Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1521610
MD5:	f2d385ddbb2edafacd070f103f7f1576
SHA1:	5ee6cb80bc943476067c148e5c16738b7b062029
SHA256:	d56a1a5602b5e72b8b9b2d6f2e0c5bc689682d0983f30b8c66dad9af093679b3
Tags:	NETexeMSILuser-jstrosch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Installs new ROOT certificates

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 776 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F2D385DDBB2EDAFACD070F103F7F1576)

conhost.exe (PID: 5716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 5308 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 2016 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "136.244.88.135:17615", "Bot Id": "LiveTraffic", "Message": "Error! Disable antivirus and try again!", "Authorization Header": "143feb5082f9936e624c1e27545e7d19"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2249581045.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2119466571.0000000003975000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2250952075.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 776	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 2016	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 2016	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
4.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.3975570.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.3975570.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T01:06:11.511627+0200	2043234	1	A Network Trojan was detected	136.244.88.135	17615	192.168.2.6	49713	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T01:06:11.325456+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:16.573654+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:16.876909+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:17.497066+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:17.687064+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:17.878109+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:18.163132+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:18.361738+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:18.549771+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:18.743182+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:18.942595+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:19.325070+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:19.581629+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:19.587209+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:20.442023+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:20.766761+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:20.953806+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:21.144901+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:21.409911+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:21.651333+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:21.877129+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:22.071444+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:22.257657+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:22.475259+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T01:06:16.881705+0200	2046056	1	A Network Trojan was detected	136.244.88.135	17615	192.168.2.6	49713	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T01:06:11.325456+0200	2046045	1	A Network Trojan was detected	192.168.2.6	49713	136.244.88.135	17615	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.2119466571.0000000003975000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "136.244.88.135:17615", "Bot Id": "LiveTraffic", "Message": "Error! Disable antivirus and try again!", "Authorization Header": "143feb5082f9936e624c1e27545e7d19"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: c:\rje\tg\ss2oyh1\obj\Release\ojc.pdb source: file.exe
Source:	Binary string: c:\rje\tg\ss2oyh1\obj\Release\ojc.pdbX source: file.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 064C938Fh	4_2_064C8C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 064CCF48h	4_2_064CCA50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 064C8B8Dh	4_2_064C88B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	4_2_064C2E88

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.6:49713 -> 136.244.88.135:17615
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.6:49713 -> 136.244.88.135:17615
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 136.244.88.135:17615 -> 192.168.2.6:49713
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 136.244.88.135:17615 -> 192.168.2.6:49713

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 136.244.88.135:17615

Source: global traffic

TCP traffic: 192.168.2.6:49713 -> 136.244.88.135:17615

Source: Joe Sandbox View

ASN Name: AS-CHOOPAUS AS-CHOOPAUS

Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135
Source: unknown	TCP traffic detected without corresponding DNS query: 136.244.88.135

Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9T
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002906000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002906000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002906000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002906000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002A14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.00000000029F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002906000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002A14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002A14000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002A14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: file.exe, 00000000.00000002.2119466571.0000000003975000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2249581045.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp5C65.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp5C55.tmp			Jump to dropped file

System Summary

.NET source code contains very large array initializations

Source: file.exe, MoveAngles.cs

Large array initialization: MoveAngles: array initializer size 311296

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00F4DC74	4_2_00F4DC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_04E56948	4_2_04E56948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_04E57C20	4_2_04E57C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_04E50040	4_2_04E50040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_04E5001F	4_2_04E5001F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_04E57C10	4_2_04E57C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0620A6B8	4_2_0620A6B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_062067D8	4_2_062067D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_06203F50	4_2_06203F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0620A688	4_2_0620A688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_06206FE8	4_2_06206FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_06206FF8	4_2_06206FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_064C9548	4_2_064C9548
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_064C7580	4_2_064C7580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_064C13C0	4_2_064C13C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_064C9FB0	4_2_064C9FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_064C8C30	4_2_064C8C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_064C6CB0	4_2_064C6CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_064CCA50	4_2_064CCA50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_064CE850	4_2_064CE850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_064CB9A0	4_2_064CB9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_064C13B0	4_2_064C13B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_064C6968	4_2_064C6968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_064CB985	4_2_064CB985

Source: file.exe, 00000000.00000002.2118137719.0000000000D0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000002.2119466571.00000000039B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePoseurs.exe8 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameVQP.exeD vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/6@0/1

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5716:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\Tmp5C55.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.4.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: c:\rje\tg\ss2oyh1\obj\Release\ojc.pdb source: file.exe
Source:	Binary string: c:\rje\tg\ss2oyh1\obj\Release\ojc.pdbX source: file.exe

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF04A8 push eax; retf 0000h	0_2_00CF04B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00F48800 push ebp; iretd	4_2_00F4881D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_04E522A4 push cs; ret	4_2_04E522A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0620EFB2 push eax; ret	4_2_0620EFC1

Source: file.exe

Static PE information: section name: .text entropy: 7.994122193996099

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\file.exe	Memory allocated: CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 27D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 47D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 7349			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 2485			Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 1600	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6500	Thread sleep time: -27670116110564310s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: RegAsm.exe, 00000004.00000002.2258992866.0000000005269000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D1F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJm6+yF+1A6ySN83i+WdwHy5TP6AGa54yNOQDMt0K/OHXfg+kqThLIfk6QFsLDCjZdpZTGOzjUsCOwZe5C6Gi8Q8TVSedBLpSfsvQj8BDp18kmZ3ex54YP0+Gs0yuOc0oHyahpuklKSN9DNVuBZhWH/uMHS1PAuQ5a2Lju9F/SWeKm7prBc0jVP84iPJxdnHVJ/HDDDbXL54Z89qdU0Vcin6gqmwXrJjGgP4IA8IR19qewIwTnUCQdrTZp1GW0u9j1R6sUgPUrm2c5cvXl9oot3E2Yi+lA6TVxs+wzTv0RyoJlnAb/LVyrQ+JXXkt08JQiqZojt7zmAq6A6TMAI3d99XjZOb1H2Ej05cPkbrRi3jsQ/1cA/+FiEaSdYURoSjyCbui7SR58sFKCEAn3HKH4uwm3eDW6eeqSVnn3vRu5S+ZPUrZgKYs8lgl1/fYieGCfbdnVWn1in27qZ19Yfhv4WKpf3SAPgywfR4sYK3wdc8VGoHmK3TWFL5jmOUHB49Ogy2jYoedRvh3h9D96fGhUBv0WbVKW3Fxq4ViXVL2x9NKNgA+vC8A5zUncE8H2TafulfEOSRqFccYu86ht5uc0nLgpiCrzoulmnAYZLfk4zbvX51WQrYMsc8ORmzRWmqqLFXZVINxxVKaxrpheUhYRfRx54cZnzZZxdMOYT0VhpWbZdIcVFHnb3QBFJEgxwyQpCTte0yQjzn7uCUZsuA+iYIJO4a+Hmq+9ONtmOcMMYl7TbktlwpTMf366yxqm+uPbWY4CHOTnXrwGvPjnt7OfVwg2HHr8jHcJ5uzn/JOx/BvEfztbLR
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_064C40B8 LdrInitializeThunk,

4_2_064C40B8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: file.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")
Source: file.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")
Source: file.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_02972139 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_02972139

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 710008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000004.00000002.2269727525.0000000008F53000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3975570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3975570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2249581045.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2119466571.0000000003975000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2016, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\walletsLR
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q4C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q-cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: qdC:\Users\user\AppData\Roaming\Binance
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q&%localappdata%\Coinomi\Coinomi\walletsLR
Source: RegAsm.exe, 00000004.00000002.2250952075.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q8C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2250952075.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2016, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3975570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3975570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2249581045.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2119466571.0000000003975000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2016, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Install Root Certificate	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	61%	ReversingLabs	Win32.Trojan.Jalapeno

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
136.244.88.135:17615	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id14ResponseD	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002A34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id23ResponseD	RegAsm.exe, 00000004.00000002.2250952075.0000000002A14000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id12Response	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id2Response	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id21Response	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id9	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id8	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id6ResponseD	RegAsm.exe, 00000004.00000002.2250952075.0000000002A14000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id4	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id7	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id6	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id19Response	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id13ResponseD	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002A34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id15Response	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002A34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5ResponseD	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id6Response	RegAsm.exe, 00000004.00000002.2250952075.0000000002A14000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.ip.sb/ip	file.exe, 00000000.00000002.2119466571.0000000003975000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2249581045.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id1ResponseD	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id9Response	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id20	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id21	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id22	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id23	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.00000000029F8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id24	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id24Response	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id1Response	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id21ResponseD	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002A34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id10	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id11	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id10ResponseD	RegAsm.exe, 00000004.00000002.2250952075.0000000002906000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id12	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id16Response	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id13	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id14	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id15	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id16	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id17	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id18	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5Response	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id19	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id15ResponseD	RegAsm.exe, 00000004.00000002.2250952075.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id10Response	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id11ResponseD	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002A34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id8Response	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id17ResponseD	RegAsm.exe, 00000004.00000002.2250952075.0000000002906000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/soap/envelope/	RegAsm.exe, 00000004.00000002.2250952075.00000000027D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8ResponseD	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2250952075.0000000002A34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	RegAsm.exe, 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
136.244.88.135	unknown	United States		20473	AS-CHOOPAUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521610
Start date and time:	2024-09-29 01:05:18 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/6@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 123 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
19:06:16	API Interceptor	48x Sleep call for process: RegAsm.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-CHOOPAUS	DEMANDA LABORAL.COM.exe	Get hash	malicious	AsyncRAT	Browse	45.32.163.234
	DEMANDA G.COM.exe	Get hash	malicious	AsyncRAT	Browse	207.246.64.185
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	95.179.250.45
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse	95.179.250.45
	KBDFW9FTsq.exe	Get hash	malicious	RedLine	Browse	95.179.250.45
	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer	Browse	95.179.250.45
	https://duroterra.com	Get hash	malicious	Unknown	Browse	207.148.0.16
	VwsPnLkxnp.exe	Get hash	malicious	Unknown	Browse	139.180.202.227
	t77rOVfEUc.exe	Get hash	malicious	Unknown	Browse	139.180.202.227
	JE2TjQlTkn.exe	Get hash	malicious	Quasar	Browse	139.180.202.227

