Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1519329
MD5:	2cfc1aa34c34f4968b099aa7646097a5
SHA1:	8f0474e95ebd679be59eb2c002056bef9361305c
SHA256:	330b91473f27721d99e11cde67a05631aefcac78b6b69fc7b6bb61bd053ddbe6
Tags:	exeuser-Bitsight
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Installs new ROOT certificates

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3196 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 2CFC1AA34C34F4968B099AA7646097A5)

conhost.exe (PID: 6704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 5536 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "91.211.248.215:24327", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.2366089599.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2170183129.0000000003A95000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: file.exe PID: 3196	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5536	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5536	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.3a95570.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.3a95570.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T11:32:14.378994+0200	2043234	1	A Network Trojan was detected	91.211.248.215	24327	192.168.2.6	49711	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T11:32:14.203025+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:19.440734+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:20.100634+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:20.373552+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:20.832089+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:21.060538+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:22.487259+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:22.666955+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:23.013834+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:23.253329+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:23.440567+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:23.732396+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:24.016824+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:24.193018+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:24.418887+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:26.087980+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:26.402758+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:26.407741+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:27.181688+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:27.398083+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:27.574784+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:27.754493+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:27.930030+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:28.105518+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:28.355607+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T11:32:20.106375+0200	2046056	1	A Network Trojan was detected	91.211.248.215	24327	192.168.2.6	49711	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T11:32:14.203025+0200	2046045	1	A Network Trojan was detected	192.168.2.6	49711	91.211.248.215	24327	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.2170183129.0000000003A95000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "91.211.248.215:24327", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.6:49711 -> 91.211.248.215:24327
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.6:49711 -> 91.211.248.215:24327
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 91.211.248.215:24327 -> 192.168.2.6:49711
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 91.211.248.215:24327 -> 192.168.2.6:49711

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 91.211.248.215:24327

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 91.211.248.215:24327

Source: Joe Sandbox View

ASN Name: ON-LINE-DATAServerlocation-NetherlandsDrontenNL ON-LINE-DATAServerlocation-NetherlandsDrontenNL

Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215
Source: unknown	TCP traffic detected without corresponding DNS query: 91.211.248.215

Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9(
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002B96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2367662005.0000000002927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2367662005.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: file.exe, 00000000.00000002.2170183129.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2366089599.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp255B.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp251C.tmp			Jump to dropped file

System Summary

.NET source code contains very large array initializations

Source: file.exe, MoveAngles.cs

Large array initialization: MoveAngles: array initializer size 311296

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00C1DC74	3_2_00C1DC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_04DE6948	3_2_04DE6948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_04DE7C20	3_2_04DE7C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_04DE0040	3_2_04DE0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_04DE0007	3_2_04DE0007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_04DE7C10	3_2_04DE7C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_04DE5A43	3_2_04DE5A43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_060F67D8	3_2_060F67D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_060FA3E8	3_2_060FA3E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_060F3F50	3_2_060F3F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_060FA3D8	3_2_060FA3D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_060F6FE8	3_2_060F6FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_060F6FF8	3_2_060F6FF8

Source: file.exe, 00000000.00000002.2167248594.0000000000ACE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000002.2170183129.0000000003AD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSeditions.exe8 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameVQP.exe< vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/7@0/1

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6704:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\Tmp251C.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002DF0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2367662005.0000000002E06000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.3.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_060FC711 push es; ret	3_2_060FC720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_060FD412 push es; ret	3_2_060FD420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_060FECF2 push eax; ret	3_2_060FED01

Source: file.exe

Static PE information: section name: .text entropy: 7.994517021039135

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 1080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2A90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: C10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2830000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4830000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Window / User API: threadDelayed 5244

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 2276	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4864	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3360	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: RegAsm.exe, 00000003.00000002.2380933754.0000000005A8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2367662005.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2367662005.0000000002D12000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2367662005.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2367662005.00000000029CF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2367662005.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJm6+yF+1A6ySN83i+WdwHy5TP6AGa54yNOQDMt0K/OHXfg+kqThLIfk6QFsLDCjZdpZTGOzjUsCOwZe5C6Gi8Q8TVSedBLpSfsvQj8BDp18kmZ3ex54YP0+Gs0yuOc0oHyahpuklKSN9DNVuBZhWH/uMHS1PAuQ5a2Lju9F/SWeKm7prBc0jVP84iPJxdnHVJ/HDDDbXL54Z89qdU0Vcin6gqmwXrJjGgP4IA8IR19qewIwTnUCQdrTZp1GW0u9j1R6sUgPUrm2c5cvXl9oot3E2Yi+lA6TVxs+wzTv0RyoJlnAb/LVyrQ+JXXkt08JQiqZojt7zmAq6A6TMAI3d99XjZOb1H2Ej05cPkbrRi3jsQ/1cA/+FiEaSdYURoSjyCbui7SR58sFKCEAn3HKH4uwm3eDW6eeqSVnn3vRu5S+ZPUrZgKYs8lgl1/fYieGCfbdnVWn1in27qZ19Yfhv4WKpf3SAPgywfR4sYK3wdc8VGoHmK3TWFL5jmOUHB49Ogy2jYoedRvh3h9D96fGhUBv0WbVKW3Fxq4ViXVL2x9NKNgA+vC8A5zUncE8H2TafulfEOSRqFccYu86ht5uc0nLgpiCrzoulmnAYZLfk4zbvX51WQrYMsc8ORmzRWmqqLFXZVINxxVKaxrpheUhYRfRx54cZnzZZxdMOYT0VhpWbZdIcVFHnb3QBFJEgxwyQpCTte0yQjzn7uCUZsuA+iYIJO4a+Hmq+9ONtmOcMMYl7TbktlwpTMf366yxqm+uPbWY4CHOTnXrwGvPjnt7OfVwg2HHr8jHcJ5uzn/JOx/BvEfztbLR
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: RegAsm.exe, 00000003.00000002.2371076778.00000000038DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2371076778.0000000003937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_02A92139 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_02A92139

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 78E008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000003.00000002.2380933754.0000000005AAB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.3a95570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3a95570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2366089599.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2170183129.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5536, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5536, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.3a95570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3a95570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2366089599.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2170183129.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5536, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Install Root Certificate	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	39%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14ResponseD	RegAsm.exe, 00000003.00000002.2367662005.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	RegAsm.exe, 00000003.00000002.2367662005.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21Response	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	RegAsm.exe, 00000003.00000002.2367662005.0000000002985000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id4	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19Response	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13ResponseD	RegAsm.exe, 00000003.00000002.2367662005.0000000002927000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15Response	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	RegAsm.exe, 00000003.00000002.2367662005.0000000002977000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000003.00000002.2367662005.0000000002927000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6Response	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	file.exe, 00000000.00000002.2170183129.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2366089599.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9Response	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24Response	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1Response	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21ResponseD	RegAsm.exe, 00000003.00000002.2367662005.0000000002927000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	RegAsm.exe, 00000003.00000002.2367662005.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15ResponseD	RegAsm.exe, 00000003.00000002.2367662005.0000000002927000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11ResponseD	RegAsm.exe, 00000003.00000002.2367662005.0000000002B96000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17ResponseD	RegAsm.exe, 00000003.00000002.2367662005.0000000002927000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	RegAsm.exe, 00000003.00000002.2367662005.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8ResponseD	RegAsm.exe, 00000003.00000002.2367662005.0000000002927000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	RegAsm.exe, 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
91.211.248.215	unknown	Ukraine		204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519329
Start date and time:	2024-09-26 11:31:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/7@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 89 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
05:32:24	API Interceptor	27x Sleep call for process: RegAsm.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ON-LINE-DATAServerlocation-NetherlandsDrontenNL	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer	Browse	45.91.200.135
	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Cryptbot, Go Injector, LummaC Stealer, PrivateLoader, PureLog Stealer	Browse	92.119.114.169
	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Cryptbot, Go Injector, LummaC Stealer, PrivateLoader, PureLog Stealer	Browse	92.119.114.169
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	45.91.200.135
	9poHPPZxlB.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	92.119.114.169
	file.exe	Get hash	malicious	Unknown	Browse	92.119.114.169
	file.exe	Get hash	malicious	Unknown	Browse	92.119.114.169
	SecuriteInfo.com.Trojan.PWS.RedLineNET.9.5979.19330.exe	Get hash	malicious	RedLine	Browse	77.83.175.241
	cHQg24hABF.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Stealc, Vidar, XWorm, zgRAT	Browse	92.119.114.169
	file.exe	Get hash	malicious	Unknown	Browse	92.119.114.169

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 05:47:19 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.4666706587201315
Encrypted:	false
SSDEEP:	48:8SQd5TvG90lRYrnvPdAKRkdAGdAKRFdAKR6P:8S6by7
MD5:	35A80D01B48EA8A6F909CD1A55CFF163
SHA1:	642B7F564B38B40568DBDF38992B6D402D3370CC
SHA-256:	5F00AADB8B2A4A8481AC48A0F20676E02DF7E0973AB5DC955A53FA28AE4D3DDF
SHA-512:	9D730C2632A8988980E36D47CBB2857B5F3864B80ACF6849DD0695F51F1E31347E675406F70312C5BBF58DEC2A1EA4810BA1F1B76D3707AA42497B86DB056149
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,..../.!.W....X.&&... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.IEW.5....B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEW@2....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.2..Chrome..>......CW.VEW.2....M.....................7...C.h.r.o.m.e.....`.1.....EW.2..APPLIC~1..H......CW.VEW.2..........................7...A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.L .chrome.exe..F......CW.VEW.5.........................l...c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Temp\Tmp251C.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp255B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	33
Entropy (8bit):	2.2845972159140855
Encrypted:	false
SSDEEP:	3:i6vvRyMivvRya:iKvHivD
MD5:	45B4C82B8041BF0F9CCED0D6A18D151A
SHA1:	B4DAD3FFFEF507CBB78671EE620BB495F8CE22F1
SHA-256:	7CFA461ED1FC8611AB74878EDB1FBBDE3596F5D042946A42A7F31EB6D462E628
SHA-512:	B29C3696A8A311EFAF9B9709BA082FF2C8D45A6912D79BC1DE7FEEFBEF8F8DDEFCD6650B5E1165D0A79800C8AED399E2B11BC2431E3837DD8587516BDE50EAB5
Malicious:	false
Preview:	0..1..2..3..4..0..1..2..3..4.....

