2b1b336c015b5a787e09c1e5
Instruction ID: db718cf5e4e7e698b3a3113a12c78fac121b36d834133eee8f8edc0dd4f47c2c
Opcode Fuzzy Hash: 78e750290c02fed22dda8120d7a6978f1b038ddf2b1b336c015b5a787e09c1e5
Instruction Fuzzy Hash: 88012B710043459AE7248F1ACD88B67BF98DF52328F18C56AED1B8A69ED2799840C671

Function 00CAD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315820040.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cad000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb5937a0e060f5b289b07884bd29f3cc42ab409241a4eee43661f7831d4cf4e5
Instruction ID: 99056d541718ed6d92691d17bcea1413b0da1c9cacb0c63e9ed9a7b02e417f51
Opcode Fuzzy Hash: eb5937a0e060f5b289b07884bd29f3cc42ab409241a4eee43661f7831d4cf4e5
Instruction Fuzzy Hash: 30F0FC714043449EE7148F15CD88B66FF98EF51334F18C45AED099B29AC2799C44CB71

Non-executed Functions

Function 06C6E120 Relevance: 1.6, Strings: 1, Instructions: 326COMMON

Download Yara Rule

Strings

{#L, xrefs: 06C6E308

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: {#L
API String ID: 0-1361971085
Opcode ID: 4fb1acd980a50bf1cd7cdf919b3e1ebf76a0e90daff7ee27005a74f3318adda2
Instruction ID: 0c30b5228888daf2d9669c60bd326c031b3e6c35ac0f9753c63893f3311d2500
Opcode Fuzzy Hash: 4fb1acd980a50bf1cd7cdf919b3e1ebf76a0e90daff7ee27005a74f3318adda2
Instruction Fuzzy Hash: 7BD13774E09219CFDB48CFAAD98049EFBF2BF88340F14D52AE419AB265D7349902CF54

Function 06C6E130 Relevance: 1.6, Strings: 1, Instructions: 325COMMON

Download Yara Rule

Strings

{#L, xrefs: 06C6E308

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: {#L
API String ID: 0-1361971085
Opcode ID: 7b80a11c4d3d67c0d246da3e7809838d2aee0259a47ee309c97d03ebcd4b537e
Instruction ID: 9588f287305fbdde452194cb41d44917193237603d424102b63a2f67386c886a
Opcode Fuzzy Hash: 7b80a11c4d3d67c0d246da3e7809838d2aee0259a47ee309c97d03ebcd4b537e
Instruction Fuzzy Hash: 19D12574E09219CFDB58CFAAD98059EFBF2BF88340F14D52AE419AB264D7349902CF54

Function 06C65039 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

98R, xrefs: 06C651A3

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: 98R
API String ID: 0-576591972
Opcode ID: 37932d943ead1e029261ecfcf2bc1fb1d64ad6a3bc4af715443e29050eac0a3f
Instruction ID: 28f7c57e6f1c1372c59dcc851d9549baa3809094f0b11ea595f66281386ff15d
Opcode Fuzzy Hash: 37932d943ead1e029261ecfcf2bc1fb1d64ad6a3bc4af715443e29050eac0a3f
Instruction Fuzzy Hash: 2A7159B5E0120ADFDB44CFAAD5809AEFBB1FF89310F64942AE415AB314D3349A41CF94

Function 06C6C241 Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

iUfo, xrefs: 06C6C366

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: iUfo
API String ID: 0-3820436262
Opcode ID: a4d2e459320083074dc4254827b6c93d3af7f6d2e29901575902c01e41f91942
Instruction ID: bc7b6f49f88066ba3fee5e178ac5e92c503dd524bc7830f9e06d877874926c71
Opcode Fuzzy Hash: a4d2e459320083074dc4254827b6c93d3af7f6d2e29901575902c01e41f91942
Instruction Fuzzy Hash: BC511874E012199FCF44CFAAD8855EDFBF2FF89300F10942AE905E7254E7385A018BA5

Function 06C6C250 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

iUfo, xrefs: 06C6C366

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: iUfo
API String ID: 0-3820436262
Opcode ID: 83be844e15baa6c17c15ab015e4e8e0fef20c26ec7cd09de2032dbbf2a36c9e7
Instruction ID: 82bce1b1e11dce62756ca00f624099b66faebe9bd67f4f58f3d15cc6df8e9018
Opcode Fuzzy Hash: 83be844e15baa6c17c15ab015e4e8e0fef20c26ec7cd09de2032dbbf2a36c9e7
Instruction Fuzzy Hash: 0951E575E012199FDB44CFAAD5855EDFBF2FF88300F10942AE905B7254E7345A418F94