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 05:47:17 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.4664974039784013
Encrypted:	false
SSDEEP:	48:8SNd5TvGk0lRYrnvPdAKRkdAGdAKRFdAKR6P:8S5bH7
MD5:	9C80DA0C152E245068D6E15C7837DDBA
SHA1:	AEAC8D6AB59C10EE9961E728F0F5488D603ADD11
SHA-256:	DBE4DEB575DF8E333360E4A47B6A7EF3C8FDD6FFF71F4F42026E4A5D156101B3
SHA-512:	3F92A723849CF5937EE2B0E92201050C68F46BC69F569B169EDB86E48F3EEC826F9C665FB6D2B0551DAE0E258CACD1C1DB97D0808CECAA1EE0B1A07EEC55097F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,....~.5.W....X.&&... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.IEW.5....B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEW@2....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.2..Chrome..>......CW.VEW.2....M.....................7...C.h.r.o.m.e.....`.1.....EW.2..APPLIC~1..H......CW.VEW.2..........................7...A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.L .chrome.exe..F......CW.VEW.5.........................l...c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlq0
MD5:	0C1110E9B7BBBCB651A0B7568D796468
SHA1:	7AEE00407EE27655FFF0ADFBC96CF7FAD9610AAA
SHA-256:	112E21404A85963FB5DF8388F97429D6A46E9D4663435CC86267C563C0951FA2
SHA-512:	46E37552764B4E61006AB99F8C542D55B2418668B097D3C6647D306604C3D7CA3FAF34F8B4121D94B0E7168295B2ABEB7C21C3B96F37208943537B887BC81590
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Temp\Tmp5C55.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp5C65.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.98614836123111
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	321'536 bytes
MD5:	f2d385ddbb2edafacd070f103f7f1576
SHA1:	5ee6cb80bc943476067c148e5c16738b7b062029
SHA256:	d56a1a5602b5e72b8b9b2d6f2e0c5bc689682d0983f30b8c66dad9af093679b3
SHA512:	e6ee00d15483ef29fb7e48ed28833ce5059f7bfada96b92c350246f6032f85d318571950bf6d2ee557e417e87d24d90965aa1523782416792fa7eb7354266df5
SSDEEP:	6144:8KNfu572RY1YNfnlxThJDfeDp7B9wNjudYHpHNHqQtb4qNp28Rrm:82Gt2RhNfz/u1B9wNSd0UQF4t8pm
TLSH:	4364234FA72AB7A6C5121132D5FC024BE0F5925B8C046F6978C89048AFDEFDD0BAB355
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...,..f............................~.... ........@.. .......................@............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x44fc7e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F71B2C [Fri Sep 27 20:53:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4fc30	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x50000	0x5c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x52000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4faf8	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4dc84	0x4de00	7878cd18e43df178928f181a81849657	False	0.9921592847110754	data	7.994122193996099	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x50000	0x5c8	0x600	68f544591fce342af9e6fa73bcad1819	False	0.435546875	data	4.111096590207842	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x52000	0xc	0x200	ff88b27b9b6f856e95a52ab290e7f06f	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x500a0	0x334	data			0.4426829268292683
RT_MANIFEST	0x503d8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-29T01:06:11.325456+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:11.325456+0200	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:11.511627+0200	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	136.244.88.135	17615	192.168.2.6	49713	TCP
2024-09-29T01:06:16.573654+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:16.876909+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:16.881705+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	136.244.88.135	17615	192.168.2.6	49713	TCP
2024-09-29T01:06:17.497066+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:17.687064+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:17.878109+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:18.163132+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:18.361738+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:18.549771+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:18.743182+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:18.942595+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:19.325070+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:19.581629+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:19.587209+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:20.442023+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:20.766761+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:20.953806+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:21.144901+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:21.409911+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:21.651333+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:21.877129+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:22.071444+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:22.257657+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP
2024-09-29T01:06:22.475259+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49713	136.244.88.135	17615	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 01:06:10.638900042 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:10.643917084 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:10.644059896 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:10.653528929 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:10.658386946 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:11.293531895 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:11.325455904 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:11.330461025 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:11.511626959 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:11.554020882 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:16.573653936 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:16.578418016 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:16.761943102 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:16.761962891 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:16.761974096 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:16.761985064 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:16.761996031 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:16.762007952 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:16.762198925 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:16.762200117 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:16.876909018 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:16.881705046 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:17.070712090 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:17.116585970 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:17.497066021 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:17.503987074 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:17.684706926 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:17.687063932 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:17.691915989 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:17.872224092 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:17.878108978 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:17.883163929 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:17.883200884 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:17.883223057 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:17.883269072 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:17.883290052 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:17.883378029 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:18.159043074 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:18.163131952 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:18.167975903 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:18.357232094 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:18.361737967 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:18.366573095 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:18.546879053 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:18.549771070 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:18.554671049 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:18.739299059 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:18.743181944 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:18.747961044 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:18.936240911 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:18.942595005 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:18.947432995 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.128442049 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.179091930 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.325069904 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.329974890 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.510477066 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.553973913 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.581629038 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.587094069 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.587110996 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.587120056 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.587208986 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.587250948 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.587260008 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.587307930 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.587398052 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.587407112 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.587435007 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.587443113 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.587461948 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.587479115 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.591871977 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.591881990 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.591938972 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.591955900 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.591964960 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.591974020 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.591981888 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.591990948 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.592000961 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.592020035 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.592041969 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.592236042 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.592245102 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.592299938 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.592356920 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.592365980 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.592374086 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.592430115 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.592504978 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.592554092 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.596967936 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.596976995 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.596986055 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.596996069 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597038984 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.597088099 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597101927 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597111940 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597141981 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.597153902 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.597194910 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597203970 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597212076 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597220898 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597229004 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597237110 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597244024 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.597245932 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597254992 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.597255945 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597264051 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597271919 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597285986 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.597352982 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597362041 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597369909 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597378016 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597387075 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597434998 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.597456932 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.597503901 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597512960 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597522020 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597553968 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.597563028 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.597606897 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597615957 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597624063 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597631931 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597640038 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597645998 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.597647905 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597656965 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597661972 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.597676992 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.597690105 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.597702980 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.597732067 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.599056005 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.599064112 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.599112034 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.601619005 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.601629019 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.601655006 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.601675034 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.601691961 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.601707935 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.601716995 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.817209959 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.817606926 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.817950010 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.817998886 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818240881 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818249941 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818321943 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818348885 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818411112 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818418980 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818475962 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818484068 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818521976 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818530083 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818572998 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818579912 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818682909 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818697929 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818705082 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818712950 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818727970 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818736076 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818746090 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818758011 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818816900 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818825006 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818854094 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818867922 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818923950 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818939924 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818948984 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818955898 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.818998098 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819005966 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819048882 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819056034 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819102049 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819109917 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819158077 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819165945 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819226980 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819236040 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819295883 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819313049 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819320917 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819329977 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819365025 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819372892 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819399118 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.819432974 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819441080 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819468021 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819468021 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.819475889 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819506884 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819514990 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819561958 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819570065 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819641113 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819649935 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819673061 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819681883 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819782019 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819833040 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819845915 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819854021 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819869995 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819879055 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819909096 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.819916964 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.820005894 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.820014000 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.820051908 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.820060968 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.820080042 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.820090055 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.820130110 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.820137978 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.820177078 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.820193052 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.820230961 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.820240021 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.820285082 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.820293903 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.820312977 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.822350025 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.822405100 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.824271917 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824321032 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824330091 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824366093 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824373960 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824418068 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824430943 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824470997 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824479103 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824498892 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824512005 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824547052 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824556112 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824579954 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824588060 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824652910 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824661970 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824668884 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824676991 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824687004 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824695110 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824754953 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824764013 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824767113 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824774981 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824790001 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824799061 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824805975 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824820042 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824830055 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824886084 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824893951 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824902058 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824935913 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824944019 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824959993 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.824968100 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.825012922 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.825021982 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.825048923 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.825057030 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.825074911 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.825083971 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.825098991 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.825108051 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.825139999 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.825148106 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.825156927 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.825165987 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.825222015 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.825231075 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.825241089 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.825248957 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.825280905 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.825525999 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.825578928 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.827265978 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827275991 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827325106 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827333927 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827374935 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827388048 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827497005 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827505112 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827558041 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827574015 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827615976 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827624083 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827666998 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827675104 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827758074 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827765942 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827791929 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827800035 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827822924 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827913046 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827922106 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827929974 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827945948 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827954054 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827989101 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.827996969 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828044891 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828052998 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828093052 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828100920 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828171968 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828180075 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828221083 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828228951 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828268051 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828275919 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828306913 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828372955 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828382015 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828391075 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828422070 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828429937 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828464985 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828504086 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828546047 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828555107 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828584909 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828593969 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828639030 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828646898 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828685045 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828694105 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828723907 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828758955 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.828959942 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.829020023 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.830440998 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830450058 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830459118 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830476046 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830526114 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830534935 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830576897 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830585003 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830630064 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830660105 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830687046 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830696106 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830761909 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830770016 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830811977 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830821037 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830849886 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830857992 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830904007 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830912113 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830951929 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830960035 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.830995083 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831002951 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831031084 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831059933 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831099987 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831136942 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831187963 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831196070 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831227064 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831294060 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831301928 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831310034 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831341028 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831350088 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831393003 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831402063 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831435919 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831444025 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831486940 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831496000 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831536055 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831543922 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831629038 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831638098 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831662893 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831671000 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831733942 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831758022 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831783056 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831790924 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831828117 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.831890106 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.832077026 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.832134962 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.833770037 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.833801985 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.833811045 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.833846092 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.833853960 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.833883047 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.833892107 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.833961010 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.833969116 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.833982944 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.833991051 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.833997011 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834003925 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834083080 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834091902 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834100008 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834108114 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834126949 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834135056 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834144115 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834172964 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834181070 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834192038 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834261894 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834270954 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834280014 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834310055 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834319115 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834326982 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834336996 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834345102 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834359884 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834368944 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834378004 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834429979 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834439039 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834472895 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834481001 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834490061 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834527969 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834537983 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834572077 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834580898 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834613085 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834620953 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834659100 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834666967 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834681034 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834690094 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834707975 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834716082 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834772110 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834780931 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834800005 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.834992886 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.835045099 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.837007046 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837022066 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837035894 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837044954 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837086916 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837095022 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837129116 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837137938 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837173939 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837182045 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837227106 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837234974 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837271929 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837296963 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837367058 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837374926 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837409973 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837418079 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837460995 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837470055 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837515116 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837588072 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837635994 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837645054 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837671995 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837702990 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837711096 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837743998 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837753057 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837759972 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837790966 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837800026 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837821960 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837889910 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837899923 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837907076 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837939024 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837946892 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837990046 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.837997913 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.838037968 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.838046074 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.838078976 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.838087082 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.838097095 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.838104963 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.838167906 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.838176012 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.838213921 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.838222980 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.838254929 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.838310003 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.838356972 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.838366032 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.839873075 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.839896917 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.839945078 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.839952946 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.839993954 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.840045929 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.840051889 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840059996 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840069056 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840092897 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840184927 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840193033 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840197086 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840243101 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840250969 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840310097 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840317965 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840395927 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840404987 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840459108 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840468884 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840533972 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840542078 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840604067 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840641975 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840701103 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840709925 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840790033 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840797901 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840811968 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840820074 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840852022 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840859890 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840902090 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840909958 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840950012 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840962887 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840986967 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.840995073 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.841022015 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.841029882 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.841053009 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.841061115 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.841111898 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.841120005 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.841126919 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.841135025 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.841161966 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.841171026 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.841206074 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.841214895 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.841245890 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.841253996 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.841311932 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.841319084 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.841326952 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.841474056 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:19.844981909 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.844993114 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845024109 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845032930 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845143080 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845150948 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845217943 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845231056 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845268965 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845278025 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845344067 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845351934 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845393896 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845402956 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845546961 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845577002 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845671892 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845680952 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845688105 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845699072 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845706940 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845736027 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845748901 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845782995 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845791101 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845830917 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845839977 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845865965 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845875025 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845884085 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845948935 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845957994 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845968008 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.845995903 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846004009 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846043110 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846051931 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846091032 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846098900 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846129894 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846138954 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846235037 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846244097 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846251011 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846259117 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846297026 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846306086 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846343040 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846350908 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846430063 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846438885 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846482038 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846491098 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846529961 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846538067 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846544981 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846601963 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846610069 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846642971 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846695900 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846704006 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846745014 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846752882 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846776009 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846899033 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846908092 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.846915960 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.847064018 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.847071886 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.847103119 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.847161055 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.847176075 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.847208023 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.847441912 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.847450972 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.847538948 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.847547054 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.847574949 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.847664118 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.847672939 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.847681046 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.847704887 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.847712994 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.847793102 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:19.847801924 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:20.414418936 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:20.442023039 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:20.448849916 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:20.764760971 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:20.766761065 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:20.771614075 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:20.951442957 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:20.953805923 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:20.958595991 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.139185905 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.144901037 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:21.149794102 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.335972071 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.382251978 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:21.409910917 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:21.414814949 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.595273018 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.647744894 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:21.651333094 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:21.657825947 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.657881975 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.657906055 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.657943010 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.657965899 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.657988071 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.658010006 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.658030987 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.658052921 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.658189058 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.664066076 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.664096117 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.664124012 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.664154053 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.664180040 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.842781067 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:21.877129078 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:21.882100105 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:22.070965052 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:22.071444035 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:22.076371908 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:22.256875038 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:22.257657051 CEST	49713	17615	192.168.2.6	136.244.88.135
Sep 29, 2024 01:06:22.262682915 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:22.443764925 CEST	17615	49713	136.244.88.135	192.168.2.6
Sep 29, 2024 01:06:22.475259066 CEST	49713	17615	192.168.2.6	136.244.88.135

Target ID:	0
Start time:	19:06:07
Start date:	28/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x670000
File size:	321'536 bytes
MD5 hash:	F2D385DDBB2EDAFACD070F103F7F1576
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2119466571.0000000003975000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:06:07
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:06:08
Start date:	28/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xb0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:06:08
Start date:	28/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x4e0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000004.00000002.2249581045.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2250952075.0000000002879000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2250952075.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	30.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	36.4%
Total number of Nodes:	22
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02972139 Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,029720AB,0297209B), ref: 029722A8
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 029722BB
Wow64GetThreadContext.KERNEL32(00000314,00000000), ref: 029722D9
ReadProcessMemory.KERNELBASE(00000310,?,029720EF,00000004,00000000), ref: 029722FD
VirtualAllocEx.KERNELBASE(00000310,?,?,00003000,00000040), ref: 02972328
TerminateProcess.KERNELBASE(00000310,00000000), ref: 02972347
WriteProcessMemory.KERNELBASE(00000310,00000000,?,?,00000000,?), ref: 02972380
WriteProcessMemory.KERNELBASE(00000310,00400000,?,?,00000000,?,00000028), ref: 029723CB
WriteProcessMemory.KERNELBASE(00000310,?,?,00000004,00000000), ref: 02972409
Wow64SetThreadContext.KERNEL32(00000314,04E70000), ref: 02972445
ResumeThread.KERNELBASE(00000314), ref: 02972454