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.986693995498632
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	321'536 bytes
MD5:	2cfc1aa34c34f4968b099aa7646097a5
SHA1:	8f0474e95ebd679be59eb2c002056bef9361305c
SHA256:	330b91473f27721d99e11cde67a05631aefcac78b6b69fc7b6bb61bd053ddbe6
SHA512:	81a4b338cf5a931e7a24c5de37069aec288cfbdd5f94895c470bef2f3407eea3e1046d5072e690430288719560baa4d63f21b89876c07d63811b5da3a9611e81
SSDEEP:	6144:89ecSWylbPXlZctxOTyORbnRRX8LC3V7/9rQxf08+LFYM:89eDNvcqT9Z7WC5/9ES8y
TLSH:	DB6423946B830172E1C84B32AEB7EA6DD0F7F5130342778F66EC0C8E92A59AD715B471
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....\|.f................................. ........@.. .......................@............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x44fcee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F47C82 [Wed Sep 25 21:11:30 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4fc94	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x50000	0x5b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x52000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4fb5c	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4dcf4	0x4de00	8945b009e71a4c00f6e1b387d369c222	False	0.992406952247191	data	7.994517021039135	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x50000	0x5b8	0x600	59c39f15f05bc5bec30f54a84b9c8ed2	False	0.4361979166666667	data	4.110921347030149	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x52000	0xc	0x200	018bc3404a75d8e475430c0894fe6423	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x500a0	0x324	data			0.4552238805970149
RT_MANIFEST	0x503c8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-26T11:32:14.203025+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:14.203025+0200	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:14.378994+0200	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	91.211.248.215	24327	192.168.2.6	49711	TCP
2024-09-26T11:32:19.440734+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:20.100634+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:20.106375+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	91.211.248.215	24327	192.168.2.6	49711	TCP
2024-09-26T11:32:20.373552+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:20.832089+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:21.060538+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:22.487259+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:22.666955+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:23.013834+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:23.253329+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:23.440567+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:23.732396+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:24.016824+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:24.193018+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:24.418887+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:26.087980+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:26.402758+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:26.407741+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:27.181688+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:27.398083+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:27.574784+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:27.754493+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:27.930030+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:28.105518+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP
2024-09-26T11:32:28.355607+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49711	91.211.248.215	24327	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 11:32:13.500581980 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:13.505496025 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:13.505647898 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:13.523066998 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:13.527842045 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:14.141542912 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:14.184636116 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:14.203025103 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:14.207935095 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:14.378993988 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:14.434525967 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:19.440733910 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:19.445719004 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:19.620354891 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:19.620385885 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:19.620441914 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:19.620455980 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:19.620469093 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:19.620481014 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:19.620482922 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:19.620639086 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:20.100634098 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:20.106374979 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:20.299901009 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:20.340761900 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:20.373552084 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:20.378576040 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:20.378592968 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:20.378616095 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:20.378627062 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:20.378635883 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:20.378643990 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:20.378664017 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:20.378673077 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:20.378679991 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:20.378690004 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:20.378735065 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:20.383609056 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:20.383627892 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:20.383636951 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:20.819842100 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:20.832088947 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:20.836893082 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:21.009042978 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:21.059515953 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:21.060538054 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:21.066297054 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:21.235510111 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:21.278279066 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:22.487258911 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:22.492295980 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:22.661741972 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:22.666954994 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:22.671750069 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:22.841356993 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:22.887653112 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:23.013834000 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:23.019962072 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:23.189404964 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:23.231429100 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:23.253329039 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:23.260410070 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:23.430255890 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:23.440567017 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:23.445400953 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:23.615128040 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:23.668874025 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:23.732395887 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:23.737320900 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:23.977459908 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:24.016824007 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:24.022330999 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:24.191739082 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:24.193017960 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:24.197875023 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:24.367187977 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:24.418886900 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.087980032 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.092912912 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.263606071 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.309518099 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.402757883 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.407677889 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.407737970 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.407741070 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.407748938 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.407785892 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.407793045 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.407795906 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.407874107 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.408128023 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.408186913 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.408222914 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.408286095 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.408443928 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.408452988 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.408504963 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.409744024 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.409801960 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.413697004 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.413716078 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.413724899 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.413741112 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.413747072 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.413763046 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.413810015 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.413810968 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.413871050 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.413906097 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.413942099 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.413959980 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.413983107 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.414048910 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.414063931 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.414120913 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.414293051 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.414313078 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.414321899 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.414340973 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.414390087 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.414542913 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.414592028 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.419296026 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419347048 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419361115 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419365883 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.419394016 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419418097 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.419450045 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419457912 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.419461966 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419523001 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.419713974 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419723988 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419740915 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419750929 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419754982 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419758081 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419766903 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419775009 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419780970 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.419791937 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419799089 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.419800043 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419819117 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419831991 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419877052 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419887066 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419903994 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419913054 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.419998884 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.420006037 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.420012951 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.420017004 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.420037985 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.420044899 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.420047045 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.420088053 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.420101881 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.420114040 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.420125961 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.420140028 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.420149088 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.420191050 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.420197010 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.420212030 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.420221090 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.420249939 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.420275927 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.420315981 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.420361996 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.420366049 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.420377970 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.420387030 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.420396090 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.420403957 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.420413017 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.420423985 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.420428991 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.424119949 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424130917 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424141884 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424150944 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424209118 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424220085 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424243927 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424256086 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424369097 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424401999 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424411058 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424421072 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424607038 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424619913 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424628973 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424638033 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424645901 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424654961 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424670935 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424685001 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424705982 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424715042 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424767017 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424777031 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424796104 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424804926 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424814939 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424869061 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424877882 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424911976 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424932003 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424941063 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.424952030 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425034046 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425045967 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425070047 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425079107 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425091028 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425160885 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425175905 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425185919 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425205946 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425261021 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425266981 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.425271988 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425286055 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425332069 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.425348997 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425544977 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425554037 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425561905 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425570965 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425580025 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425587893 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425599098 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425611019 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425627947 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425636053 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425674915 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425715923 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425764084 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425786018 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425868034 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425899029 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425964117 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.425982952 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426040888 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426049948 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426110983 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426131010 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426219940 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426230907 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426336050 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426347017 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426543951 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426553965 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426562071 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426570892 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426579952 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426588058 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426597118 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426604986 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426625013 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426635981 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426763058 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426774979 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.426981926 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.427047968 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.430201054 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430254936 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430318117 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430326939 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430366993 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430382013 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430408955 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430419922 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430468082 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430479050 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430505991 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430535078 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430605888 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430619955 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430638075 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430701017 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430759907 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430771112 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430844069 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430855036 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430871964 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430886030 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430955887 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430967093 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.430977106 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431049109 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431123018 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431188107 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431196928 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431262016 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431267977 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431312084 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431354046 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431406021 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431420088 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431436062 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431444883 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431483030 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431490898 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431519032 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431549072 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431610107 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431618929 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431628942 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431736946 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431746960 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431756020 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431781054 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431790113 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431835890 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431848049 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431922913 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431936026 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.431945086 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.432202101 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.432255030 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.432763100 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.432773113 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.432842016 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.432863951 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.432939053 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.432950020 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433017015 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433037043 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433101892 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433114052 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433152914 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433181047 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433303118 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433357000 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433391094 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433455944 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433480024 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433490992 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433568001 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433582067 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433664083 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433675051 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433716059 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433763027 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433798075 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433839083 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433957100 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.433968067 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434031010 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434088945 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434130907 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434168100 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434250116 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434263945 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434299946 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434312105 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434323072 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434376955 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434428930 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434442043 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434478998 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434492111 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434565067 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434580088 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434622049 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434633970 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434669018 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434679985 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434746981 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434760094 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434770107 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434779882 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434839964 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.434849024 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.435087919 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.435153008 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.437041044 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437135935 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437145948 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437201023 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437223911 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437309980 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437315941 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437360048 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437370062 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437405109 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437427044 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437443972 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437453985 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437500000 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437513113 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437681913 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437694073 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437716961 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437731028 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437752962 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437762022 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437809944 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437818050 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437916040 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437927008 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437947035 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437961102 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.437992096 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438005924 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438043118 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438054085 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438203096 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438214064 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438221931 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438231945 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438249111 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438263893 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438288927 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438329935 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438416004 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438472986 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438500881 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438512087 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438523054 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438544035 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438601017 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438611984 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438632011 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438642979 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438678980 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438689947 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438721895 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438733101 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.438766003 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.439208031 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.439273119 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.440069914 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440073967 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440079927 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440084934 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440097094 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440105915 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440140009 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440234900 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440243959 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440253019 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440295935 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440306902 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440327883 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440336943 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440375090 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440386057 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440407991 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440419912 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440459013 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440469980 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440500021 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440551043 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440598011 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440608025 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440615892 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440624952 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440645933 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440654039 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440670013 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440687895 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440819979 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440836906 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440979004 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440988064 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.440998077 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.441005945 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.441026926 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.441035986 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.441044092 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.441056013 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.441066027 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.441078901 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.441127062 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.441137075 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.441180944 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.441190958 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.441215038 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.441224098 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.441313028 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.441323996 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.441374063 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.441384077 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.441410065 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.441418886 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.441627979 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.441692114 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.444094896 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444106102 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444117069 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444133997 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444191933 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444201946 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444224119 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444272995 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444318056 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444329023 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444369078 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444381952 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444447041 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444459915 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444488049 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444498062 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444524050 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444534063 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444582939 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444593906 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444603920 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444617987 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444652081 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444662094 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444719076 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444735050 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444753885 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444763899 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444811106 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444820881 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444868088 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444880962 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444911003 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444921970 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444933891 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.444997072 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.445010900 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.445019960 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.445049047 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.445058107 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.445101023 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.445110083 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.445158005 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.445168018 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.445235968 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.445246935 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.445267916 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.445276976 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.445287943 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.445307970 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.445358038 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.445364952 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.445431948 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.446585894 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.446594000 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.446609020 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.446619987 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.446667910 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.446861029 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.446944952 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.490483046 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:26.490678072 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:26.538522959 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:27.130790949 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:27.181688070 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:27.186940908 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:27.356564045 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:27.398082972 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:27.402975082 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:27.572617054 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:27.574784040 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:27.579878092 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:27.749222040 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:27.754492998 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:27.759514093 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:27.759522915 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:27.759537935 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:27.759542942 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:27.929349899 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:27.930030107 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:27.934984922 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:28.104507923 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:28.105518103 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:28.110444069 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:28.280884981 CEST	24327	49711	91.211.248.215	192.168.2.6
Sep 26, 2024 11:32:28.325145006 CEST	49711	24327	192.168.2.6	91.211.248.215
Sep 26, 2024 11:32:28.355607033 CEST	49711	24327	192.168.2.6	91.211.248.215