Function 06C6C820 Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

w7e^, xrefs: 06C6C77D

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: w7e^
API String ID: 0-1657886525
Opcode ID: f68c62ef4294ed7b84ceeddefee849d540e96a84182c673930c2803198bc32c7
Instruction ID: c90f57365bfca20befd111c77cfcccb6e5d98f9263f13deee94baa1f390bf0c4
Opcode Fuzzy Hash: f68c62ef4294ed7b84ceeddefee849d540e96a84182c673930c2803198bc32c7
Instruction Fuzzy Hash: A35138B4D0520ADFDB44CFAAC9805EEFBB2FB89200F14956AD455F7254D3389A41CF98

Function 06C6C648 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

w7e^, xrefs: 06C6C77D

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: w7e^
API String ID: 0-1657886525
Opcode ID: 93e2bed2ee0206bdea98b55dd61e54be8ae019addf37b59220124d71f3998790
Instruction ID: 04e41e7d4f3bf4460f4a7dd5860979c590b399145a0c755a235291cc0833fc86
Opcode Fuzzy Hash: 93e2bed2ee0206bdea98b55dd61e54be8ae019addf37b59220124d71f3998790
Instruction Fuzzy Hash: 9141F5B4D0521ADFDB44CFABC8805EEFBB1FB89201F14952AD456B7254D7388642CF98

Function 06C6C638 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

w7e^, xrefs: 06C6C77D

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: w7e^
API String ID: 0-1657886525
Opcode ID: 9d35e3dac69e1706dc1c69808ce3524fca2b47aed2aefeadb78c2246cf594918
Instruction ID: 983e52e3d210e71a2ec22439b0d38d1a290b29aa014897dfac52e61cae9d96d7
Opcode Fuzzy Hash: 9d35e3dac69e1706dc1c69808ce3524fca2b47aed2aefeadb78c2246cf594918
Instruction Fuzzy Hash: 144105B0D0520ADFDB44CFA7C4816EEFBB1FB89201F14952AD455B6254D7388642CF99

Function 06C68BA8 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

0ni, xrefs: 06C68D19

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: 0ni
API String ID: 0-1488673370
Opcode ID: a927117d541f0dcacaee23637eb2194eea8040981674e514bc0693f3635f7568
Instruction ID: d26f30ea54b916b6212064802042d4655775310aeb0859b3e838ab8c744d7609
Opcode Fuzzy Hash: a927117d541f0dcacaee23637eb2194eea8040981674e514bc0693f3635f7568
Instruction Fuzzy Hash: 22516C71E056188BDB58CF6B9D4479EFBF3AFC8300F14C1BA950CA6264DB300A968F51

Function 05565060 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1323727612.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5560000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62617b7afd8302e9ee8676b5c6ac5e259851e56872835d9cf9fc8ccd5e73ae57
Instruction ID: cab1d43511ee0ca58c3f67b2aaaddfed218a9a47a1b85c9da99c4880a2978078
Opcode Fuzzy Hash: 62617b7afd8302e9ee8676b5c6ac5e259851e56872835d9cf9fc8ccd5e73ae57
Instruction Fuzzy Hash: 20C16E72F0015A8FD704DAA9C8846AEFBF6BFC8210F198565E418EB355EA70DD42CB90

Function 06BB51C3 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6978c7f96e68ba04ee0b5ad13398e026220e1d761645924238b78f495f2c6b8f
Instruction ID: af4e3cae57de05ee9d4045860d2a0a50df9c770fc12f43236643486f4ac8a4de
Opcode Fuzzy Hash: 6978c7f96e68ba04ee0b5ad13398e026220e1d761645924238b78f495f2c6b8f
Instruction Fuzzy Hash: 33E16BB0E102198FCB54CFA9C5909AEFBF2FF89304F249169D415AB356C730A942CF61

Function 06BB7720 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66a07cc971d39504e1ab228a4063ed32780b3d2f82c311d8a3d512d62e5a9419
Instruction ID: e99c5b88c124f9a32c36b6ac2abcb1ee20699334b58bed457f3d90d62f95e45b
Opcode Fuzzy Hash: 66a07cc971d39504e1ab228a4063ed32780b3d2f82c311d8a3d512d62e5a9419
Instruction Fuzzy Hash: 14E13AB4E101198FCB54DFA9C5909AEFBB2FF88304F2491A9D415AB356DB70A941CFA0