Strings

aryA, xrefs: 0297217F
VirtualAlloc, xrefs: 02972200
SetThreadContext, xrefs: 0297225F
GetThreadContext, xrefs: 02972213
ReadProcessMemory, xrefs: 02972226
VirtualAllocEx, xrefs: 02972239
CreateProcessA, xrefs: 029721ED
WriteProcessMemory, xrefs: 0297224C
GetP, xrefs: 029721BB
Load, xrefs: 02972177
TerminateProcess, xrefs: 02972337
ress, xrefs: 029721C3
ResumeThread, xrefs: 02972275
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 029722A7

Memory Dump Source

Source File: 00000000.00000002.2118822653.0000000002971000.00000040.00000800.00020000.00000000.sdmp, Offset: 02971000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2971000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-1257834847
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 6c0b8a6ff32433eedf93945e1a6d4ecccae03052eb5524dc46a0d117907d254f
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 6EB1E67664024AAFDB60CF68CC80BDA77A9FF88714F158524EA0CAB341D774FA41CB94

Function 00CF1274 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 00CF12F8

Memory Dump Source

Source File: 00000000.00000002.2118119751.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1a1346c6f44c80bf4b0a3fa8b9ecea3e71bd4507b51419f1ea18b2806737f90f
Instruction ID: a3fce7e2e41113ffaa8265734f154548feffe14de2654326bbc06c8218e51287
Opcode Fuzzy Hash: 1a1346c6f44c80bf4b0a3fa8b9ecea3e71bd4507b51419f1ea18b2806737f90f
Instruction Fuzzy Hash: A72112B1900249DFDB10CFAAC980AEEFBF0FF48310F10841AEA19A3250C7746914CBA1

Function 00CF1278 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 00CF12F8

Memory Dump Source

Source File: 00000000.00000002.2118119751.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ba2b6bfe6c09ab6a579dbd3b5c63a289eb16c2cbe6156694f51d5be92061f4ed
Instruction ID: 40447aa778ddf04758342a0c1e714ca97142ff481a2568b10e822c7be984774d
Opcode Fuzzy Hash: ba2b6bfe6c09ab6a579dbd3b5c63a289eb16c2cbe6156694f51d5be92061f4ed
Instruction Fuzzy Hash: E22104B190024DDFDB10DF9AC880ADEFBF4FF48310F10841AEA19A7250C7756910CBA5

Analysis Process: RegAsm.exePID: 2016, Parent PID: 776COMMON

Execution Graph

Execution Coverage:	12.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.5%
Total number of Nodes:	236
Total number of Limit Nodes:	19

Executed Functions

Function 064C9FB0 Relevance: 4.6, APIs: 1, Strings: 1, Instructions: 1117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C2, xrefs: 064CA737, 064CA73C

Memory Dump Source

Source File: 00000004.00000002.2265585332.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_64c0000_RegAsm.jbxd

Similarity

API ID:
String ID: C2
API String ID: 0-4155693530
Opcode ID: 3a2be375ca0a2cdf36fd8fae23ebd773bfbbbb469166012298aa68d0530b0178
Instruction ID: 8f95b782be26f4053f8f40a5d961c32961040cbb73e08b68d81d3b9a8fca6812
Opcode Fuzzy Hash: 3a2be375ca0a2cdf36fd8fae23ebd773bfbbbb469166012298aa68d0530b0178
Instruction Fuzzy Hash: BEC29174A02229DFDBA4EF24D998B9DB7B2FB49300F1085EAD409A7355DB346E85CF40

Function 064CCA50 Relevance: 2.9, Strings: 2, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1, xrefs: 064CCD55
., xrefs: 064CCCD0

Memory Dump Source

Source File: 00000004.00000002.2265585332.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_64c0000_RegAsm.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: 98d8bf3e56b7f1562e8c0794460138a8efda4b7ddd96a9e028cfbf816899c837
Instruction ID: e0c0769901a16c95fb6b1e0326fe148c5723500b19a639e239c3eaafd370b196
Opcode Fuzzy Hash: 98d8bf3e56b7f1562e8c0794460138a8efda4b7ddd96a9e028cfbf816899c837
Instruction Fuzzy Hash: 67F1C274E01229CFDB68DF65D984B9DBBB2FF8A301F1081AAD509A7390DB355A81CF50

Function 064C40B8 Relevance: 1.6, APIs: 1, Instructions: 60libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 064C411D

Memory Dump Source

Source File: 00000004.00000002.2265585332.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_64c0000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4474e3661b062dae20410fb972256c4cfc627e8a1dcb534bf9d5855ab21bf721
Instruction ID: 64ef76d3f0c9c01e38133098a0e9ad15540fb9d5783ced132d90fd2831be6b3f
Opcode Fuzzy Hash: 4474e3661b062dae20410fb972256c4cfc627e8a1dcb534bf9d5855ab21bf721
Instruction Fuzzy Hash: 2E21B279E01218DFDB44DFAAE984ADDBBF1BB89320F10902AE515B7360DB345851CF54

Function 064C6CB0 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\V^j, xrefs: 064C6F67

Memory Dump Source

Source File: 00000004.00000002.2265585332.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_64c0000_RegAsm.jbxd

Similarity

API ID:
String ID: \V^j
API String ID: 0-1106363800
Opcode ID: 19ff9835d1387e0aad733e8d1ffd9ff4cae834b618cd1a9ec9f1a8ffd32a85ff
Instruction ID: 162b24b4f1c9a45bf088b3be0ce9193b7d26c77585f3a82acd25b9d0d89d9b8c
Opcode Fuzzy Hash: 19ff9835d1387e0aad733e8d1ffd9ff4cae834b618cd1a9ec9f1a8ffd32a85ff
Instruction Fuzzy Hash: 04B16E74E00209CFDB91CFA9C9817AEBBF2AF88724F15C52ED415A7354EB749845CB81

Function 06203F50 Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b59ee82d8253d4b54348ad60a2055fa0965a7862ac1e5f44ac220986e4dcb424
Instruction ID: 1489871cddcbbee9a9c9a5c51e5b8a81a5e784805f20aba8207a5ab939e74c3e
Opcode Fuzzy Hash: b59ee82d8253d4b54348ad60a2055fa0965a7862ac1e5f44ac220986e4dcb424
Instruction Fuzzy Hash: B4126134B10205DFDB54EF69C844AAEBBF6BF88710B158169E906EB3A5DB70DC41CB90

Function 04E56948 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2257792369.0000000004E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 103ede844372ad237547eabe9709ab82aba9b0cfbc6f9775b9471f65e3e05eea
Instruction ID: 71ac274ae90f4b1f63604075aaf74ec365cc27817614a7d28508b4e4ab2c30d9
Opcode Fuzzy Hash: 103ede844372ad237547eabe9709ab82aba9b0cfbc6f9775b9471f65e3e05eea
Instruction Fuzzy Hash: C722F175A01228CFDB65DF60C954BD9BBB2FF8A300F4091E9D509AB2A1DB359E84DF40

Function 064C8C30 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2265585332.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_64c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475a05e0fd6be373b4e18457e6a5d685c77723a6d7a1207f48f7d49b234eb46f
Instruction ID: 4017102b87452041c623dae0e6dfe7c76ce8f7bd04fd23a88b543b2131e6718e
Opcode Fuzzy Hash: 475a05e0fd6be373b4e18457e6a5d685c77723a6d7a1207f48f7d49b234eb46f
Instruction Fuzzy Hash: 36228D74D01229DFDBA5DF65C890BDABBB2AF49310F1081EAD509A7350EB349E85CF90

Function 064CE850 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2265585332.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_64c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f8f88cca674fa83b0615cd8407abaa2746fbef4b460a2e30579754295de654f
Instruction ID: c93527ccbae2428de85f71d287da183a8996b9ed7c9aa27dab19fb6dc28bc0ba
Opcode Fuzzy Hash: 7f8f88cca674fa83b0615cd8407abaa2746fbef4b460a2e30579754295de654f
Instruction Fuzzy Hash: 8602AE35E00256CFCB95DF74C4502ADFBB2BF85310F24866ED456AB341E774AA85CB90

Function 062067D8 Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd586f036b860a8a0898703ea2a90e31b4a97e41eb7a50bf99459275e0325724
Instruction ID: dae8a2c9ec980feb791ce38309d206ae1a726fefb2a4e27bd092675fd34f67d5
Opcode Fuzzy Hash: dd586f036b860a8a0898703ea2a90e31b4a97e41eb7a50bf99459275e0325724
Instruction Fuzzy Hash: 2BF1D431A1020A9FEF45DF68D944B9EBBF2EF84300F148569E905EB2A2DB70DD55CB90

Function 064C13B0 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2265585332.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_64c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdf808a5248e8404683541b42a3b761d5207f838ffde7d951a6dbaa32cea0b20
Instruction ID: 03bbdc8009e0e419ef4a2b1d40617361e48e42e9fa7caa362abd949691994fc2
Opcode Fuzzy Hash: bdf808a5248e8404683541b42a3b761d5207f838ffde7d951a6dbaa32cea0b20
Instruction Fuzzy Hash: 6BE15F74E00209AFDF88EBF4D954AAEBBB6EF88710F104029A506BB356CF755C02DB15

Function 064C13C0 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2265585332.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_64c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a3cf330967c69cfa50e1a3dd530e0b940b79263baa25c7e2522bb61d2b3d601
Instruction ID: 93a143ac25ed3bcb0e92581b167762db39984d30630ed20f4977dcaddbaa54fd
Opcode Fuzzy Hash: 8a3cf330967c69cfa50e1a3dd530e0b940b79263baa25c7e2522bb61d2b3d601
Instruction Fuzzy Hash: 2AE13E74E00209AFDF88EBF4D954AAEBBB6EF88710F104029A506BB356CF755C02DB55

Function 0620A688 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24d1c4eb56b32584e8173146d96d44de074888957c226741ece3c525c96ca841
Instruction ID: cfc0005bca3dfbe9e4af31a84a99dfa9194b40ab1bd506b2b7ef92309cbb9d1b
Opcode Fuzzy Hash: 24d1c4eb56b32584e8173146d96d44de074888957c226741ece3c525c96ca841
Instruction Fuzzy Hash: 69D10570D00318CFCB18EFB4D854AADBBB2FF8A301F5091A9D50AAB255DB759986CF50

Function 0620A6B8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1de88ebccc5d4c6920b54696f47e66e3141a9e14aea4bb11e3d3b4eef37bb895
Instruction ID: d93246dc08254b8b2e6a0bdac16d4aeb78f65cef97c5569977f4c5042cc8f2af
Opcode Fuzzy Hash: 1de88ebccc5d4c6920b54696f47e66e3141a9e14aea4bb11e3d3b4eef37bb895
Instruction Fuzzy Hash: 93D1F470E00318CFCB18EFB4D854AADBBB2FF8A301F5091A9D50AAB255DB759985CF50

Function 04E57C20 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2257792369.0000000004E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36007938bfc4201bcc82393dd824a379a962d0ef9ad93008ea9b760159d0fb5e
Instruction ID: b13688c79fea3a7b385c89831e3875273e6f5dc4682dc1681a27061710c44af2
Opcode Fuzzy Hash: 36007938bfc4201bcc82393dd824a379a962d0ef9ad93008ea9b760159d0fb5e
Instruction Fuzzy Hash: FBC19474E01218CFEB14DFA9D840A9DFBB2BF89300F14D1A9D819AB365DB34A985CF51

Function 064CB9A0 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2265585332.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_64c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2336a83f0209f4375c0411a41b74574762f39ac676afc1e9110de0cea5f8d40
Instruction ID: 120dd2434392112a209eec4826371f437baf0f642bbfb65a3f25d1976d800b87
Opcode Fuzzy Hash: c2336a83f0209f4375c0411a41b74574762f39ac676afc1e9110de0cea5f8d40
Instruction Fuzzy Hash: 0FC1D274D01229CBEBA8DF65C950BDEBBB2BF89300F1081EAD509AB350DB755A85CF50

Function 064C7580 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2265585332.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_64c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3114dafb20abf2b60d5efcf29f6ff1f28f6c563d475891a9c007e122750205ff
Instruction ID: aaf2e8cf899d5d6bbc983dbf6ccd96c6fc1ebc871565ffb3c6080a164daf4ef3
Opcode Fuzzy Hash: 3114dafb20abf2b60d5efcf29f6ff1f28f6c563d475891a9c007e122750205ff
Instruction Fuzzy Hash: 8DB17C74E00609CFDB90CFA9C981B9EBBF2AF88760F14852ED415A7394EB749845CF91

Function 064C9548 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2265585332.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_64c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4152682d5b43ed01629d2de0f180e0f1f7275857bd7c90b38e1fe6ee0357085
Instruction ID: efdd063cd39234e72e362378b78bf23faacdf3705d57978e051fbd5e3f44f525
Opcode Fuzzy Hash: e4152682d5b43ed01629d2de0f180e0f1f7275857bd7c90b38e1fe6ee0357085
Instruction Fuzzy Hash: 66910374E01218CFDB58DFA9D584A9DBBF2FF89301F20906AE409AB355DB359982CF40