Target ID:	0
Start time:	05:32:05
Start date:	26/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x580000
File size:	321'536 bytes
MD5 hash:	2CFC1AA34C34F4968B099AA7646097A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2170183129.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:32:05
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:32:07
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x510000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.2366089599.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2367662005.00000000028D8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	40%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	30%
Total number of Nodes:	20
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02A92139 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02A920AB,02A9209B), ref: 02A922A8
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02A922BB
Wow64GetThreadContext.KERNEL32(000000A8,00000000), ref: 02A922D9
ReadProcessMemory.KERNELBASE(000000A4,?,02A920EF,00000004,00000000), ref: 02A922FD
VirtualAllocEx.KERNELBASE(000000A4,?,?,00003000,00000040), ref: 02A92328
WriteProcessMemory.KERNELBASE(000000A4,00000000,?,?,00000000,?), ref: 02A92380
WriteProcessMemory.KERNELBASE(000000A4,00400000,?,?,00000000,?,00000028), ref: 02A923CB
WriteProcessMemory.KERNELBASE(000000A4,?,?,00000004,00000000), ref: 02A92409
Wow64SetThreadContext.KERNEL32(000000A8,05110000), ref: 02A92445
ResumeThread.KERNELBASE(000000A8), ref: 02A92454

Strings

SetThreadContext, xrefs: 02A9225F
ReadProcessMemory, xrefs: 02A92226
aryA, xrefs: 02A9217F
TerminateProcess, xrefs: 02A92337
ResumeThread, xrefs: 02A92275
VirtualAlloc, xrefs: 02A92200
GetP, xrefs: 02A921BB
CreateProcessA, xrefs: 02A921ED
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 02A922A7
ress, xrefs: 02A921C3
Load, xrefs: 02A92177
WriteProcessMemory, xrefs: 02A9224C
VirtualAllocEx, xrefs: 02A92239
GetThreadContext, xrefs: 02A92213

Memory Dump Source

Source File: 00000000.00000002.2168767629.0000000002A91000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a91000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 7f84bbe7c32c24a0261f5cc644a5581fbc81e0aca9ed0216a091c3bf93dd5d0f
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: E8B1F57660024AAFDB60CF69CC80BDA73E5FF88714F158164EA0CAB341D774FA518B94

Function 02911268 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 029112F0

Memory Dump Source

Source File: 00000000.00000002.2168655968.0000000002910000.00000040.00000800.00020000.00000000.sdmp, Offset: 02910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2910000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 62d2749fe53e70e7849385be0c01a28fd1dcaacd89f99b7d784e8323dcad9f36
Instruction ID: 1b294850b1d0d38cac4d3b98c4ecd2cff60b0ff6fe6703448522a59538843956
Opcode Fuzzy Hash: 62d2749fe53e70e7849385be0c01a28fd1dcaacd89f99b7d784e8323dcad9f36
Instruction Fuzzy Hash: 152123B190134D9FDB10DFAAC881ADEBBF4FF48310F10842AEA19A7250C774A901CFA1

Function 02911270 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 029112F0

Memory Dump Source

Source File: 00000000.00000002.2168655968.0000000002910000.00000040.00000800.00020000.00000000.sdmp, Offset: 02910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2910000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 00eb5770f546bc383c7f4057d8d33f65e3e939906fc574701d00316fda58d10b
Instruction ID: b1241658a181c080a8e700ba2a678b3d811d3238fa924afe69c5b40b984b5a43
Opcode Fuzzy Hash: 00eb5770f546bc383c7f4057d8d33f65e3e939906fc574701d00316fda58d10b
Instruction Fuzzy Hash: E921E2B190124D9FDF10DFAAC981ADEBBF4FF48710F10842AEA19A7250C775A914CFA5

Analysis Process: RegAsm.exePID: 5536, Parent PID: 3196COMMON

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	82
Total number of Limit Nodes:	7

Executed Functions

Function 060F3F50 Relevance: .5, Instructions: 526COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597a5d34ae3af5d2c427ed9fa87e179771ebecd0f896c52a4a81395dc0c1445b
Instruction ID: 32755793910af50ec796e9aecc13857ff1aabc49c7b8ed5fc9ffb84a1772a514
Opcode Fuzzy Hash: 597a5d34ae3af5d2c427ed9fa87e179771ebecd0f896c52a4a81395dc0c1445b
Instruction Fuzzy Hash: 16127F34B502058FDB54DF68C884AAEBBF6BF88710B148169E906EB765DB71EC41CB90

Function 04DE6948 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2379471819.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4de0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61b7659ab07514ae9faee5d5c7985384225610975a979f97f044f4a668509d2b
Instruction ID: 7dece76504e7ae550fb39bda26b366fc4ea264b18c40bcc7f86510859e7b9c49
Opcode Fuzzy Hash: 61b7659ab07514ae9faee5d5c7985384225610975a979f97f044f4a668509d2b
Instruction Fuzzy Hash: 9322E175A01228DFDB65DF61C954BE9BBB2FF49300F4084E9D109AB2A1DB75AE84CF40

Function 060F67D8 Relevance: .4, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1088167e9135a4bab1ce39819b7cfb47d09dbd680bea308633cd4b4f6126a92a
Instruction ID: 7fbeeecbf0d845e369e6fdac5c3d3eb10bf982820da96fcdac9f9e77dcce21de
Opcode Fuzzy Hash: 1088167e9135a4bab1ce39819b7cfb47d09dbd680bea308633cd4b4f6126a92a
Instruction Fuzzy Hash: 67F1E230A102099FDB55DF68D880BAEBFF2EF88300F148569E645EB661DB71ED45CB90

Function 060FA3D8 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 046bfb0dae120f7b1d3691367617fe1bc725a1a9a0f585ce7380f43b39fd1238
Instruction ID: 583a6d96b33e73c12542f6dfde43941c168e0434cc737ff27fd85dda5dcfcaa8
Opcode Fuzzy Hash: 046bfb0dae120f7b1d3691367617fe1bc725a1a9a0f585ce7380f43b39fd1238
Instruction Fuzzy Hash: C0D1E634A02218DFCB18EFB4D8546ADBBB2FF8A301F5085A9D50AAB354DB355985CF50

Function 060FA3E8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37eda86b6b71934ddb2a224b0797b17e0317ab72aac7befa85d239030e54e66f
Instruction ID: 2e579c6dfb1ecc96e81c9e0dd55df1c48cc984e126525ba05540bf67b8d990e1
Opcode Fuzzy Hash: 37eda86b6b71934ddb2a224b0797b17e0317ab72aac7befa85d239030e54e66f
Instruction Fuzzy Hash: F6D1E534E02218DFCB18EFB4D8546ADBBB2FF8A301F5085A9D50AAB254DF319985CF41

Function 04DE7C20 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2379471819.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4de0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0180eef11c4f708c2073dd874c6fb8849103d752915afd80a7a6d03c037e24a2
Instruction ID: 0dcb4ce90273c23757aa2870500a038930ba6eb8eafb9ae84588183975659dae
Opcode Fuzzy Hash: 0180eef11c4f708c2073dd874c6fb8849103d752915afd80a7a6d03c037e24a2
Instruction Fuzzy Hash: 12C1A574E00619CFDB14DFA6D840AADFBB2FF89300F1491AAD409A7355EB30A985CF50

Function 04DE5A43 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2379471819.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4de0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 284542ee37d027ef65542ae049a3bdcd0ccce3f5ce805721230e84318e47a458
Instruction ID: c6edb9cfc49699693ec942ca585606b787e5edde01fab7cf43ce9c939ba99d3b
Opcode Fuzzy Hash: 284542ee37d027ef65542ae049a3bdcd0ccce3f5ce805721230e84318e47a458
Instruction Fuzzy Hash: 7F613C30A0031ADFDB05EFE1D9A59EEBBF6FF89344B254165D406AB261EB30AD41CB50