Function 06BB6E48 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f080a3ed849d7ef6d008f5c731d71144f74221bb63be5582550df61279059aa
Instruction ID: 9e4a368e29f842a76df17eed233de6d8e18b35f8d47576e46a53762dc70eaaea
Opcode Fuzzy Hash: 8f080a3ed849d7ef6d008f5c731d71144f74221bb63be5582550df61279059aa
Instruction Fuzzy Hash: D3E14BB4E101198FCB54DFA9C5909AEFBB2FF88304F249169E414AB356DB74AD41CFA0

Function 06BB5A40 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 609ce6df663f777d79b84198d3022e865a9fa247d44e1d4750e432f32773ca39
Instruction ID: b01374077587387e89895586e6f0a21a64958c26521d67b62b91ff05d53bfaa3
Opcode Fuzzy Hash: 609ce6df663f777d79b84198d3022e865a9fa247d44e1d4750e432f32773ca39
Instruction Fuzzy Hash: 06E15AB4E101198FCB64DFA9C5909AEFBF2FF88304F249169E415AB356C770A941CF61

Function 06BB5606 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7946b41face58879e9d082217b03ff5f0c0ef053d271c70a24b4f8631f91a00d
Instruction ID: 0380f6ad3da38db1015fd8f68af201196367f08f395c66ae11683208e0dcc521
Opcode Fuzzy Hash: 7946b41face58879e9d082217b03ff5f0c0ef053d271c70a24b4f8631f91a00d
Instruction Fuzzy Hash: 93E15AB4E101198FCB54DFA9C5909AEFBF2FF88304F249169D415AB356CB70A941CFA1

Function 05564AAA Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1323727612.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5560000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f94a31f89170f18ca65b81df7f55c0447b4847dc297f54e6cbd6418ce2e12a10
Instruction ID: 1644b4e42711274c1aa7c543d9be7187d0597a00805fc08fd4bb87b17c764fb9
Opcode Fuzzy Hash: f94a31f89170f18ca65b81df7f55c0447b4847dc297f54e6cbd6418ce2e12a10
Instruction Fuzzy Hash: 83D1F53191079A8ACB00EB64DAA069DB771FFD5300F20879AE50A77665FF706AC5CB81

Function 00D0D74C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1318640846.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1bf7495a7a5090557a7ac5d42f36a9b7860aa7445fcc1dd90b1d0885f126b04
Instruction ID: a8227acfc65a92f0c5bc5450122ffb5f4b5d8be9fcf620e3541d6b7940bd84f2
Opcode Fuzzy Hash: a1bf7495a7a5090557a7ac5d42f36a9b7860aa7445fcc1dd90b1d0885f126b04
Instruction Fuzzy Hash: B1A18136E002059FCF15DFB5C84069EB7B2FFC4310B25857AE80AAB2A5DB71E945CB60

Function 05564AB0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1323727612.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5560000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e78b3bc1ec07a11fc6c6e879f19888379d0de7caed270708730150da9545d0a0
Instruction ID: 39ade13ae1d7f014bb8191eb51e26c7cf752ea73d7c4fd273400e9ec25c7463e
Opcode Fuzzy Hash: e78b3bc1ec07a11fc6c6e879f19888379d0de7caed270708730150da9545d0a0
Instruction Fuzzy Hash: 85D1F53191079A8ACB00EB64DA6069DB771FFD5300F20879AE50A77665FF706AC5CB81

Function 06C67338 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5c0e1e4886f14c205462445f552909589909cbf87757382836fae2e9176d96d
Instruction ID: cec50ee1924153e48cacb78d0e134924108d8487c0f7db1c2abbe9ece19e4131
Opcode Fuzzy Hash: b5c0e1e4886f14c205462445f552909589909cbf87757382836fae2e9176d96d
Instruction Fuzzy Hash: FD91C274A15219CFDB44CF9AC58499EFBF2FF88314F249969E415AB220D330EA41CFA5