Function 064C88B8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2265585332.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_64c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e641c4b26261da334dd54f4807ccbec2e242eed184aba1aba8df877f9e48db1
Instruction ID: 8a742cce2d577780ea01552aa98f8dde1d861916ce30415870f7e8941a9e427a
Opcode Fuzzy Hash: 8e641c4b26261da334dd54f4807ccbec2e242eed184aba1aba8df877f9e48db1
Instruction Fuzzy Hash: 9F91E274D01228DFDBA4DF68C944B9DBBB2FF89300F1081AAE509AB355DB306A85CF51

Function 064CB985 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2265585332.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_64c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc52c908571bf276200895623b23c01adc6a3129115fba24a5354892d5a99933
Instruction ID: 99715c02278d86094d09319ecf633e2187254d1335c74a6f64bb208950240aa4
Opcode Fuzzy Hash: fc52c908571bf276200895623b23c01adc6a3129115fba24a5354892d5a99933
Instruction Fuzzy Hash: D691E571D012698FDB69DF65C951BDEBBB2BF89300F1081EAD109AB250EB345E85CF50

Function 04E57C10 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2257792369.0000000004E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 676df4bde843f8dab7f8c5e414f009bc425d3ab1ab15ff2d4ba2c19950863f87
Instruction ID: 47e3dd7f7a05f0af7735e6394d0c95124035d1ac15e8b1fa7b795b7e47068fad
Opcode Fuzzy Hash: 676df4bde843f8dab7f8c5e414f009bc425d3ab1ab15ff2d4ba2c19950863f87
Instruction Fuzzy Hash: ED51C875E002188BEB18DFA6D94179EFBB3BFC8300F14D069D81DAB269EB3459468F50

Function 00F4AE30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00F4B086

Strings

,V, xrefs: 00F4AFBE
,V, xrefs: 00F4AFE3

Memory Dump Source

Source File: 00000004.00000002.2250749231.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f40000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID: ,V$,V
API String ID: 4139908857-4205429026
Opcode ID: 62906a16c1c0d6499b3b70463d5b1f00c27413df66054454c422ed7a13ea4170
Instruction ID: c80740d598eb5a39cf751dca853de685e4cf445b1c21d8a9c0cbe17136eecff9
Opcode Fuzzy Hash: 62906a16c1c0d6499b3b70463d5b1f00c27413df66054454c422ed7a13ea4170
Instruction Fuzzy Hash: 887146B0A00B058FD724DF2AD54575ABBF1FF88714F00892DE85AD7A40DB79E849CB91

Function 04E51B90 Relevance: 1.8, APIs: 1, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2257792369.0000000004E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e50000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c95046f7d114f69c204bba1fa3af9c715f83fd2d03901d02897c39ffae73093f
Instruction ID: 4b690d06f405a1d2d7168420aaf4ecf8c9daa77c5d9b027bdff1085b07597ed7
Opcode Fuzzy Hash: c95046f7d114f69c204bba1fa3af9c715f83fd2d03901d02897c39ffae73093f
Instruction Fuzzy Hash: 779191B1C093889FEB12CFA5C8509DDBFB0EF0A300F5A819EE845AB162D7355906CB51

Function 064C3ED8 Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 064C4030

Memory Dump Source

Source File: 00000004.00000002.2265585332.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_64c0000_RegAsm.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 31c76dc7e5df8c4cd6b95cc4cbe0c4ec06508d88a523b88aaeec2ab52a2522f5
Instruction ID: 2f8605eaef1365236b73bdd8482d88c288a9cc38baa34b4788ef758280e813d7
Opcode Fuzzy Hash: 31c76dc7e5df8c4cd6b95cc4cbe0c4ec06508d88a523b88aaeec2ab52a2522f5
Instruction Fuzzy Hash: 0051C378E01208DFDB48EFA5D5946EEBBB6FF88310F20942AE515AB355DB345942CF40

Function 04E51CE4 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04E51E02

Memory Dump Source

Source File: 00000004.00000002.2257792369.0000000004E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e50000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 2ecd9bd5dfccfc0cbdfae6508f9ecbc5d685548e174db682fa2a7f4300634386
Instruction ID: ac646bd360027e464adeb08467a94954a463dd4cca7c38dc4270f6843f9bed3b
Opcode Fuzzy Hash: 2ecd9bd5dfccfc0cbdfae6508f9ecbc5d685548e174db682fa2a7f4300634386
Instruction Fuzzy Hash: B251D3B1D00349DFDB14CF99C884ADEFBB5BF48314F24952AE819AB210DBB5A945CF90

Function 04E50AA8 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04E51E02

Memory Dump Source

Source File: 00000004.00000002.2257792369.0000000004E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e50000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 89b31691a8aa3637bbf0ace6bc925c7ceeb9d961a080ce3f855f1cbd57fd8f2e
Instruction ID: a038f56bd619480984b7eaf4e5b829bbd0aded2d6d490ae40a0d980ae642a509
Opcode Fuzzy Hash: 89b31691a8aa3637bbf0ace6bc925c7ceeb9d961a080ce3f855f1cbd57fd8f2e
Instruction Fuzzy Hash: B951D2B1D00349DFDB14CF99C984ADEFBB5BF48314F64912AE819AB210DBB4A845CF90

Function 04E50BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04E54381

Memory Dump Source

Source File: 00000004.00000002.2257792369.0000000004E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e50000_RegAsm.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 602067d20c933bb2946f9aed3e5434aa1c5dedb98dc3bacded2b28cfd1807c2e
Instruction ID: 6edf47db67dc44a37199df3605a3b15cfcb42c4e548baf64e6aa43e6b7617dfe
Opcode Fuzzy Hash: 602067d20c933bb2946f9aed3e5434aa1c5dedb98dc3bacded2b28cfd1807c2e
Instruction Fuzzy Hash: C34149B5A00309DFDB14CF99C448BAEBBF5FF88318F248458D919AB360D774A840CBA0

Function 00F44248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F459F1

Memory Dump Source

Source File: 00000004.00000002.2250749231.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f40000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9782fbcbb9552307706a73e4ff31e7232d7ae1d10ee4d6348bcd5c3bda28e4cf
Instruction ID: 3ecd32cf72f4ddee92aaeca9316ec10b78210072f023392932bcf13ec1e55e1f
Opcode Fuzzy Hash: 9782fbcbb9552307706a73e4ff31e7232d7ae1d10ee4d6348bcd5c3bda28e4cf
Instruction Fuzzy Hash: 3141E0B0C0072DCBEB24DFA9C984B9DBBB5FF44714F20816AD408AB251DBB5A945CF90

Function 00F45935 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F459F1

Memory Dump Source

Source File: 00000004.00000002.2250749231.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f40000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4c31cc3f2547b4230301a005efd1c8d18fcf6f855a7b0db7892fec4ec8cd7dc2
Instruction ID: 17d3ad97e33f8b0e55dcd322ca83821a90f6272bed42be01937590afd7a6d3d0
Opcode Fuzzy Hash: 4c31cc3f2547b4230301a005efd1c8d18fcf6f855a7b0db7892fec4ec8cd7dc2
Instruction Fuzzy Hash: A741CFB1C00B29CFEB24DFA9C984B9DBBB5BF44714F20816AD408BB251DBB56945CF90

Function 064C3F5A Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064C4030

Memory Dump Source

Source File: 00000004.00000002.2265585332.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_64c0000_RegAsm.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: a02bd0cd3fc0c0e08738ea078dfb1e2c1d3abe48861455826bdb909cb8536358
Instruction ID: b920126246d6463fd1363c87b917e6a1135cc30e7612d0f1bcf661d77639f707
Opcode Fuzzy Hash: a02bd0cd3fc0c0e08738ea078dfb1e2c1d3abe48861455826bdb909cb8536358
Instruction Fuzzy Hash: CD31B478E01209DFCB44EFA4D5905EDBBB2FF48310F20942AD516AB355DB359942CF50

Function 00F4C9A0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00F4D2C6,?,?,?,?,?), ref: 00F4D387

Memory Dump Source

Source File: 00000004.00000002.2250749231.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f40000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: dff92e58a97970f1e10b91be116e32a74fca3db93cab2030644f40f1944ff720
Instruction ID: e36184d4cca8a41467d8873cbbb64aac81dfd78461ad05e44cf4c0d5486f777c
Opcode Fuzzy Hash: dff92e58a97970f1e10b91be116e32a74fca3db93cab2030644f40f1944ff720
Instruction Fuzzy Hash: 5321D4B59002499FDB10CF9AD984AEEBFF4EB48324F14841AE914A3310D774A954CFA5

Function 00F4D2F9 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00F4D2C6,?,?,?,?,?), ref: 00F4D387

Memory Dump Source

Source File: 00000004.00000002.2250749231.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f40000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b6a944b146f73e6894d1db28981571464bfe11643ed25fc18449727362501b65
Instruction ID: 5c4da0d70f774b06680ed18af3e426d5741264988be3a030460be20acd48c070
Opcode Fuzzy Hash: b6a944b146f73e6894d1db28981571464bfe11643ed25fc18449727362501b65
Instruction Fuzzy Hash: ED21E3B5D00249AFDB10CF9AD984AEEBFF4EB48324F14841AE918B3210D375A954CFA5

Function 062059C8 Relevance: 1.5, Strings: 1, Instructions: 299COMMON

Download Yara Rule

Strings

d, xrefs: 06205C29

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 4870486ded8943c1aaaf65d9b68c35d079228c43ec82cfd5e8db99c9e55bd1fb
Instruction ID: 715df0c1f40b25575aa437ca6bfa260b34f197e372695b947c0b11c32d78d5fe
Opcode Fuzzy Hash: 4870486ded8943c1aaaf65d9b68c35d079228c43ec82cfd5e8db99c9e55bd1fb
Instruction Fuzzy Hash: D8C17D35600602CFDB15CF28C58096ABBF2FF89310B65CA99D55A9B6A6D730FC46CF90

Function 064C3E08 Relevance: 1.5, APIs: 1, Instructions: 49comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 064C3E65

Memory Dump Source

Source File: 00000004.00000002.2265585332.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_64c0000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 97dfff23ac3c2559f4b8b4e75b78bf9279aa0a8d9c521057bdd701314bc005db
Instruction ID: da506c8db564137bd44522726ce55f818bb0fda5cceb9f2b68af0613afeb7a74
Opcode Fuzzy Hash: 97dfff23ac3c2559f4b8b4e75b78bf9279aa0a8d9c521057bdd701314bc005db
Instruction Fuzzy Hash: E21133B58003498FDB60CF9AD885BDEBFF4AB48324F20881AE518A7300C774A944CFA5

Function 064C37E1 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 064C3E65

Memory Dump Source

Source File: 00000004.00000002.2265585332.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_64c0000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 2e4f3941cb7210f3bc0c54c9f4e0429af4c0ea5dce9983b482a32ab7766ff3f1
Instruction ID: 92b7e190a0771766feb30d7832c29e266ada941389ef431c34ac37902c51001e
Opcode Fuzzy Hash: 2e4f3941cb7210f3bc0c54c9f4e0429af4c0ea5dce9983b482a32ab7766ff3f1
Instruction Fuzzy Hash: E91136B5800749CFDB60DF9AC884B9EBFF4AB48324F24885AD519A7700C375A944CFA5

Function 00F4B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00F4B086

Memory Dump Source

Source File: 00000004.00000002.2250749231.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f40000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 259c937ab3f1c98cee34b6b4b4a1b8b092b7d0d35034cc57d0e90a5773ebccc4
Instruction ID: 7511f9d4e6b69a51e865f444e8ab8d2e67d063f45894b4f04e814fc0bd796e85
Opcode Fuzzy Hash: 259c937ab3f1c98cee34b6b4b4a1b8b092b7d0d35034cc57d0e90a5773ebccc4
Instruction Fuzzy Hash: 1111DFB6C007498FDB20CF9AC544B9EFBF4AB88724F14841AD829B7211D7B9A545CFA1

Function 064C37E4 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 064C3E65

Memory Dump Source

Source File: 00000004.00000002.2265585332.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_64c0000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f1ac1386c6ab0fa0f872bca732a14702e85d88968b15f024b3173dfbf94c169a
Instruction ID: c91f487b0a3293ff72d992c53e2d106af3f36c43b7963bf003c9ecb1ce627a9c
Opcode Fuzzy Hash: f1ac1386c6ab0fa0f872bca732a14702e85d88968b15f024b3173dfbf94c169a
Instruction Fuzzy Hash: 791133B58043498FDB60CF9AC584B9EBBF4EB48324F20881AD518B7300C3B8A944CFA5