Function 04DE7C10 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2379471819.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4de0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20057255e114d7260f04348f7492c6ccd7da50f33e4891fc49b1b52373f3b842
Instruction ID: 093140a8554c83fe5741f5e61563bbb10a006132035c1297b83b8ed7a77bd3fd
Opcode Fuzzy Hash: 20057255e114d7260f04348f7492c6ccd7da50f33e4891fc49b1b52373f3b842
Instruction Fuzzy Hash: 2051B875E006188BEB18DFA6D84579EBBB3BFC8300F14C0A9D419AB255EB3059469F50

Function 00C1AE30 Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00C1B086

Memory Dump Source

Source File: 00000003.00000002.2367137253.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c10000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 07110f9f8ddb5cfa605da5e5aee728c852b89859bfea4f143bdacbbe38f43962
Instruction ID: e0bbc7348facb4dc89759a3be435bd22cd94731c56dfae636b31cae06123399f
Opcode Fuzzy Hash: 07110f9f8ddb5cfa605da5e5aee728c852b89859bfea4f143bdacbbe38f43962
Instruction Fuzzy Hash: 3C8189B0A01B058FDB24DF69C04179ABBF1FF89304F00892DD09AD7A51DB74E986DB91

Function 00C15935 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00C159F1

Memory Dump Source

Source File: 00000003.00000002.2367137253.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c10000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 2cbc4902ff2d720cf2f175be5545dff683de937a385758f261e624f6e7d650b8
Instruction ID: aa1f2ec676de54e2dd791d6ac32f2d6b53aa3dc4aacc5005629979437d511a08
Opcode Fuzzy Hash: 2cbc4902ff2d720cf2f175be5545dff683de937a385758f261e624f6e7d650b8
Instruction Fuzzy Hash: 2D41F2B0C00719CBEB14DFA9C984BDDBBB5BF85314F60816AD408BB251DBB56986CF50

Function 04DE0BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04DE4381

Memory Dump Source

Source File: 00000003.00000002.2379471819.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4de0000_RegAsm.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 4a787d7b8ff3c3b2abc2b7e1dec9ae4bb998768a1dffa6c15b6836760dd7ab9e
Instruction ID: 9b7e95b4123ce94a5730d2ede7c4aca755aef10aad01fb4d98da05313533de14
Opcode Fuzzy Hash: 4a787d7b8ff3c3b2abc2b7e1dec9ae4bb998768a1dffa6c15b6836760dd7ab9e
Instruction Fuzzy Hash: 8C4127B5A00309DFDB14DF9AC448AAABBF5FF88314F24C559D519AB321D774E841CBA0

Function 00C14248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00C159F1

Memory Dump Source

Source File: 00000003.00000002.2367137253.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c10000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 68d64ed79bd41598eb55c32780e007fea338715857fdc63d8aabce81f367aed6
Instruction ID: 14dd4a85a8797b90e96043a84db19be5a7802a86c3f9bb36f8dc0c6d2291e398
Opcode Fuzzy Hash: 68d64ed79bd41598eb55c32780e007fea338715857fdc63d8aabce81f367aed6
Instruction Fuzzy Hash: 9041C1B0C00719CBEB24CFAAC944BDDBBB5FF85704F60816AD408AB251DBB56985CF91

Function 00C1C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00C1D2C6,?,?,?,?,?), ref: 00C1D387

Memory Dump Source

Source File: 00000003.00000002.2367137253.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c10000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 54dcc3697acad41fe93108a3c862b9477d47ae1325c24703ebca539baaeea6b4
Instruction ID: 0ecbac891ab201462d163be0b57fd0d72148179ea966209d2f3f608e12d3391d
Opcode Fuzzy Hash: 54dcc3697acad41fe93108a3c862b9477d47ae1325c24703ebca539baaeea6b4
Instruction Fuzzy Hash: 8921E3B5900349DFDB10CF9AD984ADEBBF4EB48320F14841AE919B7310D774A954CFA5

Function 00C1D2F9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00C1D2C6,?,?,?,?,?), ref: 00C1D387

Memory Dump Source

Source File: 00000003.00000002.2367137253.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c10000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3c71942a89bbd3c75ad5341666c6da7ac6c348a88d7e0d14bbb272d7ce7d9cd5
Instruction ID: 5fb8bde2b57e486e0dcd0880b1ff52978e4b3ceb508246d79e20bf13258bbcd6
Opcode Fuzzy Hash: 3c71942a89bbd3c75ad5341666c6da7ac6c348a88d7e0d14bbb272d7ce7d9cd5
Instruction Fuzzy Hash: 3221E3B59003499FDB10CFAAD984ADEBBF4EB48324F14841AE928B7210D374A954CFA1

Function 00C1B020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00C1B086

Memory Dump Source

Source File: 00000003.00000002.2367137253.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c10000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 23b8fb151fd2f4eb2b18cce30a6f37fccf9f6cb33710245d8b1874d27cd53663
Instruction ID: 13427de1488a16933a85b2ea5fcc6810f5c2d8c4346f5d22a2ff6bd78701aecb
Opcode Fuzzy Hash: 23b8fb151fd2f4eb2b18cce30a6f37fccf9f6cb33710245d8b1874d27cd53663
Instruction Fuzzy Hash: 161102B6C007498FDB10CF9AC444ADEFBF4AB89724F10841AD428B7210C775AA45CFA1

Function 060F59C8 Relevance: 1.5, Strings: 1, Instructions: 286
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 060F5C29

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 7cb093aa110004e637d740b97a6851a247850d0d90d7b55398e071de49b640ce
Instruction ID: c6a2ea213a30364de543b4dfb65075d9308b1d63003ddaaf553e957438802b5c
Opcode Fuzzy Hash: 7cb093aa110004e637d740b97a6851a247850d0d90d7b55398e071de49b640ce
Instruction Fuzzy Hash: 55C16D34600606CFC765CF18C88096ABBF2FF89310B5ACA59D65A9BB65D730FD46CB90

Function 060D1BA0 Relevance: 1.4, Instructions: 1438
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2381714568.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1118cfd8f995d0cb2761a2d83cddcabb9d5c5062d6be60e487cc931e743bfdd7
Instruction ID: 549f6d594e0b04de5a999b0fb4dc1ed84317e9693f129f49a4ac901b2b92bacf
Opcode Fuzzy Hash: 1118cfd8f995d0cb2761a2d83cddcabb9d5c5062d6be60e487cc931e743bfdd7
Instruction Fuzzy Hash: 42C24070B402189FDB54DF64C854AAEBBB2FF88704F108499E606AB3A1DB71EE45CF51

Function 060D3838 Relevance: .9, Instructions: 875
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2381714568.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3309be0afd404097ef2632719bded84ce2123475d754e4a1c6a304a6c4c09eca
Instruction ID: ee379dc11224ba04886484ef2005ce27ba14cf3c257f40c2c99800d55716ff2b
Opcode Fuzzy Hash: 3309be0afd404097ef2632719bded84ce2123475d754e4a1c6a304a6c4c09eca
Instruction Fuzzy Hash: FA722A34B502049FCB44DF68C894EAABBF6FF89704F11819AE605DB3A1DB71ED418B61

Function 060D00D8 Relevance: .7, Instructions: 676
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2381714568.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba8da78f9e166f26ccbe1a889252459a6ac4b3004c6b78d9b6f0f05af331fe3
Instruction ID: c956ca0eefc9899c397b550dc63bc15ce202509a926eebeab1275f3b354d776a
Opcode Fuzzy Hash: 0ba8da78f9e166f26ccbe1a889252459a6ac4b3004c6b78d9b6f0f05af331fe3
Instruction Fuzzy Hash: 11426930700B199FDB68AF789450A6E7AF2FFC5614B400A5DD507AB390DFBAED058B81

Function 060D0D80 Relevance: .6, Instructions: 616
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2381714568.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b477a63e247d1c92c8201dca9c90fb0d7a64ad7b20787189e3402cef8a4d17db
Instruction ID: 4eebdb844d4f4fb0b2a4424d2cc06b32bb350c37bdf56f4ca2f87329287aa94b
Opcode Fuzzy Hash: b477a63e247d1c92c8201dca9c90fb0d7a64ad7b20787189e3402cef8a4d17db
Instruction Fuzzy Hash: 96229E30B403059FDB849B69C854A6EBBF6BF89304F1485AAE506CB392DF75DC41CB91

Function 060F48B8 Relevance: .6, Instructions: 595
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dd3320302b7f8b66503551b6512891d6d20e20729d3b28c7a370abb9ca51e4b
Instruction ID: 063b46e01ad06532721ff8983dae719b89a3eddf0e9f7f755c7b929cb75f842f
Opcode Fuzzy Hash: 3dd3320302b7f8b66503551b6512891d6d20e20729d3b28c7a370abb9ca51e4b
Instruction Fuzzy Hash: DA325D74750601CFDB58DF29C488A6ABBF2FF89300B1585A9EA06DB766DB30EC45CB50

Function 060D2071 Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381714568.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66b398503e2c71073d8f1aae061ae6b18124a9cb000a41a78b4049688f40214
Instruction ID: 2eb991f58e46a5d3ad9a8a3d3b9de341413f0679a4127feca38461a7f7074df9
Opcode Fuzzy Hash: c66b398503e2c71073d8f1aae061ae6b18124a9cb000a41a78b4049688f40214
Instruction Fuzzy Hash: 52228270B402149FDB549B24C864EAE7BB2EFC8704F1185C9EA069B391DF71EE818F91

Function 060D00B8 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381714568.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2bbb01a028b2f37aa70f9a9afaa2e6f2ead64075d1435e2865dbf0ba0e3bbba
Instruction ID: f348c8beed9e557a51a1f7e39e979a7024294c97e38b45ee314c43d124b471ad
Opcode Fuzzy Hash: a2bbb01a028b2f37aa70f9a9afaa2e6f2ead64075d1435e2865dbf0ba0e3bbba
Instruction Fuzzy Hash: 17C14E34B407049FEB849F64C898B6E7AF6FF89704F10415AEA069B3A1DBB5DC41CB52