Function 06C67331 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6690f43db17d77d8ea7e139b0b5b06b7d1993b1372adeef0a852c0a0958bae8
Instruction ID: 61f553021864ce60c97371a18cb1dbfa423495dc311b83bf923cca462161df58
Opcode Fuzzy Hash: b6690f43db17d77d8ea7e139b0b5b06b7d1993b1372adeef0a852c0a0958bae8
Instruction Fuzzy Hash: E481D374A1521ACFDB44CF9AC58499EFBF2FF88314B149969E415AB220D330EA41CFA5

Function 06C6C9F9 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b066e46500334586a1d1245a8e096376a496615f40f30fe27f40c98c287d59fa
Instruction ID: 5bd4a5458e2ddda1bc075f5fa497efeafbc457d014363cd38bc9766b779693de
Opcode Fuzzy Hash: b066e46500334586a1d1245a8e096376a496615f40f30fe27f40c98c287d59fa
Instruction Fuzzy Hash: 53815B74E101298FCB54DF6AC9809AEFBB2FF89304F24C1A9D418A7256D734AE41CF61

Function 06C68748 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 798cb0b46d935e116ade84810a6487ac955a15b3e8feaef1a14e48a61aa62a1a
Instruction ID: dfa3e6ed76afe03883070459e66fccd68a83ed8255a472e13ce60770cfed1597
Opcode Fuzzy Hash: 798cb0b46d935e116ade84810a6487ac955a15b3e8feaef1a14e48a61aa62a1a
Instruction Fuzzy Hash: 0371C774E156098FDB44CFAAC9809DEFBF2FF89210F24942AE415F7254D7349A418B68

Function 06C68739 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55778b33b460b61caf99d8506c10ee8ec55d0a6c49418583222945e81e71c535
Instruction ID: b6ee9776ba8975fefbe8a257c5bf6f18fca67b919a00319fdee159b39e65b17b
Opcode Fuzzy Hash: 55778b33b460b61caf99d8506c10ee8ec55d0a6c49418583222945e81e71c535
Instruction Fuzzy Hash: 1871D974E156098FDB44CF9AC9819DEFBF2FF89210F24942AE415F7254D334AA418B68

Function 06BB5608 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1323923937.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bb0000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b53c168169bd82ed7b728a4d754e123d8648e854d191660f07666650ffdf88d1
Instruction ID: 11824d8d8ecca7568b2ad11cd8956aaf6ce3828139db51a41ebe7126829bfb30
Opcode Fuzzy Hash: b53c168169bd82ed7b728a4d754e123d8648e854d191660f07666650ffdf88d1
Instruction Fuzzy Hash: 905128B1E102198BCB54CFAAC9805AEFBF2BF89304F24C1A9D419A7355D7709941CFA1

Function 06C6BF00 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2957cc5f5eae49ae8e24ec407ceae84eb335168e30e24bb2ee7ebe3785498fb4
Instruction ID: 1250f45eb6a909ede556af17ce117a1b3580860ca8b02dbd5ed393d75442f941
Opcode Fuzzy Hash: 2957cc5f5eae49ae8e24ec407ceae84eb335168e30e24bb2ee7ebe3785498fb4
Instruction Fuzzy Hash: 02413E75D0620ADFDB44CFA6C5816AEFBF2AF88300F20D46AD118F7264D3744B518B95

Function 06C689D8 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4aa3e58d766b3cb69c14cd1be2c9f812e64fc2b0fb296c7a08b4b49932ca6e6
Instruction ID: eead103191d63365ad1781260f5d91a7f9752c36ef224e4a0657b57485a8d560
Opcode Fuzzy Hash: e4aa3e58d766b3cb69c14cd1be2c9f812e64fc2b0fb296c7a08b4b49932ca6e6
Instruction Fuzzy Hash: C641F8B0E0520ACFDB44CFAAC5815AEFBF2EF88200F24D569D915B7254D7349A41CBA8

Function 06C689C8 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3525b6ec872b524753bd61ec0b59f0e9183770f44192f15501969889d5d4c435
Instruction ID: 8a3bb90c44c61b087a178468d93e010ef5bd644b930addd94479b0a431fd0f92
Opcode Fuzzy Hash: 3525b6ec872b524753bd61ec0b59f0e9183770f44192f15501969889d5d4c435
Instruction Fuzzy Hash: 88410DB0E0520ACFDB44CFAAC5815AEFBF2FF88300F24D569D915A7255D7349A41CBA8