Function 061E1BA0 Relevance: 1.4, Instructions: 1446COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261840793.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f77019a51049f773531f01054c41549989ef74d1f47dbd3aba4de38d8f007f67
Instruction ID: 7482f3696cc857a87e8f5212e736323228f4afd61e1c0ef68d9f4223fa74dfc6
Opcode Fuzzy Hash: f77019a51049f773531f01054c41549989ef74d1f47dbd3aba4de38d8f007f67
Instruction Fuzzy Hash: 90C23C70A006189FDB55DF64C854AAEBBB6FFC8700F108099E606AB3A1DF71EE45CB51

Function 061E46A1 Relevance: .9, Instructions: 877COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261840793.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a10d592327b2e3b49375975f85286a3ea795d4c3f434b4657ec2977a17ce260a
Instruction ID: 7069f8bc9b8708322ec13a2f7227ea88740185b8838ea8dd11909423ea27ad06
Opcode Fuzzy Hash: a10d592327b2e3b49375975f85286a3ea795d4c3f434b4657ec2977a17ce260a
Instruction Fuzzy Hash: 6A328034B04644DFDB85DF68C858A6EBBF6EF89600B15809AE506DB3A2CB71DC41CB61

Function 061E00D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261840793.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71d7d4af713b9ec7bcdff9f8676784eb8ec9dec6232be5828d75634e90d8eb20
Instruction ID: 950907280cbb8d3ba5ed2222ac8554e85dc29e0f3b910f404f5aef35bfa360d5
Opcode Fuzzy Hash: 71d7d4af713b9ec7bcdff9f8676784eb8ec9dec6232be5828d75634e90d8eb20
Instruction Fuzzy Hash: 7B422634700B198FDB68EB78D45462EBBF2FBC9605B01491CD502AB395CBBAED058B85

Function 061E3838 Relevance: .6, Instructions: 636COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261840793.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de40d2c446262179cdc4e2471d677f5fa5fb2dc3866cfa26db83507acf50d338
Instruction ID: d6f5602360fede86e99c1028cdbaa9554791845fd18b96bc526200b4b2ad12ff
Opcode Fuzzy Hash: de40d2c446262179cdc4e2471d677f5fa5fb2dc3866cfa26db83507acf50d338
Instruction Fuzzy Hash: 66420534B006149FCB44DF69C894EADBBF6AF89704F15809AE606DB3A6DB71ED40CB50

Function 061E0D80 Relevance: .6, Instructions: 623COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261840793.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 577dfa3d02fecff5318ba51b4df830fbd523865257eb378f93e54dc5fd587012
Instruction ID: 82053bbcd39a9ac12f16ecd45b5a16f6587c2dc109fce2efa47ffb2d4312ee7a
Opcode Fuzzy Hash: 577dfa3d02fecff5318ba51b4df830fbd523865257eb378f93e54dc5fd587012
Instruction Fuzzy Hash: C622C330B00605AFDB589BA9C844A6EBBF6FF89300B15886AE506D7396CF74DC51CB91

Function 062048B8 Relevance: .6, Instructions: 595COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5df5e43cfbdffdd4088f41aa8cfc8d4aeecc787800830bdd4f0faac68c0742e2
Instruction ID: 83e6b6b1313f5e2c3328a039e5afd16086a18303d6092031eb025dada9cfa45a
Opcode Fuzzy Hash: 5df5e43cfbdffdd4088f41aa8cfc8d4aeecc787800830bdd4f0faac68c0742e2
Instruction Fuzzy Hash: EB326034710605CFDB54EF29C494A6ABBF2FF89300B1585A9EA06DB3A2DB70EC45CB51

Function 061E00B8 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261840793.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a8682fd2e249ae1b1e1fe98540130f70cee104e86b53e621d358a2fddcc252a
Instruction ID: dab1d9e4877e4bff57b9110f40c4240aadfb294d7516bcb39fa3777c5e61a69c
Opcode Fuzzy Hash: 0a8682fd2e249ae1b1e1fe98540130f70cee104e86b53e621d358a2fddcc252a
Instruction Fuzzy Hash: 9CC17F34B006049FEB849B64C858B2A7BF6FFCD705F158459EA029B3A1CBB9DC51CB91

Function 061E1582 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261840793.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03cd3a9035ba876e1c891337c95680f2a71dbf91da608b305ba5ceac21f5172
Instruction ID: 31e8a1ba1bbe5bd504a91f3ca351741df965230b8b9a0e7ac0b625ad348fb2f9
Opcode Fuzzy Hash: e03cd3a9035ba876e1c891337c95680f2a71dbf91da608b305ba5ceac21f5172
Instruction Fuzzy Hash: D0C1C534B00641AFDB549BA8C859A7E7BE6BFC9704F14886AE502CB392DFB5DC01C791

Function 061E0756 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261840793.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b33361f01441286d3658aceecf7fb487c2bb017c509eabfcfd030bc3331be0e
Instruction ID: 2c0347014135b75f6e2e14cc2762bbb5309d6799c3c201b1ebdd0dceb4e0dd7b
Opcode Fuzzy Hash: 6b33361f01441286d3658aceecf7fb487c2bb017c509eabfcfd030bc3331be0e
Instruction Fuzzy Hash: B3B18F34B40A00DFEB849B64C858B2E77B6FBCD705F158455EA029B3A1CBB9DC51CB91

Function 061E06DE Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261840793.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7cf6eb9b4966ead3404dd16de2045ba4f2668866727352745597086b152b8db
Instruction ID: eb977e95a50eb14b6c7da9fbf04f4f4f3a13fd346a9d3af41dc7dd81df4526a4
Opcode Fuzzy Hash: b7cf6eb9b4966ead3404dd16de2045ba4f2668866727352745597086b152b8db
Instruction Fuzzy Hash: 1BB18E34B40A00DFEB849B64C858B2E77B6EBCD705F158465EA029B3A1CBB9DC51CB91

Function 061E0666 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261840793.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa0b9705dde8320055075aa400502ffae87ffefd32a2fb21892ac35b909246d2
Instruction ID: 3722ebb89246dafaa9c6f08c449322beaf2822d98f71ec6e00d33762a48f1d4d
Opcode Fuzzy Hash: aa0b9705dde8320055075aa400502ffae87ffefd32a2fb21892ac35b909246d2
Instruction Fuzzy Hash: 1CB17F34B40A00DFEB849B64C858B2E77B6EFCD705F158455EA029B3A1CBB9DC51CB91

Function 061E05EE Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261840793.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c3f1afbcc5481c5749d2d80b981611708cb13c0f8428554917ea7c21b296c80
Instruction ID: 21dfe9d5fce1b7fe80da84a5ec483871c6e26ed0b6936a70efe3cde56a24fc41
Opcode Fuzzy Hash: 5c3f1afbcc5481c5749d2d80b981611708cb13c0f8428554917ea7c21b296c80
Instruction Fuzzy Hash: 2AB18E34B40A00DFEB849B64C858B2E77B6EFCD705F158455EA029B3A1CBB9DC50CB91

Function 062048A8 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15877e9effcf6a868e77d5d570984757efaf8620add7694de44c05e7e4ea8e16
Instruction ID: 568a02937275ecb0e1f33a3852ecb916d216bfd22b1fec299724522881db04e7
Opcode Fuzzy Hash: 15877e9effcf6a868e77d5d570984757efaf8620add7694de44c05e7e4ea8e16
Instruction Fuzzy Hash: 18B13B34B10605CFDB54EF39C594AAABBF2BF88305B1580A8E546DB3A6DB30ED05CB50

Function 06208C88 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ee84b5d5fd95f8b442383d52e6e106f1c9ee18a5c3d97d73719bd177ac1dbc
Instruction ID: 0c0631fd33c66ce21e1be935bef395fca5e669f260402003e7281c7dd8466fa5
Opcode Fuzzy Hash: 81ee84b5d5fd95f8b442383d52e6e106f1c9ee18a5c3d97d73719bd177ac1dbc
Instruction Fuzzy Hash: 2941E431B083595FEF89AF74941076F3BA6AFC5650F14406AE809DB395DE388D06C7E2

Function 06207D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfb0432be65f41eedc4e6a3ffeed5be8ec1bc4c61511083d8983950b9ad8bdf2
Instruction ID: 918929744c2211fe232504f7968869ff23bace0ab7e647df6fdb8806586224ab
Opcode Fuzzy Hash: bfb0432be65f41eedc4e6a3ffeed5be8ec1bc4c61511083d8983950b9ad8bdf2
Instruction Fuzzy Hash: 56516771E10309CFEB54CFA9C880BDEBBF5AF88310F148529D815AB284DB74A845CF80

Function 061E34D8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261840793.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 921778656fc215092bcd96595ce591bc1286aa3ef37386aedc3a2b9805458e38
Instruction ID: 4d24b4fb8d83e3d132ca7182b6f8555ca1ebf1e3703525abe9ee399e1026daf2
Opcode Fuzzy Hash: 921778656fc215092bcd96595ce591bc1286aa3ef37386aedc3a2b9805458e38
Instruction Fuzzy Hash: F1513835B105159FCB44CF69C8849AEBBF2FF89310B158069E916AB361DB70EC05CB50

Function 061E3328 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261840793.00000000061E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8945604e68be7676b52005a04c82b524f992b4686cba32a2ad4a1df91a77200b
Instruction ID: 9afc18b398a31bd904302fad6b6988ffa009181d39ce9ac35972126964b40728
Opcode Fuzzy Hash: 8945604e68be7676b52005a04c82b524f992b4686cba32a2ad4a1df91a77200b
Instruction Fuzzy Hash: 99512835B10518EFCB44CF69C8849AEBBF2FF88310B15846AE915AB361DB71EC05CB50

Function 06207D4C Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ac1f8d1223af2ea89818ad8c95fd3e57c5ca448c2e6bb62e0c987e3c3a0529a
Instruction ID: 2574d88859a3a37aa38cc33f45d7dc6025c56b7b41c5d582c20cdad997201b09
Opcode Fuzzy Hash: 9ac1f8d1223af2ea89818ad8c95fd3e57c5ca448c2e6bb62e0c987e3c3a0529a
Instruction Fuzzy Hash: 0A5167B0D10259CFEB54CFA9C984BDEBBF5BF48700F14852AE815AB285DB74A945CF80

Function 06203DE0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc915c9bf19ea31518c3200a1af11303a0402244ae49124058bc32f4cd0674f
Instruction ID: a3725a6b436c9ed764509e0e8eb5dd8452a41acf27a28b3de72febc435fc0448
Opcode Fuzzy Hash: acc915c9bf19ea31518c3200a1af11303a0402244ae49124058bc32f4cd0674f
Instruction Fuzzy Hash: 833106327047518FD759A778A8505AE7BF6DFCA32031944AAD80ACB791DE24EC07C7A1

Function 06205579 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db17cac738ad757dc11bb41f97668ad6931667ab58d7ee275a33db7f78e8215
Instruction ID: 8aa521d9d844108c4dcf5f63f54660ecef3696774b906c6ab795fac143c55e8e
Opcode Fuzzy Hash: 2db17cac738ad757dc11bb41f97668ad6931667ab58d7ee275a33db7f78e8215
Instruction Fuzzy Hash: EB315A39B112119FDB49DF38D8849AE7FB2BF89200B548569ED05DB356DB30ED05CB90

Function 062084C8 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab61e8f1e757c9ce225ea814ff7852cac357a35510cf44b9fed058e6e95eacc
Instruction ID: 8cc3472bf51b4e01aaef926c1a96df3fd75a2204b08f427fbba0f5682ad7a9da
Opcode Fuzzy Hash: aab61e8f1e757c9ce225ea814ff7852cac357a35510cf44b9fed058e6e95eacc
Instruction Fuzzy Hash: 3B31AB717002158BDB08EF79A85017E7BE3AFC8200B54443AD60ADB385EF388E469792

Function 06205588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d80d69544ea05f4ec2b48119642c625413581a093009654605ab4eaec9aab55
Instruction ID: f52d2e7fd863febae6acf64b4561c453ea610fb33da848d1e433a28c6191d650
Opcode Fuzzy Hash: 2d80d69544ea05f4ec2b48119642c625413581a093009654605ab4eaec9aab55
Instruction Fuzzy Hash: 0D314639B112119FDB19DF38D8849AEBFB2BF89200B508469E9069B355DF30ED01CB90

Function 062087A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cd03d0950602ed3fa7016ecf8e7d7ff58e83dff264c7c4415ea811e6623c79e
Instruction ID: 586f54b2f3de8eb70be188f865627ce59d4e931b3b4d1e3b80ddbae470512915
Opcode Fuzzy Hash: 6cd03d0950602ed3fa7016ecf8e7d7ff58e83dff264c7c4415ea811e6623c79e
Instruction Fuzzy Hash: 814112B1D1124C9FEF54CFAAD980ADEBBB5AF88310F14802AE815B7240DB74A945CF90