Function 060D1582 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381714568.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc0a4e17a590dda31fbb8459dbeeee31898f3ab8e6ec3e4fc08337d82cb1c030
Instruction ID: ebad115cc70c8a88a8f4d29cb1811df1edb19a9c45d5366139ea326328af4247
Opcode Fuzzy Hash: dc0a4e17a590dda31fbb8459dbeeee31898f3ab8e6ec3e4fc08337d82cb1c030
Instruction Fuzzy Hash: 42C1E530B403019FEB949BA8C458A6E7FE6AF89704F1045ABE602CB392DFB5DC41CB51

Function 060D0753 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381714568.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b2650f8b2f0135ab0eec56acc1b08c82a3d99cb9bfd5840e4dd4c60bf4e4b7e
Instruction ID: d41a61e94f3f673b4edacc99a4da080d1f89dea102d5da5b972e1b1ab6b2225b
Opcode Fuzzy Hash: 2b2650f8b2f0135ab0eec56acc1b08c82a3d99cb9bfd5840e4dd4c60bf4e4b7e
Instruction Fuzzy Hash: 89B14B34B40704DFEB849F64C898B6D7AA6EF89704F10815AEA069B3A1DBB5DC41CB91

Function 060D06DB Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381714568.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae4c277b26dcb2277b176081e200a5ea44a2c1aaf95cc17ea4b43e43c636953e
Instruction ID: 942836300981fb3e37358beacbb46714621794e36b79a3f08aa74e553754ccf3
Opcode Fuzzy Hash: ae4c277b26dcb2277b176081e200a5ea44a2c1aaf95cc17ea4b43e43c636953e
Instruction Fuzzy Hash: 6FB15B34B40704DFEB849F64C898B6D7AB6EF89704F10815AEA069B3A1DFB5DC41CB91

Function 060D0663 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381714568.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25cbdd374b625936c39e235de6226b44b54485ebf191afa24471ddb80e1a58a7
Instruction ID: e1461034f5d9acfbcdc1ade34981b0c5e8090f2c8b1b2823c7d8736c01eb3b75
Opcode Fuzzy Hash: 25cbdd374b625936c39e235de6226b44b54485ebf191afa24471ddb80e1a58a7
Instruction Fuzzy Hash: 67B15A34B40704DFEB849F64C898B6D7AA6EF89704F10815AEA069B3A1DBB5DC41CB91

Function 060D05EB Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381714568.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0a681f25fc99a3f006fa7f5a9c4905d5bb84fd642c2fa910dc4a830f93c42b
Instruction ID: 64e332849bf88394edc54d12926566dd1589039420bf20c4551e0baf8525e785
Opcode Fuzzy Hash: 8d0a681f25fc99a3f006fa7f5a9c4905d5bb84fd642c2fa910dc4a830f93c42b
Instruction Fuzzy Hash: 16B15A34B407049FEB849F64C898B6D7AF6EF89704F10815AEA069B3A1DBB5DC41CB91

Function 060F48A8 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 166dfdfc8e655afb44f130d37dbbd3b28abf0fcc770974aa046853f570dc78dc
Instruction ID: 361b78cc5b3f0bd569c9adcc0ab73db990fa3f2a578c387b830bb60f17e1934b
Opcode Fuzzy Hash: 166dfdfc8e655afb44f130d37dbbd3b28abf0fcc770974aa046853f570dc78dc
Instruction Fuzzy Hash: 07B13734B106058FDB54DF29C588AAABBF2BF88204B1544A8E546DB776DB30ED45CB50

Function 060F7D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e3fb7b6f3da385383851220acf675ba9154f12debb3fc290aee5025c8dfffd8
Instruction ID: 7d2b5942091488e32bc3157bef31282652183b5ad186adb0cdb5204717f5c372
Opcode Fuzzy Hash: 3e3fb7b6f3da385383851220acf675ba9154f12debb3fc290aee5025c8dfffd8
Instruction Fuzzy Hash: 4E514771E50318CFEB94CFA9D840BDEBBF1AF88700F14812AE515AB644EB749846CF81

Function 060D2FC8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381714568.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f6e761cb0c9905e1137693b5d4f5878fb3cf290b9052d9efd8abe678ae328b1
Instruction ID: 5c8837b120e961f99efde0246e28a60280db2ace95a938755c35b823b37c25c8
Opcode Fuzzy Hash: 7f6e761cb0c9905e1137693b5d4f5878fb3cf290b9052d9efd8abe678ae328b1
Instruction Fuzzy Hash: 08514935B502199FCB48DF69C89499EBBF2FF89314B11806AED05AB361DB71EC05CB50

Function 060D34D8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381714568.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceb5b21ef72b3432c6a4ac0a5acdb77933e6ea59a6da7071b66b899c08f0a154
Instruction ID: 94998ae701333d7feb5c594bb2409c2175f9ac9d6c9fad2772d32ce6b652e97d
Opcode Fuzzy Hash: ceb5b21ef72b3432c6a4ac0a5acdb77933e6ea59a6da7071b66b899c08f0a154
Instruction Fuzzy Hash: 23515A35B502159FCB58DF69C88499EBBF2FF89314B1181A9E905AB361DB70EC05CB60

Function 060D3818 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381714568.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e9fdf02f0c8c9504a6984c68bd67f9750536fd0ddd7e3b332b0e4693424558d
Instruction ID: a56a729c8fb8551732bdebf121141bcd8597af64d844842191ac572720974845
Opcode Fuzzy Hash: 4e9fdf02f0c8c9504a6984c68bd67f9750536fd0ddd7e3b332b0e4693424558d
Instruction Fuzzy Hash: 59515D34B542059FCB85DF58D998E6E7BE6EFCA700B118085EA059B3A6CB71DC018B72

Function 060F7D4C Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94227623b60b096fc7839eb7c788bf4b9d2095478cc71c1662956de9c94a419a
Instruction ID: 5dc8b386ca704ef359841a1bef7a44ab55e8c77fa0d20fcdf86ee0fab67448d6
Opcode Fuzzy Hash: 94227623b60b096fc7839eb7c788bf4b9d2095478cc71c1662956de9c94a419a
Instruction Fuzzy Hash: C95156B0D503598FDB94CFA9D880BDEBFF1AF48700F14852AE405AB644EB749846CF82

Function 060F3DE0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75e8019bbce2f6052524f66604c738917e84ea6418b7fc838afe93c27cf5ca57
Instruction ID: b1e5f0945a612820acaac0d029621f0b242bc13d985a41f7dbdc24c313025721
Opcode Fuzzy Hash: 75e8019bbce2f6052524f66604c738917e84ea6418b7fc838afe93c27cf5ca57
Instruction Fuzzy Hash: F331E3317042508FD72ABB38E8505AE7BE6DFC622031948BAD54ACB791DE75EC07C7A1

Function 060F5579 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 193b69f25ffe0309c0c21e40b155abe3b4d3aa00671b11bbc7e0c2f38f4e70a4
Instruction ID: 421f57b71b3820b71102013142d60c904316b4533fcc792c32559b43018f06b3
Opcode Fuzzy Hash: 193b69f25ffe0309c0c21e40b155abe3b4d3aa00671b11bbc7e0c2f38f4e70a4
Instruction Fuzzy Hash: B2314B35B112149FCB59DF38D8849AEBFB2FF89201B148569EA05DB365DB30ED05CB90

Function 060F84C8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 870a0691c78f394795425b5931a2dda1319d1e633f372451f1a09f6430bdb8e0
Instruction ID: 9ddaea598a05e472fa857ec5db444d3672759dc867d77a8e63234af4c0622f42
Opcode Fuzzy Hash: 870a0691c78f394795425b5931a2dda1319d1e633f372451f1a09f6430bdb8e0
Instruction Fuzzy Hash: CD31DF757002148BDB58AF79A8542BE3BE7EFC8200B54447AD606CB385EE74DE0287D2

Function 060F5588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a98abc486071aec98c391d5d75b23f1a0f662283f73f83f1ee65ee10cb8a39b6
Instruction ID: b5d84b1397ba063efa8d9b47d909cdde76eaf038a08d50f1e68ac7e02d471aac
Opcode Fuzzy Hash: a98abc486071aec98c391d5d75b23f1a0f662283f73f83f1ee65ee10cb8a39b6
Instruction Fuzzy Hash: 1E315734B112109FCB49DF38D8849AEBFB2FF89201B008469FA068B365DB30ED01CB90

Function 060F87A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb77bf13f051b862186bbc4da25c57a253c4df5ec1f2581e929263205f99d0eb
Instruction ID: 50ecc114dd27cd7f8d995cf0bd771175c08094c447a2c47d74b566b696b1d6bb
Opcode Fuzzy Hash: fb77bf13f051b862186bbc4da25c57a253c4df5ec1f2581e929263205f99d0eb
Instruction Fuzzy Hash: B84101B1D112489FDB54CFAAD940ADEFFF6AF88310F10802AE515B7250DB74A946CF90

Function 060F8796 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd9c900a160ac8507d75a39a885aea3910e0f7d7c6072d001ab693a29d46ba5a
Instruction ID: 831f8d268396cb9649edb281212a21e89758c85d42c1650e4c429a9962fb216c
Opcode Fuzzy Hash: cd9c900a160ac8507d75a39a885aea3910e0f7d7c6072d001ab693a29d46ba5a
Instruction Fuzzy Hash: CE3112B1D112489FDB54DFAAC940ADEBFF6AF88310F14802AE415B7290DB749946CF50