Function 06C6BF10 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aede2b08aa1e08eb45a2755aed4159ca8627835c5723551d20947e11d891933
Instruction ID: f8d9ec50a20db6344a6e7d0d621d589e113f9f4df6306c84480a6d0dddf3226a
Opcode Fuzzy Hash: 1aede2b08aa1e08eb45a2755aed4159ca8627835c5723551d20947e11d891933
Instruction Fuzzy Hash: 92413A74E0520ADFDB44CFA6D5816AEFBF1AB98300F10946AD118F7264E3744B518F99

Function 06C68530 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72f8065cec5bcd41e8462389fe26bb1d9575a3a05951bf2082e5ff4bb9fe850a
Instruction ID: 39a3c0fd6c0d1bab08101f5d528de4962b334cb25e8c5bd5cdd9a1c322705caa
Opcode Fuzzy Hash: 72f8065cec5bcd41e8462389fe26bb1d9575a3a05951bf2082e5ff4bb9fe850a
Instruction Fuzzy Hash: 4441C6B0E0560A9FDB44CFAAD4816AEFBF2AF88300F14C46AE515A7254D7349A41CFA4

Function 06C68540 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff3e731150d16741251c6bc63549d78c45eafbc2dae454ebc2d2d424095d4824
Instruction ID: 26314a64eb62cded2ff84465bd3b9d60d1664b33865fb919a0535fbb5d0ff79d
Opcode Fuzzy Hash: ff3e731150d16741251c6bc63549d78c45eafbc2dae454ebc2d2d424095d4824
Instruction Fuzzy Hash: 9F41D4B0D0520ADFDB44CFAAD4805AEFBF2BB88200F14C46AD515B7254D3349A41CFA4

Function 06C63793 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1324037378.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c60000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ddef8c2f9207127810a2a9baba7fdaa9c3abb975c137c3cddbe8de1a589bd2d
Instruction ID: 2770ac9e0c27e945f7a5af07a9c21493beff2172b2bce04e60c29ad3717fbb45
Opcode Fuzzy Hash: 0ddef8c2f9207127810a2a9baba7fdaa9c3abb975c137c3cddbe8de1a589bd2d
Instruction Fuzzy Hash: B221F971E016189BEB58CFAB9C4069EFBF3AFC9200F18C17AD918A6264EB3406558F55

Analysis Process: #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exePID: 7476, Parent PID: 7300COMMON

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	177
Total number of Limit Nodes:	12

Executed Functions

Function 08192220 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

$_q, xrefs: 081923D4

Memory Dump Source

Source File: 00000004.00000002.1494232173.0000000008190000.00000040.00000800.00020000.00000000.sdmp, Offset: 08190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8190000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID: $_q
API String ID: 0-238743419
Opcode ID: f11fbe1b754cfb8f93a8fe6f064868a1887c03bd29cd3c04e65fd5d0d77af59e
Instruction ID: 94e6c5030f6b80bff58a7b0d984b37fb7acedbea35fd44ee9a6a3320053a992d
Opcode Fuzzy Hash: f11fbe1b754cfb8f93a8fe6f064868a1887c03bd29cd3c04e65fd5d0d77af59e
Instruction Fuzzy Hash: 1D71B374E01218DFDF18DFA5D880AADBBB2BF89301F208469D429BB354DB359986CF50

Function 02F2AE30 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02F2B086

Memory Dump Source

Source File: 00000004.00000002.1475348758.0000000002F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f20000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 301360cb6eeb7c3274745d3328210db960c5e3f628bc2efebb2f78caaf0200b3
Instruction ID: 5f6f39073e281fef724d6440c5e92a71f70ca9bd43c210e22a4cd8453876fd87
Opcode Fuzzy Hash: 301360cb6eeb7c3274745d3328210db960c5e3f628bc2efebb2f78caaf0200b3
Instruction Fuzzy Hash: 907157B0A00B158FD724DF2AD54075ABBF1FF89344F00892DE58ADBA50D739E849CB91

Function 05651CE4 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05651E02

Memory Dump Source

Source File: 00000004.00000002.1486208326.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5650000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 1c8b2c68d74af9cf00db1a39eda09a4d1a0b1d2a7a9aff7fb43435cd25d736a4
Instruction ID: b0d00b21559e703f77069b60ab8b6cb54caa169e8d7a42b02505899ae2605149
Opcode Fuzzy Hash: 1c8b2c68d74af9cf00db1a39eda09a4d1a0b1d2a7a9aff7fb43435cd25d736a4
Instruction Fuzzy Hash: 5A51B0B1D00309AFDB14CF99C884ADEBBB5FF49314F64822AE819AB210D7759945CF90