Function 0620FBE0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2504b43dd9f8d3594f30b83fe8dac83b247afcaf2e52f6597a2c76186a62c6f9
Instruction ID: 9e6cd81ba05a63b17177cb4e3699bf1f49c96bbdc16f04ff588e82feab9f02d7
Opcode Fuzzy Hash: 2504b43dd9f8d3594f30b83fe8dac83b247afcaf2e52f6597a2c76186a62c6f9
Instruction Fuzzy Hash: 883125397043514FDB196B38E81456E3FF6EFC921931044AEE805CB392EE748C09CB61

Function 06208796 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01e683615e96b18ffa053bbb9ba25bada93928a099f47263dac773f59f665979
Instruction ID: fe5df7d220729c2c2a8f21b646df99148e07cf47bdd3b9281ddd52305bb66cf6
Opcode Fuzzy Hash: 01e683615e96b18ffa053bbb9ba25bada93928a099f47263dac773f59f665979
Instruction Fuzzy Hash: AD3111B1D112499FEB54CFAAC984BDEBFB6AF88310F14802AD815B6290DB789945CF50

Function 06208A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21baf108ae12e96d57764ec5f24890221e78aef464a17d64b7252b3931ab617b
Instruction ID: 51e3396b0492249ce478b17e038eedb5df3961a375f2fbb4a5240ebbd8ece7e0
Opcode Fuzzy Hash: 21baf108ae12e96d57764ec5f24890221e78aef464a17d64b7252b3931ab617b
Instruction Fuzzy Hash: D53114B1D11258DFEF54CFA9D880BDEBBF5AF88310F14842AE805B7240CB78A945CB90

Function 00A8D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2249914224.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a8d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5496bf7e155a2eb7b1084c0157cd9a1a2ef0779a37e9d225511c5d453ecf12a
Instruction ID: 6ec849214fcc6fff5f84aa2273baa427452ee2e11af7e4a1c4e747c72b361e5f
Opcode Fuzzy Hash: d5496bf7e155a2eb7b1084c0157cd9a1a2ef0779a37e9d225511c5d453ecf12a
Instruction Fuzzy Hash: E92125B6504244EFDB04EF14D9C0B26BF65FB94324F24C56DD9090B296C376E856CBA2

Function 06209158 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64659d67a92fc2e860d2dd382471bcbf64675f7cbd7e4fa17e4890e7b7824013
Instruction ID: d52f2b31ae811a92c6b1be58ef2e0b4e8003e4c8956c7f6914c5be9436a9e707
Opcode Fuzzy Hash: 64659d67a92fc2e860d2dd382471bcbf64675f7cbd7e4fa17e4890e7b7824013
Instruction Fuzzy Hash: 2F310274E1420ADFDB40CFA8D4886EDBBB4FF49301F1054AAE816A3392D7745A81DF90

Function 00E7D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2250520274.0000000000E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e7d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b556885f9983baa1fd2fdb7bad73388461f07a3320589fc1e8c69f7096d8ec
Instruction ID: 3860bae5c09b5473d18db313f4aba7ee108707ba48c17f8ed1945bd0f671165a
Opcode Fuzzy Hash: b8b556885f9983baa1fd2fdb7bad73388461f07a3320589fc1e8c69f7096d8ec
Instruction Fuzzy Hash: 3B210E75608240EFCB14DF24DD80B26BBA2EF84318F24E56DD90E5B296C77AD847CA61

Function 06208A8C Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19e18ead18c3f431a4d0372986fbefee8d5ba5ded5813e89ad8001f684bbfb20
Instruction ID: 0ad52a9bb74b6863f5a9d5ed1d86e15bb576784ff7cfe99f8e2e6367894acd46
Opcode Fuzzy Hash: 19e18ead18c3f431a4d0372986fbefee8d5ba5ded5813e89ad8001f684bbfb20
Instruction Fuzzy Hash: 202125B1D112499FDF54CFA9C885BDEBFF8AB48310F14842AE405A7241CB789945CBA0

Function 00E7D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2250520274.0000000000E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e7d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5186972a04c163662c0d1babecf8bfd6c0d7f28d7ddf05cc1b8c81dca2d61bc9
Instruction ID: 8151ccf339a44616c46ca4d2b54fdacaeb4fb303de5a17035c621da6f56b8134
Opcode Fuzzy Hash: 5186972a04c163662c0d1babecf8bfd6c0d7f28d7ddf05cc1b8c81dca2d61bc9
Instruction Fuzzy Hash: 3D214F755093C08FCB12CF24D994715BF71EF46218F28C5EAD8498B6A7C33A984ACB62

Function 06208E70 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d34eb1cee615714410029f40bf4a1b8cea8ac767489a857fda903d18a205c61d
Instruction ID: ddf54ad4d4886c64c34a6e15c9cf0f8cba0b65a08319dbbb68a1da1207840721
Opcode Fuzzy Hash: d34eb1cee615714410029f40bf4a1b8cea8ac767489a857fda903d18a205c61d
Instruction Fuzzy Hash: 8221C479E11218DFDF44DFA9E8586DDBBB5BB88310F10502AE809B3350D7741945CB54

Function 00A8D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2249914224.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a8d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5504dfd99aeaae02a5904faf24bf7c180eb56da23d91347c8bcbb22ee6d9b3
Instruction ID: f14bddfa71c6c114215141579903c7970e5b548bd12fa33d02a633b3404461a4
Opcode Fuzzy Hash: 5a5504dfd99aeaae02a5904faf24bf7c180eb56da23d91347c8bcbb22ee6d9b3
Instruction Fuzzy Hash: E011E6B6504284DFCB15DF10D9C4B16BF71FB94324F24C6A9DC094B656C33AE85ACBA1

Function 0620BF2F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e1f80d367aaab8bed0e510c5bbcd2363be595d6fd64b8a2d31642d64e9f19e
Instruction ID: 469d0f07dfaf2984233570e714ec707965952081eb15eb3dc8105776a75d6fa9
Opcode Fuzzy Hash: c1e1f80d367aaab8bed0e510c5bbcd2363be595d6fd64b8a2d31642d64e9f19e
Instruction Fuzzy Hash: 0201C8312005058FC7C8BB24E91456D7BF7FFC1359764681CE30687A81DEB4794B9B94

Function 06208C10 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 109f6cdcbe05299a9583b2c7b8ea0a5251576dc327fe8ab2869ca5afceba724a
Instruction ID: 1e6fb8111e54cbaca463bd93e73c02d31a4da607fe31ef8c746b0cd929eb3068
Opcode Fuzzy Hash: 109f6cdcbe05299a9583b2c7b8ea0a5251576dc327fe8ab2869ca5afceba724a
Instruction Fuzzy Hash: 7901A2B26042059FE744DB65EC80BAB7FB9EBC8320F01456EE109C7292DAB59C0587A0

Function 06208F28 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5957d2314a29f7372c9870b257c2cac259c894d59cb79b030279f6883a636e90
Instruction ID: 500e5fd5d5753d2b4654f5e3518cd3a363fddfb253df362d3151937cb356fb7c
Opcode Fuzzy Hash: 5957d2314a29f7372c9870b257c2cac259c894d59cb79b030279f6883a636e90
Instruction Fuzzy Hash: 811133B1E0524ACFDB09CFA5D9445EEBBB6AF89305F1040AAD814B72A1DB355E44CFA0

Function 06208C78 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd447ba4ed0e978811caa01fbecf518fabc56c421339aa26893569714b5df2b5
Instruction ID: 9d6884d4efd16551c7592068565d5a5cf927facf9b1814eba9cf32bfb4e9e6c9
Opcode Fuzzy Hash: cd447ba4ed0e978811caa01fbecf518fabc56c421339aa26893569714b5df2b5
Instruction Fuzzy Hash: BA01A7357042496FFB555E28D854BAB37AAEBD8660F044026FD09C7381CA359C16C7A1

Function 06208350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fafe27df26e5cbad73b524df849f040665d50e1364dc4d09adc0a5c667c5c53a
Instruction ID: f2ece0f5e71dfcf47191b28e7ca7aaf1410f841afbc120d469aad1319c48250f
Opcode Fuzzy Hash: fafe27df26e5cbad73b524df849f040665d50e1364dc4d09adc0a5c667c5c53a
Instruction Fuzzy Hash: 4B018431B002199BDF10DEA9EC84ABFF7FAEBC8751B14403AE604D3241DB70A95587A1

Function 0620C769 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d391d6704cc9b7ff21c5b8ec1840bed64582b94e1f000a673720b5475c2824b
Instruction ID: bcde871fa258f2711074e033264bad6f935c176d16b609f07cdfbf01fab430d0
Opcode Fuzzy Hash: 0d391d6704cc9b7ff21c5b8ec1840bed64582b94e1f000a673720b5475c2824b
Instruction Fuzzy Hash: 7601C4352006048FE324EF65E00426E7BE2FFC8315F208A2DD04A97745DFB8A84ACB91

Function 06208F38 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4754a8ddcc939ba57bddef5b4260cfae22ac8574f59f0c947e37795e74ff85a0
Instruction ID: 0fa4a1e5ea2790a908a51b4dc340129018757fa8f4e2d15f4ab3172263eb8dc4
Opcode Fuzzy Hash: 4754a8ddcc939ba57bddef5b4260cfae22ac8574f59f0c947e37795e74ff85a0
Instruction Fuzzy Hash: DC11F375E002098BDB04DFA9D8045EEBBB6EF88301F10406AD414B33A0DB755E41CFA0

Function 0620BF40 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 162c49bad37fedca3a4db6c673649366d64e2b146948b82fc9c8b39bf7de863b
Instruction ID: 4d2909f93f70078adb02a74eb6c135c7bfef395b9f0996a5b371f99131565a51
Opcode Fuzzy Hash: 162c49bad37fedca3a4db6c673649366d64e2b146948b82fc9c8b39bf7de863b
Instruction Fuzzy Hash: 8801B1362009058B8BC8B738E55456E7BE3FEC0259364682CE3078BA81DD787D0BAB95

Function 00A8D885 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2249914224.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a8d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84ee8cae83d6353ea667fcaba9fe37f3b19d0cf4c3f611178b3d0332556a5076
Instruction ID: 00e4b254b0aba3e62238dbe8382c77eaa8c88985af26dc70adfd553198c61b9f
Opcode Fuzzy Hash: 84ee8cae83d6353ea667fcaba9fe37f3b19d0cf4c3f611178b3d0332556a5076
Instruction Fuzzy Hash: 42012671404340DAE710AF69CE80B26BFE8DF41724F18C45AEE085A2C2CAB89840DB71

Function 0620C778 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49bdbefc98c40a7cdd8f1a69af9958adeb946b17ea436803cbf20f023a9fa458
Instruction ID: 96faf5d255d175df57d9d9a057646ba7174e4be541ef7f389c584847c0eb1465
Opcode Fuzzy Hash: 49bdbefc98c40a7cdd8f1a69af9958adeb946b17ea436803cbf20f023a9fa458
Instruction Fuzzy Hash: A701B1352006048FE328EF65E40866E7BE3EFC8715B108A2DD04B97745DFB8A90ACBD1

Function 06205508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70a422959ca657cdce2823c07787ec9edf4d7ab5f94445397002a9f509469bb8
Instruction ID: 2838d8e318a679fe764694ea21b20848c41e64bb7d725dfe7a4b276398502416
Opcode Fuzzy Hash: 70a422959ca657cdce2823c07787ec9edf4d7ab5f94445397002a9f509469bb8
Instruction Fuzzy Hash: F301D638A31702CFEBA89A35A644663BFF7BF84205704882CD80696586DEB1E480CF80

Function 06206E92 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e69f8ad4a38ea19194259a461f0f62420e42b65d6bd5e5530164ce09a68565f2
Instruction ID: 62ae6ca1f0b5252a8f8fba641821d024f6c2529183bd9bd329a95b94ff25127c
Opcode Fuzzy Hash: e69f8ad4a38ea19194259a461f0f62420e42b65d6bd5e5530164ce09a68565f2
Instruction Fuzzy Hash: 52F062672081D83F8B564EAA5C11CFB3FFDDA8E161B094096FED4C2152C028CA52AB71

Function 0620EB70 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae61b781c8073e65e7dde467387bc561f7336e885a9b5e11abad52b4b4b04191
Instruction ID: 5649f5e99b9846ccf2e1743322f945bb5fd10727ee78e3ad6cc1981e0905739c
Opcode Fuzzy Hash: ae61b781c8073e65e7dde467387bc561f7336e885a9b5e11abad52b4b4b04191
Instruction Fuzzy Hash: 7E01D138208309DFCB45AF74D8148697FB6FF86200B1088EDE9418B362DB329C05DB91

Function 06209168 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a9ee93c61096a478e891645638c2305206f72d22ea5beb583ac6ec1d74e4d86
Instruction ID: f864c7451617b0340702d18eb43d0719ebd1c4321d7e03d1219e962a9612afd1
Opcode Fuzzy Hash: 4a9ee93c61096a478e891645638c2305206f72d22ea5beb583ac6ec1d74e4d86
Instruction Fuzzy Hash: 9D01D6B4E0421ADFDB44DFA9D9486AEFBF5FB48300F1095A9D815A3392E7740A80DF90

Function 0620B628 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2be12cd0316f019ab57c054091bb7c576c2ba0380013d93eab05efaad66446b2
Instruction ID: bb75b76e7ede77360360d7c0c99c814777965720c63861336a8356a1c5606e79
Opcode Fuzzy Hash: 2be12cd0316f019ab57c054091bb7c576c2ba0380013d93eab05efaad66446b2
Instruction Fuzzy Hash: F4018B7490220AEFCB05FFB8E58469CBFB5FB84304F2064ACD806A7201EB345A85DB40

Function 06203EC8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 756983d76ece914df05231db709408dd017ddb6eb3df45c8c2ae797bd2f4b06f
Instruction ID: a4f2d8e11a5d4af5027bc14d238b4ce243767b29eea79794cd55a13fa8dbe819
Opcode Fuzzy Hash: 756983d76ece914df05231db709408dd017ddb6eb3df45c8c2ae797bd2f4b06f
Instruction Fuzzy Hash: 79F09A313001028BC618F769E85096E7BE6EFC9310310992DD50AAB744EFA4EE0787E1

Function 06208C20 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58593cbfffdd456ce0075a93c5f7744b565e001fdcd6719ba572f54ec2c0197
Instruction ID: b2c3e29b3d8119f57fda9534004f32b385710880719ea7f8f8c8e39e35176f80
Opcode Fuzzy Hash: a58593cbfffdd456ce0075a93c5f7744b565e001fdcd6719ba572f54ec2c0197
Instruction Fuzzy Hash: ABF054717002155FD714DE55DC54EAB77AEEBC8314F10452AE109C7381DAB5EC0587A0

Function 00A8D884 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2249914224.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a8d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7271fddc30723e088138d1ccb80d6638e25264c9a27990c8edb16adcd67ce528
Instruction ID: 42e312f90902e77a712392c42da5179aa4fe8be4e93537991b670ed0d2b9d984
Opcode Fuzzy Hash: 7271fddc30723e088138d1ccb80d6638e25264c9a27990c8edb16adcd67ce528
Instruction Fuzzy Hash: 6DF0C2714043449AE7109F0ACDC4B66FFD8EB81725F18C49AED085A286C6789C40CB71

Function 06206EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee3fade94a68b67978e8ac718e554de6ca3462f994a601c81ed2f3377c76479
Instruction ID: df3dff4f96c48fd169bb2b4342363e962164be34284a3212417b7b3843ca6591
Opcode Fuzzy Hash: 0ee3fade94a68b67978e8ac718e554de6ca3462f994a601c81ed2f3377c76479
Instruction Fuzzy Hash: 68F082762081E83F8B154E9A5C10CFB3FEDDA8E161B084056FE98C2141C429C961ABB0

Function 062067C8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be6601aca9d73bfa31c62f43958421ba9d267301c73ae6d8871192aa9f11820d
Instruction ID: fbea8254e35583432ae03d61af1c5e3520542db97c35e26585a5434f3ea21098
Opcode Fuzzy Hash: be6601aca9d73bfa31c62f43958421ba9d267301c73ae6d8871192aa9f11820d
Instruction Fuzzy Hash: 8BF02431B103019FE7208B689845F907FE1AB42710F148226E650CB1E2D7B0D8059740

Function 0620B4B9 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb2410fa24fabd3bea16540e1c85d798166b66c2fc4c2c732044c3a1ad7c83ca
Instruction ID: 8337a85c007639efa8a7f8887948fe14ffbc26e8df31e1c2ce8fac35c21f7736
Opcode Fuzzy Hash: cb2410fa24fabd3bea16540e1c85d798166b66c2fc4c2c732044c3a1ad7c83ca
Instruction Fuzzy Hash: C2F08272205201AFC7542B66A8686AA7FE9EBCA714B1054ADF24AD3243CAA5180687A1

Function 062091E8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38fd29df9461a767844cc0f858cb69a5140ad8df9b28f1a82585c0e67e82f955
Instruction ID: fce1ddaeacf340590e0ffa830dc7ec10e9cbc92f323979be8357a32c647a8428
Opcode Fuzzy Hash: 38fd29df9461a767844cc0f858cb69a5140ad8df9b28f1a82585c0e67e82f955
Instruction Fuzzy Hash: 67F082317002048F9754DBE9E590566F7E5DFC8224318C86EDD1EC7B41DA32FC028780

Function 062091DA Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9519c90482141665bab5cc873c06fafe14881624e8de7847452f81e075749c
Instruction ID: 8842474876ca21a0827bbdb3fca362eaa09680b12e53da3891c20542aa4553c7
Opcode Fuzzy Hash: ae9519c90482141665bab5cc873c06fafe14881624e8de7847452f81e075749c
Instruction Fuzzy Hash: 0EF0E275F1D2489FE761CAA494100A4FBF8DB8A21030458DADC5EC7783DA219E02C781

Function 062054F8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b862e0c232b90419b8bf5016df3c714aca29e1c265cfa06bb7ace6680c5026
Instruction ID: c3981e442f40bb681cd7f214a29ac97d4d39222fcb6830109b0060ae0ddd8652
Opcode Fuzzy Hash: 12b862e0c232b90419b8bf5016df3c714aca29e1c265cfa06bb7ace6680c5026
Instruction Fuzzy Hash: 4BF0F638525742CFE7A5CF20D6006677FB2AF81214F08449DE845579A3D675E544CF90

Function 06208340 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9dc3c30a19c850021ccbffef647565149eb05049e42695c24b4d279e6ffc008
Instruction ID: 3c232f0ce4266db1ab5f108a3a113777ca99c48ba65aad4448e1bd3f2037401b
Opcode Fuzzy Hash: e9dc3c30a19c850021ccbffef647565149eb05049e42695c24b4d279e6ffc008
Instruction Fuzzy Hash: 33F0A731B142169BCF50DA69AC846EFFBFAEBC9260F0C053ED954D3141E735A415C3A2

Function 0620AF88 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eab002a634bc138b9bc06c46dc15d1376bb5a56fdb9d6346332af237aa80454
Instruction ID: f4ed344eac5a1ca5e05bb948d97ae1534e0fc1515b7daf8b3c66ac4bfcbefb63
Opcode Fuzzy Hash: 0eab002a634bc138b9bc06c46dc15d1376bb5a56fdb9d6346332af237aa80454
Instruction Fuzzy Hash: 2EF027B371C1A0AFC75627686C640BD3FA6E9C769230810DFD646CB293CA994A07C3E1

Function 0620B638 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d924c2bbe4a94ccd33956023c50199567cebb226947e8176a06ef81329b86b80
Instruction ID: 6c6995ffde0d229e3b4daf544e5a2477466831e8228aa184f3d2cbb063373b21
Opcode Fuzzy Hash: d924c2bbe4a94ccd33956023c50199567cebb226947e8176a06ef81329b86b80
Instruction Fuzzy Hash: F3F08C34E02209EFCB09FFB8E54949C7BB5FB84204B1051ADD406E7205DB345A48DB40

Function 0620C440 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38c734d78734dc5bccca596b5ed920bdbcf74432174131fa79703bc7a9c8e5e1
Instruction ID: 17c2b0bb4e714b0391929b6f679273bb49d5fb7b63d90426f2f8a1911f88dae8
Opcode Fuzzy Hash: 38c734d78734dc5bccca596b5ed920bdbcf74432174131fa79703bc7a9c8e5e1
Instruction Fuzzy Hash: 77F0AF74500B059FD729DF26E808266BBF6FF8C304B00CA1EE48A83A01DB70A489CF84

Function 0620C3E0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90dc773d058c2689a4a5b8ccf7038e3b8ee66dbd9f4ca0cddec0f48e300eba4b
Instruction ID: 1e5b9c5381a1b66e1b30ef0e481c23583b0fbc5b70cd5dcfc2d1f6d378e86355
Opcode Fuzzy Hash: 90dc773d058c2689a4a5b8ccf7038e3b8ee66dbd9f4ca0cddec0f48e300eba4b
Instruction Fuzzy Hash: C1F0B435245B908FC7119B28F8047AE7FE6DFC1309F04055DE1868BA42CAF559458B91

Function 06209237 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4596c0dedf0386506c39335d00c63c8b9aec2ddff1676d5ed7058aa2ee5c7cbe
Instruction ID: 828271b5aec08d3c1490683c41f3395fed598c4719f743d0c23f873c5e531db7
Opcode Fuzzy Hash: 4596c0dedf0386506c39335d00c63c8b9aec2ddff1676d5ed7058aa2ee5c7cbe
Instruction Fuzzy Hash: 3AF0BE74E00348AFDB52EFB4E800B9D7BB0AB05300F0081A5D805A73A2D7346E55CB81

Function 06209294 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22086c5fb047f0d91a11c416b52c51bae577ce251bd93a4163ed15d0064290ad
Instruction ID: 1499411ecea29320f4c7eb13d60b6f1ba4931a86436ea7f32f95bc3a4d0b66c7
Opcode Fuzzy Hash: 22086c5fb047f0d91a11c416b52c51bae577ce251bd93a4163ed15d0064290ad
Instruction Fuzzy Hash: 23F024B2D05240DFE741EB60D8217A97F70EB41300F0081DAD8068B3E2D7789A91CB80

Function 0620B4C8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f66659c28ee3200d5cb416b279c2492dd81c06dacc5bfc34da89a1fd35b351c6
Instruction ID: 10848f7c112f959ebd66afc291d98defb55788d4c6c7a07c44616a91c0cf0db0
Opcode Fuzzy Hash: f66659c28ee3200d5cb416b279c2492dd81c06dacc5bfc34da89a1fd35b351c6
Instruction Fuzzy Hash: BEE09272200100AFC7242A6AE858AAE7BEEEBCA761B50507DF20ED3242CEE5180547A1

Function 0620C978 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e6a8d39cf533129c9a99b4e16f0b9bf95321d7fff274c906633470d03630cf1
Instruction ID: 8e03fb7588794f81ec9b885d29aeeed79d7e6b0cad5e36030273d27824391355
Opcode Fuzzy Hash: 2e6a8d39cf533129c9a99b4e16f0b9bf95321d7fff274c906633470d03630cf1
Instruction Fuzzy Hash: ABF03034901248EFCB40EFB8E555ADCBFB1EF85315F20559CD40AA7311DB351A49DB51

Function 0620C450 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db82a4eaafbb0efcf2c3c6b77dcd006046640898dea1e4f439198be68b31f55f
Instruction ID: 3517d6a91d07988452b868613bec2c0bd532c53542cb97d080bc8fe14598f1cd
Opcode Fuzzy Hash: db82a4eaafbb0efcf2c3c6b77dcd006046640898dea1e4f439198be68b31f55f
Instruction Fuzzy Hash: 48F09A78500B019FD729EF26E408566BBF6FF8C304B00C62EE84B83A11DB70A449CF84

Function 0620AF40 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0d89a6d15fa3268a762823e4e9e080250393910aad7cd6fb814c8d1a02124f1
Instruction ID: 7a996ef50e1bc70288f6e17767327c0b14e215162ab277a7b6f03b775fcdce30
Opcode Fuzzy Hash: f0d89a6d15fa3268a762823e4e9e080250393910aad7cd6fb814c8d1a02124f1
Instruction Fuzzy Hash: 25E048727151605FCB16273478544FE7FAADAC7552308109BE246C7242CEA44E1687D5

Function 0620B7D0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cce53b12ec9f5ec19d235c4cb022cb091fab557a81f35e9053d3dbd456f51ae7
Instruction ID: 19fabb28fcedf6847c7a45d4d3928d8c9235e8a78c4467ad92630e79ba2afdb0
Opcode Fuzzy Hash: cce53b12ec9f5ec19d235c4cb022cb091fab557a81f35e9053d3dbd456f51ae7
Instruction Fuzzy Hash: B3F01539D46208EFCF02DFB4E9488DDBFB4EB49244F1042AAD846E2251E6315B89DF81