Function 060F8A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb37ad0523738089675a0ab7eb6aaa0507c83e76fa28777101faf92013c5cd9b
Instruction ID: 22dfe5c17bf9b23a453ac07f8096601c5f4d345a12012fd407e56b83b4244701
Opcode Fuzzy Hash: eb37ad0523738089675a0ab7eb6aaa0507c83e76fa28777101faf92013c5cd9b
Instruction Fuzzy Hash: F63103B1D112489FDB54CFA9D894BDEBBF5AF88310F14842AE509B7240DB74A846CB90

Function 00BBD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2366868781.0000000000BBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bbd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfd9ab88bdf9f9e2b11fec660cc2d20c3f11f34382e1274cf30b6ce085a5f531
Instruction ID: 95a6abc66ffe626a499fcb0d7bc827d83e69233909e1952cbbcfa26b5d092926
Opcode Fuzzy Hash: dfd9ab88bdf9f9e2b11fec660cc2d20c3f11f34382e1274cf30b6ce085a5f531
Instruction Fuzzy Hash: 61214872100204DFDB04DF00D9C0B76BFA5FB94324F20C5ACD9090B316D3BAE856CAA2

Function 00BBD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2366868781.0000000000BBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bbd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec11d462e2f53025f2e966b2e65ef8bebf633f6b7114697032f5b795c54921a
Instruction ID: f502f219f4fe85b5dfce4ae6fef7f0f2a6ca8fca588543a8c44dfb88caf41e94
Opcode Fuzzy Hash: fec11d462e2f53025f2e966b2e65ef8bebf633f6b7114697032f5b795c54921a
Instruction Fuzzy Hash: 1A214572500240EFDB24DF14D9C0B7ABFA1FB94318F20C5A9D9090B216D3BAD856CAA1

Function 060D1069 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381714568.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36950832e05e8cc4be91bb77cd7f031dbc683b49143008cd017527d8fb06af30
Instruction ID: 83459e17834aad9cee0ac64097485e02524e39b6211165c70e0d4120aee4dae8
Opcode Fuzzy Hash: 36950832e05e8cc4be91bb77cd7f031dbc683b49143008cd017527d8fb06af30
Instruction Fuzzy Hash: 3F21D434B40204EFDB44DB69D9449AEBBFAFFD821071586AAE515873A1CF70DC50C7A1

Function 060F8F42 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12b5377ade3840aa3971193f11fba83b8464ddcc094d7970d2dad83aaabd956
Instruction ID: fc217602d83de2514a08da8cd6b8a2043132fb08b2e6e5125178b41657bebfdc
Opcode Fuzzy Hash: e12b5377ade3840aa3971193f11fba83b8464ddcc094d7970d2dad83aaabd956
Instruction Fuzzy Hash: 6131DE74D5521ADFDB80CFA8D484AEDBBF1EB48301F2080AAE515A7350E7345A85CF90

Function 00BCD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2366909471.0000000000BCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bcd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e293396cf084a3ea32c011acfd3a931eab2424c33f9f9d7b62084b06cf5ced8a
Instruction ID: 2f7ac3ee0b69cfc4e9992d9f618268a56ce19fcef692da05cff3c99f02c5b993
Opcode Fuzzy Hash: e293396cf084a3ea32c011acfd3a931eab2424c33f9f9d7b62084b06cf5ced8a
Instruction Fuzzy Hash: 43212F79604240EFCB14DF28D9D0F26BBA1FB84324F20C5BDD90A4B252C77AD847CA62

Function 060F8A8C Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88a6b4cec28315c608311260f7fd828c0d4840370ee224ee0f2fb33603550077
Instruction ID: 2580eb87d4dad65d3409e907f147d495bd976ce9c60ecd516b746506d67167e2
Opcode Fuzzy Hash: 88a6b4cec28315c608311260f7fd828c0d4840370ee224ee0f2fb33603550077
Instruction Fuzzy Hash: 972115B1D113489FDB54CFA9C895BDEBFF9AF48710F14842AE505B7240DB74A846CBA0

Function 00BCD006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2366909471.0000000000BCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bcd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ae4b7b2997f98f45eef75ad909afbb926301184b29cdf3641ce6bc77ac2f474
Instruction ID: e66a05fba0b1da027f30fe23b23908fd7b8e392dc3ed8f18e6490461b53fccb7
Opcode Fuzzy Hash: 5ae4b7b2997f98f45eef75ad909afbb926301184b29cdf3641ce6bc77ac2f474
Instruction Fuzzy Hash: BC21A4795093808FCB12CF24D990B15BFB1EB45314F28C5EED8498B657C33AD80ACB62

Function 060F6E72 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c43cf7f0716f1780725b885a0b6f0ecbda9c5fe0b66d79ce3fbe8e0e69d4ff
Instruction ID: f2db38ac96e273d68c3af09234327809406b7b38f57687a2e6bb20d60d47216d
Opcode Fuzzy Hash: b1c43cf7f0716f1780725b885a0b6f0ecbda9c5fe0b66d79ce3fbe8e0e69d4ff
Instruction Fuzzy Hash: F1015E6210C2D43FC7268EA99C61CEB7FECDE8A251709409BFAD4C6153C429CA55E7B1

Function 00BBD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2366868781.0000000000BBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bbd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5504dfd99aeaae02a5904faf24bf7c180eb56da23d91347c8bcbb22ee6d9b3
Instruction ID: a38a3132ac71b871c810eeac03a0a22b547035ff8949e00f57e1d702a7b404c6
Opcode Fuzzy Hash: 5a5504dfd99aeaae02a5904faf24bf7c180eb56da23d91347c8bcbb22ee6d9b3
Instruction Fuzzy Hash: A911E676504284CFCB15CF10D9C4B66BFB1FB94318F24C6E9D8494B616C37AD856CBA1

Function 00BBD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2366868781.0000000000BBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bbd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5504dfd99aeaae02a5904faf24bf7c180eb56da23d91347c8bcbb22ee6d9b3
Instruction ID: 0a35b0e4067b026e2074f6df26ed9a8883a7c06bc86bd1ca7e41b12501900d82
Opcode Fuzzy Hash: 5a5504dfd99aeaae02a5904faf24bf7c180eb56da23d91347c8bcbb22ee6d9b3
Instruction Fuzzy Hash: FB11D676504280DFCB15CF10D5C4B66BFB1FB94314F24C6A9D8094B716C37AD456CB91

Function 060FBC5F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 996061166737782f3b2d37134cf852e68d31bd683541417d1740c3ee0289f56a
Instruction ID: 0b0c9ffdc9a1cc9ba83e9b1105fe0ed0bec535439d99c587060b2afc4755fc4f
Opcode Fuzzy Hash: 996061166737782f3b2d37134cf852e68d31bd683541417d1740c3ee0289f56a
Instruction Fuzzy Hash: 5901C4312122059FC699B734AC586BE3FE3EEC1351388495DE60797A91CDB07A4ECBE1

Function 060F8350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 387eb7433cdea8f0638d529300138e42928e0332cc90bddd8991d91d281328e8
Instruction ID: b4f25d5099e43b796db94e1786b9b4259f612439ed61abae02f7e202f4f899db
Opcode Fuzzy Hash: 387eb7433cdea8f0638d529300138e42928e0332cc90bddd8991d91d281328e8
Instruction Fuzzy Hash: 3E01D472B001099BDB54DEA9EC84ABFFBFAEBD4610B148036E604D3240EB70991587A0

Function 060FBC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bd1e6388a1b518f164b76ae97d6dff89f9d9c4d330782e8be79c02562278719
Instruction ID: a4371753e6fff3de42f160db0dd608d6bbf80c33f0eb39c47d5ed6c27b9b60de
Opcode Fuzzy Hash: 8bd1e6388a1b518f164b76ae97d6dff89f9d9c4d330782e8be79c02562278719
Instruction Fuzzy Hash: 8A01B1312112059F8688B738E85867E3BE3EFC4350388482DE60787A80DEF07D4E8B91

Function 00BBDAA5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2366868781.0000000000BBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bbd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dc59c87336cf99f126477c28dd9ffc6a674a688a244b52b7257a5e35e2b0867
Instruction ID: c87aadc6842ff52a5538ca3c4fa5afdab640942ef31baf3a6093f6aa6d5166b2
Opcode Fuzzy Hash: 5dc59c87336cf99f126477c28dd9ffc6a674a688a244b52b7257a5e35e2b0867
Instruction Fuzzy Hash: 7301F2710083449BE7208B25CDC4BB7BFD8DF81724F18C89AEE085A282DAFC9840C771

Function 060F5508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0d8292482387664d847a94a7e4779c4bcbd7cdf2cfe7ac182bd21ef82e1b48d
Instruction ID: d02462348054c15ed07dbab4b4e9f9bdd50ba92202f8c73bc4850574d30e0ecc
Opcode Fuzzy Hash: d0d8292482387664d847a94a7e4779c4bcbd7cdf2cfe7ac182bd21ef82e1b48d
Instruction Fuzzy Hash: 8401D630A21302CFDBEA9B35A8145677FF3BF94605B04883CD60682D14DE71E480CB80

Function 060FE8B0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fc55ab2d815738a6883dd6863d14c6b1add2045ac5b9fbdc5d72da9c34fcb3d
Instruction ID: 88bfb375d7a543d50de109cac4dafa1e7cb201c743f93e84f73ddaec3d0ba23e
Opcode Fuzzy Hash: 5fc55ab2d815738a6883dd6863d14c6b1add2045ac5b9fbdc5d72da9c34fcb3d
Instruction Fuzzy Hash: E701F434619308DFCB06EF74D8148A93FB6EF8620071488E9E505CB762EB36CD16CB90

Function 060FB358 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe24eaf443306b0c58fdd7bd9edabfc63d4d80fef119ae1eb49f882a4bffa49a
Instruction ID: 2736dab4793fba0b7713a2b85aedf0adbaf7617c97e29666f13e09e6a9ebea1a
Opcode Fuzzy Hash: fe24eaf443306b0c58fdd7bd9edabfc63d4d80fef119ae1eb49f882a4bffa49a
Instruction Fuzzy Hash: 2601B13090738AEFCB05EBB4E85859C7FB1FF45200B1405DED985A7291DA701A55CB51

Function 060F8F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd5c58bd9c25b0f5809a4f028771ee3d6a06034dd89cce62963b7c7cff2e5d8a
Instruction ID: 15ed4385417d0363dc3380c435c5bc1ec10db763c7c645d0761ab8d366b982bd
Opcode Fuzzy Hash: bd5c58bd9c25b0f5809a4f028771ee3d6a06034dd89cce62963b7c7cff2e5d8a
Instruction Fuzzy Hash: 0A01C4B4D4421ADFDB84DFA9D9446EEBBF1BB48301F1081A99515A3350E7780A44CF90

Function 00BBDAA4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2366868781.0000000000BBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bbd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a384dec1bfa64ef3141cfabc2f894af74d9c868655d6730df9d1e2bdf4383c76
Instruction ID: 7b8dfabb9c6b606ed9f1464d2e64390b8c80cada3e22b432a198001de3eb0fd0
Opcode Fuzzy Hash: a384dec1bfa64ef3141cfabc2f894af74d9c868655d6730df9d1e2bdf4383c76
Instruction Fuzzy Hash: D3F0C272404344AFE7208E15CDC4B62FFD8EB81725F18C45AED085B286C3B89840CB71

Function 060F6EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb706c8e7e4a76f7767b31381f18b1ff88e90a731dc53ea3842a47d0c34b224e
Instruction ID: a6be3dc251ef15970a23aa1c260adbb97324bc26eda12532ceaa4572b5f842a3
Opcode Fuzzy Hash: fb706c8e7e4a76f7767b31381f18b1ff88e90a731dc53ea3842a47d0c34b224e
Instruction Fuzzy Hash: BEF0A7722081E83F8B154E9A5C10CFB7FEDDA8E1617084056FED8C2151C469C921ABB0

Function 060FADE9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 126d4444cf2c0df73f09957d752bf00df1900bac10b8ea68d40b47f61e105d7c
Instruction ID: f2b2a34690f6fd50af46eecc604f38df640d40c287a686bfe8da1e54e6a26838
Opcode Fuzzy Hash: 126d4444cf2c0df73f09957d752bf00df1900bac10b8ea68d40b47f61e105d7c
Instruction Fuzzy Hash: 98F027302061507FC3106B68A858ADB7FE6DFCA711B44055EF10BD3242CAA41A4A8770

Function 060F67C8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb531023bfc6638caf8bf0b5e6b9d2985f17e619c6d3dee4b1dcdef4e8c96229
Instruction ID: 11b3c7e0dcd9740570a81c34b27604aa110e48d9545d1110391fed5a4d8bd0b6
Opcode Fuzzy Hash: cb531023bfc6638caf8bf0b5e6b9d2985f17e619c6d3dee4b1dcdef4e8c96229
Instruction Fuzzy Hash: 5AF09031BA03009FD760CB68D841F957FE5AB42721F14866AE354CB6E2D6B1E8069740

Function 060F8341 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9fc3ca2c24cae414527b2acb1adeebd197d500f9026368fce1b233659c69794
Instruction ID: c96c89efc178690bc74eb1040d48154fa903a6295cee1fb12834e028caf71d56
Opcode Fuzzy Hash: c9fc3ca2c24cae414527b2acb1adeebd197d500f9026368fce1b233659c69794
Instruction Fuzzy Hash: 73F0A772F501154BCB60DE69AC846EFBBF9EB95290708403AEA54C3200FB34891A8791

Function 060FC170 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd8a95a0d2b9f207d188df3f266ca1e627263d4017af5c5f274b083d68eb0296
Instruction ID: fce6992d79b564be6c3556523f47c4558d4ad63eb7e52ba1584c85c358beaaee
Opcode Fuzzy Hash: bd8a95a0d2b9f207d188df3f266ca1e627263d4017af5c5f274b083d68eb0296
Instruction Fuzzy Hash: 3EF0A435503B058FD315DF25E90C562BBF6FF88301700865EE48BC2A55DB30A65ACF84

Function 060F54F8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe504c795ae0de51e9a7e09ed91f6a0fe09620a02f37a13217e1ddf7e838f46e
Instruction ID: a606611277df837cf822b1817dc6afe77cbbaf9b2e984261efa278d1f4fb0baf
Opcode Fuzzy Hash: fe504c795ae0de51e9a7e09ed91f6a0fe09620a02f37a13217e1ddf7e838f46e
Instruction Fuzzy Hash: 9CF0F6305153419FDBA6CF20D910A677FF2AF81614F48849DE14546D22D675E989CB40

Function 060FC110 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef64d04cd97351649f032bfb33bf1d16b284a4d808ad3896f946f9603f13d5b
Instruction ID: d8b308c825c7e569433dafa2d6d9cf2807f3a95b58725880dac3b0cbe47d1b56
Opcode Fuzzy Hash: 4ef64d04cd97351649f032bfb33bf1d16b284a4d808ad3896f946f9603f13d5b
Instruction Fuzzy Hash: F3F0963010A7D15FC312A739E81869B7FF6DFC2204B08059EE28687692CAA56A15C7A1

Function 060F8FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec224d4d8a1c88ad4f50f148a30d47e4d59fd38f2f7d8a53ce233ce3bf0a9b85
Instruction ID: 35e14a588466eca3dd0ea282316e37ca1cf46f40f7ccff27216a8e64b917fe09
Opcode Fuzzy Hash: ec224d4d8a1c88ad4f50f148a30d47e4d59fd38f2f7d8a53ce233ce3bf0a9b85
Instruction Fuzzy Hash: B6F0CDB1C48159DFDB80CFA4C8145EEBFB0EB5A201F0081CAE506E7750E7394A41CB40

Function 060FACB8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5764ef84d630fe5d2f2dfd7fb8317ac1fba27bf1bcdaffaf14d67ce9d6e4b6a1
Instruction ID: 5b6d099a239bb5030ed7e0e47ae5cb8059e52ed95e3e673a922621f40a4d0caf
Opcode Fuzzy Hash: 5764ef84d630fe5d2f2dfd7fb8317ac1fba27bf1bcdaffaf14d67ce9d6e4b6a1
Instruction Fuzzy Hash: 27F0E26270B1A09FC7162B786C240AD3FB2DDD664234844CFE28BCB6A1CA544606C3E1

Function 060FB368 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a767f916ca5203babc52247d8e9e993978bd567e70f56566c0b50749334fd483
Instruction ID: 539227b28f09af8688c5492d0df60f2edfd7d16c64552bfef6a78b9bd73eb830
Opcode Fuzzy Hash: a767f916ca5203babc52247d8e9e993978bd567e70f56566c0b50749334fd483
Instruction Fuzzy Hash: E7F01934E0224AEFCB48EBB8E85C59C7BB2FB84200B5445A9D906A7395DA702A558F41

Function 060FADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d10c5accd36d83c9bee33a6c4d4d07e4b4d60b12b9f62471e67a54051d9bc0b
Instruction ID: a43c2945f1bc889145a900bd748ec8090ee943afc3b4392f5e9c9f7537ad453a
Opcode Fuzzy Hash: 7d10c5accd36d83c9bee33a6c4d4d07e4b4d60b12b9f62471e67a54051d9bc0b
Instruction Fuzzy Hash: EDE09231306110BFC3146A5AE848AEE7ADAEFCA751B80402DF20FD3242CEA1290547A5

Function 060FC180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a655486aa217a06db09def32f2f5c66f1f652b9923b6308fbb56b01b50c2966f
Instruction ID: 7ad6d098ade793f1400962e998e553744b04747fd8748bad80106bc43519dd5f
Opcode Fuzzy Hash: a655486aa217a06db09def32f2f5c66f1f652b9923b6308fbb56b01b50c2966f
Instruction Fuzzy Hash: E9F09034502B05CFD715DF26E80C522BBF6FB88301B00C62EE94B82A50DB70A54ACF84

Function 060FB500 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 167bee89d1bb60dacf3be430218b54e1ec83495c674dc68f0584281e84d8ef24
Instruction ID: 9e771b97a7b8c0274347ad5e3010cbd7e96a857c673b23e2dab0f6e818623383
Opcode Fuzzy Hash: 167bee89d1bb60dacf3be430218b54e1ec83495c674dc68f0584281e84d8ef24
Instruction Fuzzy Hash: 1FF01535D0120EAFCB01DFB4E9488CEBFB9EB44200F1042AAE885E2280EA305B55DB81

Function 060FC120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab7199fcc46a12811af2fb667cb590008e059d2504d594891d592ec9a556ea4c
Instruction ID: 98a82629d9a7260b0826faafdfc1afbfd0212cd2ad76698c068eb71a9b988cf0
Opcode Fuzzy Hash: ab7199fcc46a12811af2fb667cb590008e059d2504d594891d592ec9a556ea4c
Instruction Fuzzy Hash: 14E0A9302017968FC211AB29E80C7AE7FE6DFC1304F04092EE24687A81CBE1A9028B91

Function 060FCC38 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44a28924695c92a5069e64e4388c8343fb071e3c2dbf287834fdb121e5d4c0fe
Instruction ID: be733a54f5bd3b173f3dacedea0561c81235918cdff1e3e0d1476a38731f81d0
Opcode Fuzzy Hash: 44a28924695c92a5069e64e4388c8343fb071e3c2dbf287834fdb121e5d4c0fe
Instruction Fuzzy Hash: 48E026316076A09FC712FB29FC04ADB3FE1DF86B14B1045D6E20087746CA301946CBE1

Function 060F5698 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94c96a573ece7ae16d07b16fed73563095f96405fdc2ff6bce893c9bae242591
Instruction ID: 85b2632298bf412970efd37bad4ec979a434867f07372dcd5c8c7e1e206de8f1
Opcode Fuzzy Hash: 94c96a573ece7ae16d07b16fed73563095f96405fdc2ff6bce893c9bae242591
Instruction Fuzzy Hash: 58E092B211C3109FC3459B20EC44896BBA8EB95221B05886EF590C7241E732E882CBA5

Function 060FE280 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3af9b989e3ae656adf8cdfd820df18dddab516cdb3578fdb35b74133e7e8c065
Instruction ID: 559aa49895052b21516ea337ea0c2e7ba4bd5e9c6fd32bc226a123b1ff61f720
Opcode Fuzzy Hash: 3af9b989e3ae656adf8cdfd820df18dddab516cdb3578fdb35b74133e7e8c065
Instruction Fuzzy Hash: B1E0D831805B019FC745FB10FD039453FF1EB5AB04B111499DE40477A5DB641E99CBD2

Function 060FCE88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6beab823045241e357ab4f8ce397ea9a7bcadcd5ec0c534417647c4e0bf24c99
Instruction ID: 8dbc5b18078f28bc7acb41e801ed280c5511fadd5f97c87917e105142ccbd0a9
Opcode Fuzzy Hash: 6beab823045241e357ab4f8ce397ea9a7bcadcd5ec0c534417647c4e0bf24c99
Instruction Fuzzy Hash: 5BE0DF7080A791AFD742F720B805AAA3FB59F46B14B1509CAEE808BB46CA748945C7D0

Function 060FE1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1af830e706d19b518daea391a3a9f272c3173032f18faa7392843bca6c7b7c
Instruction ID: c8b59d67f2521917a705b41bdf1ac9ab245f5c4851a12d2d5b611f761254fcfc
Opcode Fuzzy Hash: 5e1af830e706d19b518daea391a3a9f272c3173032f18faa7392843bca6c7b7c
Instruction Fuzzy Hash: A5E0D871E06204FFC701DFA4EC409DD3BB1DF82600F2041DAE805D7251D5B01F108752

Function 060FAC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aea11208f9b265738795fc6fd9810d8e1f43f739d26a4c79610f5aa18fd4fe3a
Instruction ID: 42fa68fde5f444e15db43edc544179e6b60e26f02f75165e3316c9cd60e45cc8
Opcode Fuzzy Hash: aea11208f9b265738795fc6fd9810d8e1f43f739d26a4c79610f5aa18fd4fe3a
Instruction Fuzzy Hash: AFD05E31302129A78A097769F4184BE7BFBEEC5A62344042EE70BC3240CFA52D4287D5

Function 060FB510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e0b4c16fd6d6387562cd713c88069defc9d8484cebdb46d22ff920b1419b6cc
Instruction ID: 56e10b76a4360f72d75c3123754d7cabf776b5f684999d444ea2ec480a0859ac
Opcode Fuzzy Hash: 8e0b4c16fd6d6387562cd713c88069defc9d8484cebdb46d22ff920b1419b6cc
Instruction Fuzzy Hash: 81E09275D0120DEFCB40DFE5E9488DDBBB9FB48200F1082AAD909A3240EB316B56DF80

Function 060FE8F8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec47609268b5d8d2fab67b4e42360d937d1b677eab2dd6f7d84dff28fb9cad57
Instruction ID: 86e5af9b367c98c5d5a192be47913262905b9a3b4d7e5a5863e7a85543ac0acb
Opcode Fuzzy Hash: ec47609268b5d8d2fab67b4e42360d937d1b677eab2dd6f7d84dff28fb9cad57
Instruction Fuzzy Hash: F7D01739225140AFCB029B64C940CA63F36AF5A61030880C6F5458F6B2C232C925DB60

Function 060FE210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4303490cf6d99ccb0b82cc97aa20fa6abb40953d759456d6b7a08805599c8d46
Instruction ID: ae829060d81d58e473e326d30b740be0e54397150c190c240579a67727730379
Opcode Fuzzy Hash: 4303490cf6d99ccb0b82cc97aa20fa6abb40953d759456d6b7a08805599c8d46
Instruction Fuzzy Hash: 8CD01271A0120CFF8B44EFA8E90155D77F5DF45604B5045DDD509E3200DA712F009B90

Function 060FF8EA Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf788054bec060be4af8c475c274bb3b368da56e7d5f0b1fd0538a7c990c24a
Instruction ID: e3300e86139a94cb03c4310134a3653f99aaad7e0e9700f8a838195ee66f3973
Opcode Fuzzy Hash: baf788054bec060be4af8c475c274bb3b368da56e7d5f0b1fd0538a7c990c24a
Instruction Fuzzy Hash: 0BC012327151200F8784BA6C78142AD6AD786C86A33C9406BEA0EE3388CDB08D428B94

Function 060F3721 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f73a013390103355e8d88c42060b7fc93f0c34dbb5a1d86ed30d0bab04ad4856
Instruction ID: 62c570575c50fca91f05b7352185fb23656644a99ab6441e17c281cabb97e7a8
Opcode Fuzzy Hash: f73a013390103355e8d88c42060b7fc93f0c34dbb5a1d86ed30d0bab04ad4856
Instruction Fuzzy Hash: 38C08C3119D3805FD3168B108C87A913F71EB82705B0A0082EAC2DB0A3CA69902CC276

Function 060FDFD1 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20fc870dec95435494f246eb964d304d25c7af9f6569f6f740a396199a42e170
Instruction ID: 560a06b5f9169367ad1610b94a2219ec0b626c77d2cb5ff39340825802dc21e1
Opcode Fuzzy Hash: 20fc870dec95435494f246eb964d304d25c7af9f6569f6f740a396199a42e170
Instruction Fuzzy Hash: 5EC04C7254B7D05EDB0257749D1D4053E615F4671471501CBA2818A4A3D5214019C751

Non-executed Functions

Function 060F6FE8 Relevance: .8, Instructions: 786COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b30372109e3fc0f05f22b84a17434c64de3b0620e559965176fb9b1a2b030554
Instruction ID: 4737018bef3df081192a1d8f6957783978ac6089580c4286f6dec358fb115fe5
Opcode Fuzzy Hash: b30372109e3fc0f05f22b84a17434c64de3b0620e559965176fb9b1a2b030554
Instruction Fuzzy Hash: 9B622EB06002009BE74CEF59D45476A7EE6EF84308F64C5AC910A9F396DFF6D90B8B91

Function 060F6FF8 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2381746585.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f1ee12b54d2aa7dac6cf75ebd311bd2799e8207d09cc19cd347acef467d33b2
Instruction ID: 6a1eaae3fc0a40df10ff961b9040f2a03866eeb6cc5c2e75104ee83bd55661de
Opcode Fuzzy Hash: 4f1ee12b54d2aa7dac6cf75ebd311bd2799e8207d09cc19cd347acef467d33b2
Instruction Fuzzy Hash: F9622EB06002009BE74CEF59D45476A7EE6EF84308F64C5AC910A9F392DFF6D90B8B95

Function 04DE0040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2379471819.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4de0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e3e5a2f6e527d979b2394a28d203786b358eb4d06dc5b1658b4eb11f7acc6c2
Instruction ID: 478f10cf33c3792724d5d7ef75857c67aecb66f5a615c46a10ca610b4984cf62
Opcode Fuzzy Hash: 1e3e5a2f6e527d979b2394a28d203786b358eb4d06dc5b1658b4eb11f7acc6c2
Instruction Fuzzy Hash: 0F1297B2C82B45CAEB90CF65E84C18D3BB1B741318BD16A09D3631B2D5D7B419E6CF48

Function 00C1DC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2367137253.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7427e78dfe54634291b5424b24521a8a4cb584af1f822ab93bd501931a5ae1ef
Instruction ID: 5e561b1d442f089094b11b68ffbf6eda7fee132f5f629a78d0077d126df7e734
Opcode Fuzzy Hash: 7427e78dfe54634291b5424b24521a8a4cb584af1f822ab93bd501931a5ae1ef
Instruction Fuzzy Hash: 74A17D32E002158FCF05DFB4C8405DEB7B2FF86300B15457AE916AB265DB71EA96EB80

Function 04DE0007 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2379471819.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4de0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91330fdc8a7031c7de50caddc14ad77315d2d3045cfd483d9dd509b55def95d1
Instruction ID: 16e660e31f18c86e3bcb9ec924f1e5a576ea36da17c0286df77fea72e3739abd
Opcode Fuzzy Hash: 91330fdc8a7031c7de50caddc14ad77315d2d3045cfd483d9dd509b55def95d1
Instruction Fuzzy Hash: E1C10CB1C82745CBDB91CF25E84818D7BB1BB85314B916A09D3636B2D1DBB418EACF48

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

C:\Users\user\AppData\Local\Temp\Tmp251C.tmp

C:\Users\user\AppData\Local\Temp\Tmp255B.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
file.exe

Function 02A92139 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 02911268 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 02911270 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Function 00C1AE30 Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Function 00C15935 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Function 04DE0BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 00C14248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 00C1C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 00C1D2F9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Function 00C1B020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 060F59C8 Relevance: 1.5, Strings: 1, Instructions: 286
COMMON

Function 060D1BA0 Relevance: 1.4, Instructions: 1438
COMMON

Function 060D3838 Relevance: .9, Instructions: 875
COMMON

Function 060D00D8 Relevance: .7, Instructions: 676
COMMON

Function 060D0D80 Relevance: .6, Instructions: 616
COMMON