Function 05650AA8 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05651E02

Memory Dump Source

Source File: 00000004.00000002.1486208326.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5650000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 688f0621e2e15eb2ab027587f89644f52cffdb01e92805343007d3866384f7dc
Instruction ID: 4ef4701c2ec72cf45bd51b91982b86f581ae9e8c7ef1c681e3aa7afe1fcf64b6
Opcode Fuzzy Hash: 688f0621e2e15eb2ab027587f89644f52cffdb01e92805343007d3866384f7dc
Instruction Fuzzy Hash: 755190B1D0034DAFDB14CF99C984ADEBBB6FF49310F64812AE819AB210D7759945CF90

Function 05650BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05654381

Memory Dump Source

Source File: 00000004.00000002.1486208326.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5650000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: e5b9dade767406ba7c162a7baa310211e70dbe355eeb7e45247ca581abf2904a
Instruction ID: a815ad2991b44060c0e925aa29cefb7155f4cd9425801d320eba3013020b8f00
Opcode Fuzzy Hash: e5b9dade767406ba7c162a7baa310211e70dbe355eeb7e45247ca581abf2904a
Instruction Fuzzy Hash: 0C413BB5900309DFCB14CF9AC448AAABBF5FF88324F14C599E919A7321D735A845CFA0

Function 02F24248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02F259F1

Memory Dump Source

Source File: 00000004.00000002.1475348758.0000000002F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f20000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 6a9bb1c1a33d5c486a0e629f00ed621cb6f6e40de69a5d816bf30c4aaeb1293a
Instruction ID: 25cc37e155b27e83eff9356da1ea324e45e5118679db5ad8ebc67a73c5412910
Opcode Fuzzy Hash: 6a9bb1c1a33d5c486a0e629f00ed621cb6f6e40de69a5d816bf30c4aaeb1293a
Instruction Fuzzy Hash: 6341EFB0D0062DCFDB24DFA9C884B9DBBB5FF49304F60806AD408AB254DB756949CF90

Function 02F25935 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02F259F1

Memory Dump Source

Source File: 00000004.00000002.1475348758.0000000002F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f20000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0b195c6f249ff6c17cfdd56ec7b437b27781bdf669f41e8886b341e6dc2f7e8b
Instruction ID: ff0210a69d6aca87c7f3d80110c817261e5a975b6ff7e89a90a403f0029b05f7
Opcode Fuzzy Hash: 0b195c6f249ff6c17cfdd56ec7b437b27781bdf669f41e8886b341e6dc2f7e8b
Instruction Fuzzy Hash: 9441F0B0D00629CFDB24DFA9C884B8DBBB5FF49304F20806AD408BB255DB756949CF90

Function 02F2C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02F2D2C6,?,?,?,?,?), ref: 02F2D387

Memory Dump Source

Source File: 00000004.00000002.1475348758.0000000002F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f20000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: df17e80c19d78148736af95b15e85601b2d72c7e1d396b8b069b1c387900ff38
Instruction ID: eaad3d8a3df230525dd0a68cd19b00c3d5f127ddf3a4f29f135ae8df5d6a6064
Opcode Fuzzy Hash: df17e80c19d78148736af95b15e85601b2d72c7e1d396b8b069b1c387900ff38
Instruction Fuzzy Hash: 3B21E4B5D00218AFDB10DFAAD984ADEBFF4FB49310F14845AE918A3310D375A954CFA4

Function 02F2D2F9 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02F2D2C6,?,?,?,?,?), ref: 02F2D387

Memory Dump Source

Source File: 00000004.00000002.1475348758.0000000002F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f20000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 33293f4e08db3d31ad0b3a5fd5077fbf8c6cbd315648498e2519b542702cef1a
Instruction ID: 203a5e7f2d04d757d80d983d8268cf8ed84d324d1b259592f2de6fc0edf52f4d
Opcode Fuzzy Hash: 33293f4e08db3d31ad0b3a5fd5077fbf8c6cbd315648498e2519b542702cef1a
Instruction Fuzzy Hash: 3721E0B5D00218AFDB10CFA9D985ADEBBF4EB48314F14841AE918B3210D374A954CFA0