Function 0620C3F0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d1207b338f20da50fb6c0fc4a26b6ef4dbf3f9b4e68684b13a8c84cd5a2e569
Instruction ID: cb73de3141e7dd6f5fd00f9e13b0f5401e0344ee22d57fbf86f0d5d4b3ab467d
Opcode Fuzzy Hash: 8d1207b338f20da50fb6c0fc4a26b6ef4dbf3f9b4e68684b13a8c84cd5a2e569
Instruction Fuzzy Hash: 2AE0E535200B508FC710A72DF4087AE7FE6DFC5308F04142DE2468BA41CFF568058791

Function 06205698 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed09b266b7fba4913447f4f16206f6a802b767de4596a04880a72e5d5f557127
Instruction ID: 7d52fdc1f1422f21b375be6041da095e0e63373e2762d5ac310c01d1305110f6
Opcode Fuzzy Hash: ed09b266b7fba4913447f4f16206f6a802b767de4596a04880a72e5d5f557127
Instruction Fuzzy Hash: A1E092B211C2419FD345DB25E8458967BE4EB96320F05886EE480D7141EB31D841CBA5

Function 06209248 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96d365a9e18f5856060b6df92aac44633d9157b2949a6565964d205d7216ae9d
Instruction ID: 49bf3cc9212ede7e4937adc9215dd25b6e31e62e17e5c5671e62d30e7ede0ab6
Opcode Fuzzy Hash: 96d365a9e18f5856060b6df92aac44633d9157b2949a6565964d205d7216ae9d
Instruction Fuzzy Hash: 67F06D74E00308AFEB54FFB4E841B9EBBB0AB44300F1081A8D804A73A5E7785E95CF81

Function 0620C988 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 044d0b89ca0604ef4a6b3392293999225a7275b19534c9acc94a43b810d57244
Instruction ID: 8f5f08eb4de0ebcd01a2375688e5b38d3ba2ef2d11809fa41f273ab6f1da1eca
Opcode Fuzzy Hash: 044d0b89ca0604ef4a6b3392293999225a7275b19534c9acc94a43b810d57244
Instruction Fuzzy Hash: B9F03934A00208EFCB44FFA8E58599CBBB1EB84205F2051ACD80AA3311EA342F499B50

Function 0620E4BF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bd7392c04f3621a1908e7b41c14aad182101350c582a6dc6601a9ba8f68e42f
Instruction ID: fd3d945b507b6cc564578a371f5fbf8742a63465478d6a9e28b0e2e206e83eb7
Opcode Fuzzy Hash: 6bd7392c04f3621a1908e7b41c14aad182101350c582a6dc6601a9ba8f68e42f
Instruction Fuzzy Hash: D0E0DF72A0A204FFCB01DB68E940CED3BB1DA82204B2042DEE809E73A2D6340F259791

Function 0620E540 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 315d79490ee09e3558f8dbe9bd11b6bd6504cd9d4f166beac1ae869a8a391e75
Instruction ID: a59f9d6e18c113a2acaa5f23c9c55f140fb4cf6036c89c1b29eeafeb773dac07
Opcode Fuzzy Hash: 315d79490ee09e3558f8dbe9bd11b6bd6504cd9d4f166beac1ae869a8a391e75
Instruction Fuzzy Hash: 9EE0D8326092C14BD706A334BD914883F71DACF904307504AD84A8B1A6C65C4F1A9392

Function 0620CF10 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09f6d8db5b0476a4409318ff631c34f57fa213e93ea629866506c2db6662172c
Instruction ID: b8ccfd44de844ab183da2ff2d60ac15e7c279db5c1b8b872d0b833dec7df38b1
Opcode Fuzzy Hash: 09f6d8db5b0476a4409318ff631c34f57fa213e93ea629866506c2db6662172c
Instruction Fuzzy Hash: EEE046322021128BC710FF19F484B89FBF5EBC5A15F019229D04A8775ADB7808568B81

Function 0620AF50 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6540081a3c88ed5f5dd0e180360969c7fe8a577182e497a058ebb83a2041a0
Instruction ID: 50e3f46a3dd052943ffe8a24f2706f9c6f279e43feed1fa03bd1d75bfc5058ce
Opcode Fuzzy Hash: 3e6540081a3c88ed5f5dd0e180360969c7fe8a577182e497a058ebb83a2041a0
Instruction Fuzzy Hash: 24D05B72700124678A453769F4584BE7BAFDAC6661304102EE707C3240DEE55D0247D5

Function 0620B7E0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b4b56b62638383dcd5496ef26452a9db02bd8e645d55d4c8867648d373c803
Instruction ID: c12751b23f384167f146242bec39d6443dc56ff0dfc88b188d5b5f8ed1db03e1
Opcode Fuzzy Hash: e7b4b56b62638383dcd5496ef26452a9db02bd8e645d55d4c8867648d373c803
Instruction Fuzzy Hash: 77E09A75D4020CEFCB41DFE4E5448DDBBB9EB48204F1082AAD809A3200EB305B55DF80

Function 0620FBD0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ae2dad3bfcc74486b74a269cdd2b9ecd0a9b86f2eff349de02e96470c12321
Instruction ID: ccd5dc20c52b34d953802610a1356a3a263d31cadfe7bdee6e26ffbbf8440e25
Opcode Fuzzy Hash: 35ae2dad3bfcc74486b74a269cdd2b9ecd0a9b86f2eff349de02e96470c12321
Instruction Fuzzy Hash: A1D05E396006169BD7241F6DA1242EA77EBEB99216B25942ED98587245EE7148018B80

Function 0620E4D0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c49564dd62e1d3aec14285e70071ff54a3f5026b8bb15118e01bac3666b3fef3
Instruction ID: 2235bc449280e37ef70612526a631e1a9956b98f5336e64960fcc5f9da785da3
Opcode Fuzzy Hash: c49564dd62e1d3aec14285e70071ff54a3f5026b8bb15118e01bac3666b3fef3
Instruction Fuzzy Hash: 07D05B71A0110CFFCF00EFA8E94199D7BF5EB85204B1051EDD409E7311DA751F119790

Function 0620FF4C Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a075869b79208e951b7d0231b5f19469bd7b58e63a445dc5f3c1602fdafbac
Instruction ID: 1b14b7924a4be81368afe897be745ed59db85624470b6fb00226c0a37714ecde
Opcode Fuzzy Hash: 06a075869b79208e951b7d0231b5f19469bd7b58e63a445dc5f3c1602fdafbac
Instruction Fuzzy Hash: 38D0223A704052130F0029587C088CA7F46C6932717285322FB70529D1CA200016D3D0

Function 0620FBA0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47987d9ca178d640a086d3a829844d9bf1754545a2faece16fd95d4eff535984
Instruction ID: 5d7e83485fef0a76703ff464359ff22a0e3ad64d421a00d5f1cf1b37f97deeb1
Opcode Fuzzy Hash: 47987d9ca178d640a086d3a829844d9bf1754545a2faece16fd95d4eff535984
Instruction Fuzzy Hash: F9D0221FB4412007C30123ACB02022C5AD3F3C8ADBB86022EE606C7389D8154C230381

Function 0620EBB8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38df5ac6ff713bce9dd15fb79fcbf6a2509e1a47ed88aad7f1a5c52a7d94a8c0
Instruction ID: f7152911a23a314ca2015edc65a8f0ea716093d5116656188b69ce1fe2214795
Opcode Fuzzy Hash: 38df5ac6ff713bce9dd15fb79fcbf6a2509e1a47ed88aad7f1a5c52a7d94a8c0
Instruction Fuzzy Hash: 94D0523A210208EFC740AF48C880A907BF9BF48B00F608098F6804B220CB72E820EF50

Function 06203721 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66a88b43389bc5670f423fc1970172c65d2e8f6091432014cf0565bacf0add15
Instruction ID: f86cf5bfa0ec0cea6c1fc1ad784d3369acaf21d1091e05851da94984a98ec696
Opcode Fuzzy Hash: 66a88b43389bc5670f423fc1970172c65d2e8f6091432014cf0565bacf0add15
Instruction Fuzzy Hash: 1CC02BB21593801FE39A03100C0BBD23F329792300B0F4083EB83DF083E9414018C6B3

Non-executed Functions

Function 064C6968 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\V^j, xrefs: 064C6BB3

Memory Dump Source

Source File: 00000004.00000002.2265585332.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_64c0000_RegAsm.jbxd

Similarity

API ID:
String ID: \V^j
API String ID: 0-1106363800
Opcode ID: 0457e6d1f4208c1f9f232c66e984aef58821bbdcbe36e58f4158a692760246ea
Instruction ID: ad7309869ecf0e4849b3629eee4d1d2e1dbf9f3b5c689ed9bc814d99a2b6e2c5
Opcode Fuzzy Hash: 0457e6d1f4208c1f9f232c66e984aef58821bbdcbe36e58f4158a692760246ea
Instruction Fuzzy Hash: 24917D74E002198FDF90CFA8C9817AEBBF2AF88324F15C52EE405A7354EB749845CB81

Function 06206FE8 Relevance: .8, Instructions: 785COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a04e932c64999052a293925051f5f72d2065b6693af6d7c4db8c6698dc0b4018
Instruction ID: 87e9d3203bc130cd3afa37ee38d72258819375db0da37d65089134b4afe40ad3
Opcode Fuzzy Hash: a04e932c64999052a293925051f5f72d2065b6693af6d7c4db8c6698dc0b4018
Instruction Fuzzy Hash: 1A6235B0600200DFE788DF69D55871ABAE6EF84308F65C45CD1199F392DFBAD90B8B91

Function 06206FF8 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2261917813.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6200000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e79ed78e9b1350eeb62b6818bf03f62ff193b4e4903131383c3eae502530c423
Instruction ID: 3cba12cf374735e3ab6c71c449786cce2f0bb850810425a324783334fec2dc8d
Opcode Fuzzy Hash: e79ed78e9b1350eeb62b6818bf03f62ff193b4e4903131383c3eae502530c423
Instruction Fuzzy Hash: B96235B0600200DFE788DF69D55871ABAE6EF84308F65C45CD1199F392DFBAD9078B91

Function 04E50040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2257792369.0000000004E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8abb8c1420dcd8812e60990f5d185d1386d448a58f6e93a66a808cf790284ec5
Instruction ID: bc8888b1e0b0bd0441d023c0d0aefedc1783e37a134dfdc7ba4b8a24f4db84aa
Opcode Fuzzy Hash: 8abb8c1420dcd8812e60990f5d185d1386d448a58f6e93a66a808cf790284ec5
Instruction Fuzzy Hash: B01285F8502B45ABE714CF65EA4C3893BB1F745318F914209D3626B2E6EBBC194ACF44

Function 00F4DC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2250749231.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec4dc11086fa2ba6c0386e9da3296a45f8f6cf280f158d3ff764a81b03dfedeb
Instruction ID: 2ef1697f8a3ea9647493606b7295ef5c8f9a65e90ea9e7de36400b76301e1a88
Opcode Fuzzy Hash: ec4dc11086fa2ba6c0386e9da3296a45f8f6cf280f158d3ff764a81b03dfedeb
Instruction Fuzzy Hash: DAA16B36E002158FCF05DFA4C88059EBBB2FF84310B15857AED05AB265EB79EE45DB80

Function 04E5001F Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2257792369.0000000004E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dde17a0994270b7dc13d36a8f853eacd710b2f20b1ae34a76145f433e03da73
Instruction ID: eee9fa3fa3825ed9794013cbfe609daed3da999b39ab5f275820347b8149014a
Opcode Fuzzy Hash: 3dde17a0994270b7dc13d36a8f853eacd710b2f20b1ae34a76145f433e03da73
Instruction Fuzzy Hash: 44C1FAB8902745AFD714CF65EA483897BB1FB89314F514309D3626B2E6EBBC184ACF44

Function 064C2E88 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2265585332.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_64c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 797426088186720cc4e76093317334c72442320a04c254971896cb14c8629f23
Instruction ID: c73f76cc7f5798a0a9b0db3640de62046cbb516cf8f89d13ceb3512a357190ed
Opcode Fuzzy Hash: 797426088186720cc4e76093317334c72442320a04c254971896cb14c8629f23
Instruction Fuzzy Hash: F161CF75E00208DFDB45DFA9C880ADDBBB2BF89310F24912AE505BB365DB35A946CF50

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

C:\Users\user\AppData\Local\Temp\Tmp5C55.tmp

C:\Users\user\AppData\Local\Temp\Tmp5C65.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
file.exe

Function 02972139 Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 00CF1274 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Function 00CF1278 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Function 064C9FB0 Relevance: 4.6, APIs: 1, Strings: 1, Instructions: 1117
COMMON

Function 064CCA50 Relevance: 2.9, Strings: 2, Instructions: 364
COMMON

Function 00F4AE30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 198
COMMON

Function 04E51B90 Relevance: 1.8, APIs: 1, Instructions: 283
COMMON

Function 064C3ED8 Relevance: 1.6, APIs: 1, Instructions: 126
COMMON