Function 05657260 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 056572DC

Memory Dump Source

Source File: 00000004.00000002.1486208326.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5650000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 33e8ecb059b8bfaf8d3c6adc2c0d02f6092a8c643c9838f66902152782782309
Instruction ID: 32c3604d3e80b4abeb722efba9d07e6bc17be1667f5a2ee532cf0e2848e70f41
Opcode Fuzzy Hash: 33e8ecb059b8bfaf8d3c6adc2c0d02f6092a8c643c9838f66902152782782309
Instruction Fuzzy Hash: 1521D074E152189BCB08CFA9E988ADDBBF6FF88310F10502AE805B3350DB341945CB54

Function 08196AF1 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 08196B55

Memory Dump Source

Source File: 00000004.00000002.1494232173.0000000008190000.00000040.00000800.00020000.00000000.sdmp, Offset: 08190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8190000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 01121c6850dddad5575b7dc1083d513a251add861860630ffc81fee2ffb502be
Instruction ID: 5becf02897da4a6b7e28610e919f720bb1a3c35a171b70b9a426131ae179291a
Opcode Fuzzy Hash: 01121c6850dddad5575b7dc1083d513a251add861860630ffc81fee2ffb502be
Instruction Fuzzy Hash: 0C1110B59003499FCB10DF9AD888BDEBBF8EB48320F10845AE858A7200D375A954CFB1

Function 08195E28 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 08196B55

Memory Dump Source

Source File: 00000004.00000002.1494232173.0000000008190000.00000040.00000800.00020000.00000000.sdmp, Offset: 08190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8190000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ce68b8965a6fe01a9f2997a8e13ebf5fd74fc6e2adae00fcd123aac22279dc84
Instruction ID: 90ac7fb8813d13b39836e3fbba48919be058588ccd6149b351396e391924bf04
Opcode Fuzzy Hash: ce68b8965a6fe01a9f2997a8e13ebf5fd74fc6e2adae00fcd123aac22279dc84
Instruction Fuzzy Hash: 1F11FEB59003499FCB10DF9AC988BDEBBF8FB58320F10845AE959A7200D375A954CFB5

Function 02F2B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02F2B086

Memory Dump Source

Source File: 00000004.00000002.1475348758.0000000002F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f20000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8fda32fa249bd0230a42d7923094cf872607a481ca25dcd5c894512595ac3bdf
Instruction ID: 9bf944d4a3ea94925c8ff50dfbb8c86c62e18c903b35b46862dac54a0fb6c0b9
Opcode Fuzzy Hash: 8fda32fa249bd0230a42d7923094cf872607a481ca25dcd5c894512595ac3bdf
Instruction Fuzzy Hash: 92110FB6D003498FCB20DF9AC844B9EFBF4AB89714F10841AD929B7210C375A549CFA5

Function 0159D654 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1471788624.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_159d000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32f021acafcf28cfe56e6037a9b74c4cacec72eaf22dbbcbdc7d538bf7287184
Instruction ID: c7cc562390d282fbb23850a255b08c65f2f82644c5828a66d637812107b82b09
Opcode Fuzzy Hash: 32f021acafcf28cfe56e6037a9b74c4cacec72eaf22dbbcbdc7d538bf7287184
Instruction Fuzzy Hash: 9021F476504240DFCF05DF98D9C0B2ABFB5FB88314F248669E9490F256C33AD416CBA2

Function 015AD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1471895605.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15ad000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff25a36a309d6edbb8c9f0ea81bdd0dd78b18c36ed861c8af5d551c282723a07
Instruction ID: 9edc9a592279d1340c5671f5a6c59beb7408902d299b70e26249fe1d3ef54c0c
Opcode Fuzzy Hash: ff25a36a309d6edbb8c9f0ea81bdd0dd78b18c36ed861c8af5d551c282723a07
Instruction Fuzzy Hash: 33214271284200DFCB11EF68D980B2ABFB1FB88314F60C96DE80A0F656D33AD407CA61

Function 015AD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1471895605.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15ad000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88a53442e809473c3a2fe73736c70574638b1fda37130b7e119ce49cef8fbbff
Instruction ID: f104dd22e3fc93bcf5311351c30e2577c79d1eea0ae4c6820c4b3571fceb3a57
Opcode Fuzzy Hash: 88a53442e809473c3a2fe73736c70574638b1fda37130b7e119ce49cef8fbbff
Instruction Fuzzy Hash: DA21CF355483808FCB03CF24C990719BF71FB46214F29C1EAD8498F6A3C33A980ACB62

Function 0159D64F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1471788624.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_159d000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba41b1534e0b140cab357806c61da93050629d49bf63a26b6c0316e6a0221c2
Instruction ID: 35c17133fe73b04c6f6167fbeb6124f56006f3ba3f9c830388290ba8fb530ed3
Opcode Fuzzy Hash: 0ba41b1534e0b140cab357806c61da93050629d49bf63a26b6c0316e6a0221c2
Instruction Fuzzy Hash: 93219D76504280DFDF16CF54D9C4B1ABF72FB88314F2486A9E9490E256C33AD426CB92

Function 0159D9D9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1471788624.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_159d000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e98dfcbf683a49f38926b3ecb4f9581a969ddf74e7323658005a7443b84e61
Instruction ID: e799cebd88c11411f24cfdb70635979af7e8fc80c2a90730586fa2244fd55749
Opcode Fuzzy Hash: c0e98dfcbf683a49f38926b3ecb4f9581a969ddf74e7323658005a7443b84e61
Instruction Fuzzy Hash: 9601F7711083449AEB209A9ACD84B66FFE8FF41320F08C95AED095E286C3BC9840C672

Function 0159D9D8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1471788624.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_159d000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca15ff1bce9a14a5c893f8a4637decb63c9a0e30b9f0050854339ddc79f2a77f
Instruction ID: 1573f0a5f7cfe2b3d796fd074b70ddbc6caaacb885897934415a2d6278013aab
Opcode Fuzzy Hash: ca15ff1bce9a14a5c893f8a4637decb63c9a0e30b9f0050854339ddc79f2a77f
Instruction Fuzzy Hash: 18F0C271408344AEEB208A0ACC84B66FFA8FF41224F18C45AED085E286C2B99844CA71

Non-executed Functions

Function 08190CEC Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1494232173.0000000008190000.00000040.00000800.00020000.00000000.sdmp, Offset: 08190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8190000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee834dc59e897df0fbf3fccc506cffa317c79dfbcbb1c53689eef25337bd596
Instruction ID: d994b56254140a3b343a4e547e81ff7b55caed0294b19e2e1c4640bafcd2aa72
Opcode Fuzzy Hash: 4ee834dc59e897df0fbf3fccc506cffa317c79dfbcbb1c53689eef25337bd596
Instruction Fuzzy Hash: 97F065B0C05619CFEF288F54D8987BEBBB4BF0A30AF106059D05A73180CBB55A88DF84

Function 08194659 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1494232173.0000000008190000.00000040.00000800.00020000.00000000.sdmp, Offset: 08190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_8190000_#U0417#U0430#U043f#U0440#U043e#U0441 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ad507661c3f7d1fd71aab3dcceaec9d263e44b0a0390cfec669461c8c972188
Instruction ID: fdf5e509bcc753189323126eaf42c64a1dc4913a973ed39f928c44d01e6c23f9
Opcode Fuzzy Hash: 6ad507661c3f7d1fd71aab3dcceaec9d263e44b0a0390cfec669461c8c972188
Instruction Fuzzy Hash: 2EE09274C4610EDAEF18CF51E4147FFF6746F45305F606449C80673240DB704A468FAA

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report #U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

Windows Analysis Report
#U0417#U0430#U043f#U0440#U043e#U0441 11.12.2024.exe

Function 0556CECC Relevance: 6.9, Strings: 5, Instructions: 623
COMMON

Function 06C64293 Relevance: 4.0, Strings: 3, Instructions: 247
COMMON

Function 06C642DF Relevance: 4.0, Strings: 3, Instructions: 225
COMMON

Function 06C642F0 Relevance: 4.0, Strings: 3, Instructions: 219
COMMON

Function 06C66371 Relevance: 2.9, Strings: 2, Instructions: 388
COMMON

Function 06C6633A Relevance: 2.9, Strings: 2, Instructions: 377
COMMON

Function 06C66458 Relevance: 2.8, Strings: 2, Instructions: 284
COMMON

Function 06C6D280 Relevance: 2.7, Strings: 2, Instructions: 224
COMMON

Function 06C6D270 Relevance: 2.7, Strings: 2, Instructions: 223
COMMON

Function 00D0D1C8 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Function 00D0D1D8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON