popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

http://regalosfreaks.blogspot.com/2012/12/sable-laser-de-anakin-skywalker-con.html

AgentTesla CoinHive Downloader Cryptocurrency HTTP ScreenShot Create Service KeyLogger Internet API P2P DGA Hijack Network Http API persistence FTP Socket Escalate priviledges DNS Code injection Sniff Audio Steal credential AntiDebug PNG Format AntiVM
  1. Resubmit sample
Category Machine Started Completed
URL s1_win7_x6401 June 8, 2021, 8 p.m. June 8, 2021, 8:03 p.m.
URL http://regalosfreaks.blogspot.com/2012/12/sable-laser-de-anakin-skywalker-con.html
File 2b52f85e3e809aa8_sable-laser-de-anakin-skywalker-con[1].htm
Size 242.3KB
Type HTML document, UTF-8 Unicode text, with very long lines
MD5 d808b4bbb918207dd54b242b2339afec
SHA256 2b52f85e3e809aa818b09165a9f3786f7c0770b18e08d5924dd92edd759513b5
CRC32 ED86C5CD
ssdeep 3072:v3D5HWRbCPl2nUOfhfQObi0FlIWY7RkTPSHSevid8t:b5HW2SfiIk3t
Yara
  • WWW_Cryptocurrency_Miner_Zero - WWW Cryptocurrency Miner Zero

Name Response Post-Analysis Lookup
contadores.miarroba.com
A 172.67.68.168
A 104.26.12.114
A 104.26.13.114
104.26.13.114
contadores.miarroba.es
A 104.26.12.38
A 172.67.70.74
A 104.26.13.38
172.67.70.74
ws-eu.assoc-amazon.com
A 52.95.118.186
52.95.118.186
zbox.zanox.com
resources.blogblog.com
A 142.250.204.137
CNAME blogger.l.google.com
172.217.25.105
2.bp.blogspot.com
CNAME photos-ugc.l.googleusercontent.com
A 142.250.66.65
172.217.175.225
fls-eu.amazon-adsystem.com
A 52.94.218.163
52.94.216.221
regalosfreaks.blogspot.com
A 142.250.66.65
CNAME blogspot.l.googleusercontent.com
172.217.161.33
www.blogger.com
A 172.217.163.233
CNAME blogger.l.google.com
172.217.25.105
apis.google.com
A 172.217.26.142
CNAME plus.l.google.com
172.217.161.78
platform.twitter.com
CNAME wac.apr-8315.edgecastdns.net
CNAME cs1-lb-as.8315.ecdns.net
A 192.229.237.25
CNAME cs472.wac.edgecastcdn.net
CNAME cs155.wac.edgecastcdn.net
CNAME cs1-apr-8315.wac.edgecastcdn.net
192.229.237.25
static.ak.connect.facebook.com
www.linkwithin.com
CNAME ec2-3-19-188-212.us-east-2.compute.amazonaws.com
A 3.19.188.212
3.19.188.212
authedmine.com
www.awltovhc.com
CNAME track.cj.akadns.net
A 89.207.16.72
159.127.40.144
www.tqlkg.com
CNAME track.cj.akadns.net
A 89.207.16.72
159.127.40.144
fonts.gstatic.com
A 142.250.204.131
CNAME gstaticadssl.l.google.com
172.217.161.67
images-eu.ssl-images-amazon.com
CNAME m.media-amazon.com
CNAME c.media-amazon.com
A 99.86.205.103
13.225.116.83
1.bp.blogspot.com
CNAME photos-ugc.l.googleusercontent.com
A 142.250.66.97
172.217.175.225
4.bp.blogspot.com
CNAME photos-ugc.l.googleusercontent.com
A 142.250.204.129
172.217.175.225
translate.googleapis.com
A 142.250.204.42
172.217.175.10
pagead2.googlesyndication.com
A 142.250.66.130
172.217.174.98
3.bp.blogspot.com
A 172.217.31.225
CNAME photos-ugc.l.googleusercontent.com
172.217.175.225
track.webgains.com
A 46.236.13.147
46.236.13.147
accounts.google.com
A 142.250.66.141
142.250.196.109
rcm-eu.amazon-adsystem.com
CNAME rcm-eu.assoc-amazon.com
A 52.95.124.70
52.95.124.70
www.google.com
A 142.250.204.100
172.217.174.100
translate.google.com
A 142.250.66.142
CNAME www3.l.google.com
172.217.175.78
www.yceml.net
CNAME e16754.d.akamaiedge.net
CNAME mirror.cj.edgekey.net
A 23.42.214.71
104.84.174.49
IP Address Status Action
104.26.12.114 Active Moloch
104.26.13.38 Active Moloch
117.18.232.200 Active Moloch
142.250.204.100 Active Moloch
142.250.204.129 Active Moloch
142.250.204.131 Active Moloch
142.250.204.137 Active Moloch
142.250.204.42 Active Moloch
142.250.66.130 Active Moloch
142.250.66.141 Active Moloch
142.250.66.142 Active Moloch
142.250.66.65 Active Moloch
142.250.66.97 Active Moloch
164.124.101.2 Active Moloch
172.217.163.233 Active Moloch
172.217.26.142 Active Moloch
172.217.31.225 Active Moloch
192.229.237.25 Active Moloch
23.42.214.71 Active Moloch
3.19.188.212 Active Moloch
46.236.13.147 Active Moloch
52.94.218.163 Active Moloch
52.95.118.186 Active Moloch
52.95.124.70 Active Moloch
89.207.16.72 Active Moloch
99.86.205.103 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49206 -> 172.217.163.233:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49211 -> 172.217.26.142:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49210 -> 172.217.26.142:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49209 -> 172.217.163.233:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49208 -> 172.217.163.233:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49207 -> 172.217.163.233:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49216 -> 142.250.204.137:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49215 -> 142.250.204.137:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49262 -> 52.95.118.186:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49237 -> 52.95.124.70:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49244 -> 142.250.204.137:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49251 -> 142.250.204.137:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49311 -> 117.18.232.200:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49260 -> 52.95.118.186:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49265 -> 142.250.204.100:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49263 -> 104.26.12.114:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49261 -> 104.26.12.114:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49279 -> 52.95.118.186:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 117.18.232.200:443 -> 192.168.56.101:49312 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49253 -> 142.250.66.141:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49252 -> 142.250.66.141:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49269 -> 99.86.205.103:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49268 -> 99.86.205.103:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49270 -> 52.94.218.163:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49272 -> 52.94.218.163:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49275 -> 52.95.124.70:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49310 -> 117.18.232.200:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49271 -> 52.94.218.163:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49278 -> 52.95.118.186:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49266 -> 142.250.204.100:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49277 -> 52.95.118.186:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 23.42.214.71:80 -> 192.168.56.101:49222 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49206
172.217.163.233:443 		C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=*.blogger.com 26:1f:9b:19:e6:66:74:fb:20:2f:d7:68:a2:c6:ac:ae:a8:ae:20:3e
TLSv1
192.168.56.101:49211
172.217.26.142:443 		C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=*.apis.google.com 3b:a4:84:db:fa:63:d0:7c:ff:af:bb:ff:de:2f:3a:f2:53:a2:40:83
TLSv1
192.168.56.101:49210
172.217.26.142:443 		C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=*.apis.google.com 3b:a4:84:db:fa:63:d0:7c:ff:af:bb:ff:de:2f:3a:f2:53:a2:40:83
TLSv1
192.168.56.101:49209
172.217.163.233:443 		C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=*.blogger.com 26:1f:9b:19:e6:66:74:fb:20:2f:d7:68:a2:c6:ac:ae:a8:ae:20:3e
TLSv1
192.168.56.101:49208
172.217.163.233:443 		C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=*.blogger.com 26:1f:9b:19:e6:66:74:fb:20:2f:d7:68:a2:c6:ac:ae:a8:ae:20:3e
TLSv1
192.168.56.101:49207
172.217.163.233:443 		C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=*.blogger.com 26:1f:9b:19:e6:66:74:fb:20:2f:d7:68:a2:c6:ac:ae:a8:ae:20:3e
TLSv1
192.168.56.101:49216
142.250.204.137:443 		C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=*.blogger.com 26:1f:9b:19:e6:66:74:fb:20:2f:d7:68:a2:c6:ac:ae:a8:ae:20:3e
TLSv1
192.168.56.101:49215
142.250.204.137:443 		C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=*.blogger.com 26:1f:9b:19:e6:66:74:fb:20:2f:d7:68:a2:c6:ac:ae:a8:ae:20:3e
TLSv1
192.168.56.101:49262
52.95.118.186:443 		C=US, O=Amazon, OU=Server CA 1B, CN=Amazon CN=ws-eu.assoc-amazon.com 43:09:0d:df:b9:6a:36:ba:e9:ea:65:ea:f9:86:a7:b7:d5:62:be:12
TLSv1
192.168.56.101:49237
52.95.124.70:443 		C=US, O=Amazon, OU=Server CA 1B, CN=Amazon CN=rcm-eu.assoc-amazon.com 44:80:e5:91:7b:ac:a8:ca:cc:8f:5b:3a:bf:1e:fb:11:64:72:e1:ce
TLSv1
192.168.56.101:49251
142.250.204.137:443 		None None None
TLSv1
192.168.56.101:49244
142.250.204.137:443 		None None None
TLSv1
192.168.56.101:49260
52.95.118.186:443 		C=US, O=Amazon, OU=Server CA 1B, CN=Amazon CN=ws-eu.assoc-amazon.com 43:09:0d:df:b9:6a:36:ba:e9:ea:65:ea:f9:86:a7:b7:d5:62:be:12
TLSv1
192.168.56.101:49265
142.250.204.100:443 		C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=www.google.com 29:85:2f:22:ac:4f:fd:8e:9d:c0:9c:7e:b9:5a:6b:04:f1:3b:30:76
TLSv1
192.168.56.101:49263
104.26.12.114:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com cc:67:a6:82:fd:24:2a:c4:f4:bd:ab:3e:75:07:db:0e:22:dc:05:4c
TLSv1
192.168.56.101:49261
104.26.12.114:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com cc:67:a6:82:fd:24:2a:c4:f4:bd:ab:3e:75:07:db:0e:22:dc:05:4c
TLSv1
192.168.56.101:49279
52.95.118.186:443 		C=US, O=Amazon, OU=Server CA 1B, CN=Amazon CN=ws-eu.assoc-amazon.com 43:09:0d:df:b9:6a:36:ba:e9:ea:65:ea:f9:86:a7:b7:d5:62:be:12
TLSv1
192.168.56.101:49253
142.250.66.141:443 		C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=accounts.google.com 4f:01:ce:23:b6:63:46:ae:39:42:25:26:55:2d:29:a3:86:06:49:76
TLSv1
192.168.56.101:49252
142.250.66.141:443 		C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=accounts.google.com 4f:01:ce:23:b6:63:46:ae:39:42:25:26:55:2d:29:a3:86:06:49:76
TLSv1
192.168.56.101:49269
99.86.205.103:443 		C=US, O=DigiCert Inc, CN=DigiCert Global CA G2 CN=Images-na.ssl-images-amazon.com cf:df:18:bf:b0:ee:0b:e9:c3:3a:ba:63:b2:ea:db:0d:0c:bc:ab:af
TLSv1
192.168.56.101:49268
99.86.205.103:443 		C=US, O=DigiCert Inc, CN=DigiCert Global CA G2 CN=Images-na.ssl-images-amazon.com cf:df:18:bf:b0:ee:0b:e9:c3:3a:ba:63:b2:ea:db:0d:0c:bc:ab:af
TLSv1
192.168.56.101:49270
52.94.218.163:443 		C=US, O=Amazon, OU=Server CA 1B, CN=Amazon CN=fls-eu.amazon-adsystem.com a3:9d:95:dc:0f:81:eb:aa:c9:be:0d:9b:bd:bd:a7:7e:d0:83:a4:19
TLSv1
192.168.56.101:49272
52.94.218.163:443 		C=US, O=Amazon, OU=Server CA 1B, CN=Amazon CN=fls-eu.amazon-adsystem.com a3:9d:95:dc:0f:81:eb:aa:c9:be:0d:9b:bd:bd:a7:7e:d0:83:a4:19
TLSv1
192.168.56.101:49275
52.95.124.70:443 		None None None
TLSv1
192.168.56.101:49271
52.94.218.163:443 		C=US, O=Amazon, OU=Server CA 1B, CN=Amazon CN=fls-eu.amazon-adsystem.com a3:9d:95:dc:0f:81:eb:aa:c9:be:0d:9b:bd:bd:a7:7e:d0:83:a4:19
TLSv1
192.168.56.101:49278
52.95.118.186:443 		C=US, O=Amazon, OU=Server CA 1B, CN=Amazon CN=ws-eu.assoc-amazon.com 43:09:0d:df:b9:6a:36:ba:e9:ea:65:ea:f9:86:a7:b7:d5:62:be:12
TLSv1
192.168.56.101:49266
142.250.204.100:443 		C=US, O=Google Trust Services, CN=GTS CA 1O1 C=US, ST=California, L=Mountain View, O=Google LLC, CN=www.google.com 29:85:2f:22:ac:4f:fd:8e:9d:c0:9c:7e:b9:5a:6b:04:f1:3b:30:76
TLSv1
192.168.56.101:49277
52.95.118.186:443 		C=US, O=Amazon, OU=Server CA 1B, CN=Amazon CN=ws-eu.assoc-amazon.com 43:09:0d:df:b9:6a:36:ba:e9:ea:65:ea:f9:86:a7:b7:d5:62:be:12

Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefd6da49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7feff1673c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7feff2c43bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7feff185295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7feff182799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7feff22af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7feff22b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7feff1848d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7feff3f0883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7feff3f0ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7feff3f0c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7feff2aa4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7feff2bd551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7feff3f347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7feff3f122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7feff3f3542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7feff2bd42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7feff2bd1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x770d9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x770d98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7feff2bd0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7feff3e3e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7feff290106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7feff290182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76e5652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x771ec521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 42141
exception.address: 0x7fefd6da49d
registers.r14: 0
registers.r15: 0
registers.rcx: 72278848
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 72284800
registers.r11: 72280608
registers.r8: 0
registers.r9: 0
registers.rdx: 1
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1936277167
registers.r13: 0
1 0 0
request GET http://regalosfreaks.blogspot.com/2012/12/sable-laser-de-anakin-skywalker-con.html
request GET http://regalosfreaks.blogspot.com/favicon.ico
request GET http://track.webgains.com/link.html?wglinkid=66911&wgcampaignid=127033&js=0
request GET http://track.webgains.com/link.html?wglinkid=185916&wgcampaignid=127033
request GET http://www.awltovhc.com/1a107r6Az42OVTTPXTXOQPWXRRXU
request GET http://www.tqlkg.com/if116o26v0zKRPPLTPTKMLOROORN
request GET http://www.yceml.net/0482/10363362-1602900629265
request GET http://www.yceml.net/0589/10782285-1571238489933
request GET http://pagead2.googlesyndication.com/pagead/js/google_top_exp.js
request GET http://3.bp.blogspot.com/-k_qBTbsvAzM/UMJQMv_XYTI/AAAAAAAADBQ/56lqTThDv1U/s320/Star+Wars+Espada+Anakin+Skywalker+Con+Hoja+Extra%C3%ADble.jpg
request GET http://3.bp.blogspot.com/-9B4mlAETTLg/UN8XtCe4OwI/AAAAAAAADYI/PX7EE3w_CE4/w72-h72-p-k-no-nu/Big+Bang+Theory+Cabezones+Pack.jpg
request GET http://www.linkwithin.com/widget.js
request GET http://www.linkwithin.com/pixel.png
request GET http://platform.twitter.com/widgets.js
request GET http://rcm-eu.amazon-adsystem.com/e/cm?t=regalosfreaks-21&o=30&p=42&l=ur1&category=amazon_es&banner=0R3J1Y4B94F3QYQB7VR2&f=ifr
request GET http://fonts.gstatic.com/s/play/v12/6aez4K2oVqwIvtU2Gw.eot
request GET http://2.bp.blogspot.com/-XHbl-XvHCxI/ULRLWMjeXoI/AAAAAAAACzE/dMnUHfJWhpE/w72-h72-p-k-no-nu/Fraggle+Rock+-+Peluche+Matt.jpg
request GET http://4.bp.blogspot.com/-PGjaJ8a4p3Y/UMY_-UsVBRI/AAAAAAAADGA/uwwflgTsig4/w72-h72-p-k-no-nu/Darksiders+Replica+ChaosEater.jpg
request GET http://1.bp.blogspot.com/-4sfU6WuB5A4/TkmSvzgV1GI/AAAAAAAAAVM/55OaLN4L-es/s1600/facebook_argim.jpg
request GET http://4.bp.blogspot.com/-uDFM1qVRXq0/UOsC8wSEXNI/AAAAAAAADy0/EOpZ5qSl1mU/w72-h72-p-k-no-nu/Pack+Completo+Friends.jpg
request GET http://3.bp.blogspot.com/--K7q8enmwJw/UMc_cWHStAI/AAAAAAAADI8/N-iG1c6RsIQ/w72-h72-p-k-no-nu/Hulk+Marvel+Select+Figura.jpg
request GET http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit
request GET http://4.bp.blogspot.com/-FuCHHEKmJnA/UN8mtRNZxaI/AAAAAAAADag/Gbp34bRp7fQ/w72-h72-p-k-no-nu/Dragon+Ball+Z+-+Figura+Articulada+SonGoku+SuperSaiyan.jpg
request GET http://1.bp.blogspot.com/-FO23MXFAcVY/UNHuslTEzDI/AAAAAAAADNk/sq2dfI1DGaw/w72-h72-p-k-no-nu/Futurama+Gorros.jpg
request GET http://4.bp.blogspot.com/-3KkqiCraQPM/UHRczqY0xYI/AAAAAAAAB4c/KRGz6p5dngU/w72-h72-p-k-no-nu/Busto+Spiderman+Zombie.jpg
request GET http://contadores.miarroba.es/ver.php?id=668184
request GET http://translate.googleapis.com/element/TE_20210503_00/e/js/element/element_main.js
request GET http://translate.googleapis.com/translate_static/css/translateelement.css
request GET http://translate.googleapis.com/translate_static/js/element/main_ko.js
request GET http://rcm-eu.amazon-adsystem.com/e/cm?t=regalosfreaks-21&o=30&p=11&l=ur1&category=generico&banner=1HWYNRB8SN6CQ3VANYG2&f=ifr
request GET http://track.webgains.com/link.html?wglinkid=201293&wgcampaignid=127033
request GET http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
request GET https://www.blogger.com/static/v1/jsbin/3775400722-ieretrofit.js
request GET https://apis.google.com/js/plusone.js
request GET https://www.blogger.com/static/v1/widgets/115981500-css_bundle_v2.css
request GET https://resources.blogblog.com/img/icon18_wrench_allbkg.png
request GET https://www.blogger.com/dyn-css/authorization.css?targetBlogID=9109980527255485708&zx=ba21ca9f-52ef-4f71-9a5e-873f64399f9b
request GET https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.ko.WgTOIxoySQQ.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCPr8pJzx73KJCRugZ418iKGzF4Nkg/cb=gapi.loaded_0
request GET https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.ko.WgTOIxoySQQ.O/m=gapi_iframes,gapi_iframes_style_bubble/exm=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCPr8pJzx73KJCRugZ418iKGzF4Nkg/cb=gapi.loaded_1
request GET https://resources.blogblog.com/img/icon18_edit_allbkg.gif
request GET https://www.blogger.com/static/v1/jsbin/1114208092-comment_from_post_iframe.js
request GET https://www.blogger.com/navbar.g?targetBlogID=9109980527255485708&blogName=Regalos+Freaks&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=LIGHT&layoutType=LAYOUTS&searchRoot=https://regalosfreaks.blogspot.com/search&blogLocale=es&v=2&homepageUrl=http://regalosfreaks.blogspot.com/&targetPostID=4647081066964754927&blogPostOrPageUrl=http://regalosfreaks.blogspot.com/2012/12/sable-laser-de-anakin-skywalker-con.html&vt=8248516631269504934&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.ko.WgTOIxoySQQ.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCPr8pJzx73KJCRugZ418iKGzF4Nkg%2Fm%3D__features__
request GET https://www.blogger.com/comment-iframe.g?blogID=9109980527255485708&postID=4647081066964754927&blogspotRpcToken=1963275
request GET https://resources.blogblog.com/blogblog/data/1kt/simple/gradients_light.png
request GET https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.png
request GET https://resources.blogblog.com/img/widgets/arrow_dropdown.gif
request GET https://resources.blogblog.com/img/icon_feed12.png
request GET https://www.blogger.com/img/share_buttons_20_3.png
request GET https://resources.blogblog.com/img/widgets/subscribe-yahoo.png
request GET https://resources.blogblog.com/img/widgets/subscribe-netvibes.png
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1772
region_size: 13635584
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002b30000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000003830000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077131000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077131000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077131000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077131000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077131000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077131000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000770dd000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077102000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000770e4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077102000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefc135000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefc135000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdda4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefda01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000770ca000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1772
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002df0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000735bc000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000073de3000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1332
region_size: 12718080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000003130000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1332
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000003d50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077131000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077131000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077131000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077131000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077131000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077131000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000770dd000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077102000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000770e4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077102000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefc135000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefc135000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdda4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefda01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000770ca000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000770cf000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000770cd000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000770cb000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076e56000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077206000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076e51000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000770d0000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000770ca000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000771df000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000771eb000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007feff3d7000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdd44000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdd41000
process_handle: 0xffffffffffffffff
1 0 0
Application Crash Process iexplore.exe with pid 1772 crashed
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefd6da49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7feff1673c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7feff2c43bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7feff185295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7feff182799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7feff22af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7feff22b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7feff1848d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7feff3f0883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7feff3f0ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7feff3f0c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7feff2aa4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7feff2bd551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7feff3f347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7feff3f122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7feff3f3542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7feff2bd42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7feff2bd1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x770d9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x770d98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7feff2bd0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7feff3e3e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7feff290106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7feff290182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76e5652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x771ec521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 42141
exception.address: 0x7fefd6da49d
registers.r14: 0
registers.r15: 0
registers.rcx: 72278848
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 72284800
registers.r11: 72280608
registers.r8: 0
registers.r9: 0
registers.rdx: 1
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1936277167
registers.r13: 0
1 0 0
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\2624012622-lbx__es[1].js
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\plusone[1].js
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\cb=gapi[1].js
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\cb=gapi[1].js
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\1147971663-widgets[1].js
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\1114208092-comment_from_post_iframe[1].js
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\cb=gapi[4].js
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\cb=gapi[3].js
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\widgets[1].js
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\main_ko[1].js
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\cb=gapi[2].js
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTDTA402\3775400722-ieretrofit[1].js
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTDTA402\FfCPi2TMnNz6Sf8yzawZ-WtZthvCzb7ioWpphmPTQrs[1].js
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\2575565767-cmt__es[1].js
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\element_main[1].js
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\platform_gapi.iframes.style.common[1].js
CLEAN MX malicious site
CyRadar malicious site
BitDefender malware site
CRDF malicious site
Trustwave malicious site
Fortinet malware site
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x000007fffff60000
process_handle: 0xffffffffffffffff
1 0 0
url https://ssl.pstatic.net/tveta/libs/1287/1287046/6df1cc02334922baa2d4_20200806172035021.jpg
url https://ssl.pstatic.net/static/pwe/common/img_use_mobile_version.png
url http://uk.ask.com/favicon.ico
url https://fonts.gstatic.com/s/lato/v16/S6uyw4BMUTPHjx4wWA.woff
url http://crl.identrust.com/DSTROOTCAX3CRL.crl0
url http://www.google.com/2005/gml/expr
url http://regalosfreaks.blogspot.com/search/label/Orgullo%20Y%20Prejuicio
url http://www.cnet.com/favicon.ico
url http://regalosfreaks.blogspot.com/search/label/Link
url https://t1.daumcdn.net/tistory_admin/blogs/plugins/A_ShareEntryWithSNS/script/shareEntryWithSNS.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
url https://s.pstatic.net/shopping.phinf/20200729_1/2931dd60-1842-4048-a39c-1e3389db4a0e.jpg
url http://regalosfreaks.blogspot.com/search/label/Resina%20ABS
url http://search.hanafos.com/favicon.ico
url http://regalosfreaks.blogspot.com/search/label/Pesadilla%20En%20Elm%20Street
url https://ssl.pstatic.net/tveta/libs/1298/1298853/743c01d46e807a376d99_20200730182507675.png
url https://s.pstatic.net/static/newsstand/2020/logo/light/0604/820.png
url http://regalosfreaks.blogspot.com/search/label/Disfraces
url http://regalosfreaks.blogspot.com/2012/
url http://www.amazon.co.jp/
url http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
url http://regalosfreaks.blogspot.com/search/label/Halo%204
url http://regalosfreaks.blogspot.com/search/label/Revientapechos
url http://track.webgains.com/click.html?wgcampaignid=127033
url http://regalosfreaks.blogspot.com/2012/12/lego-batman-persiguiendo-dos-caras.html
url http://yellowpages.superpages.com/
url http://www.yceml.net/0482/10363362-1602900629265
url https://www.naver.com
url http://regalosfreaks.blogspot.com/search/label/DC
url https://s.pstatic.net/shopping.phinf/20200806_26/3cad46ab-3fa4-4756-9e01-d61372890bd0.jpg
url https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0804%2Fmobile_212629657646c.jpg%22
url http://regalosfreaks.blogspot.com/search/label/McFarlane
url http://ocsp.digicert.com0
url https://my.sendinblue.com/public/theme/version4/assets/images/loader_sblue.gif
url http://regalosfreaks.blogspot.com/search/label/Humor
url https://ssl.pstatic.net/static/pwe/nm/sp_mail_setup_140716.png
url http://regalosfreaks.blogspot.com/search/label/4D%20Cityscape
url https://s.pstatic.net/static/newsstand/2020/logo/light/0604/410.png
url http://search.msn.com/results.aspx?q=
url https://s.pstatic.net/shopping.phinf/20200731_21/4628ed28-27dc-4586-871c-f7f22524da89.jpg?type=f214_292
url https://s.pstatic.net/imgshopping/static/sb/js/sb/nclktagS01_v1.js?v=2020080314
url http://regalosfreaks.blogspot.com/search/label/Batman
url https://ssl.pstatic.net/tveta/libs/1299/1299024/c033376e145702a0a471_20200806171156016.jpg
url https://fls-eu.amazon-adsystem.com/1/associates-ads/1/OP/?cb=1623150083515
url http://regalosfreaks.blogspot.com/search/label/King%20Ghidorah
url https://fonts.googleapis.com/css?family=Open
url http://isrg.trustid.ocsp.identrust.com0
url http://si.wikipedia.org/w/api.php?action=opensearch
url http://regalosfreaks.blog
url http://search.ebay.fr/
url http://regalosfreaks.blogspot.com/search/label/Mazinger%20Z
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Match Windows Http API call rule Str_Win32_Http_API
description Match Windows Inet API call rule Str_Win32_Internet_API
description Take ScreenShot rule ScreenShot
description Bypass DEP rule disable_dep
description Communication using DGA rule Network_DGA
description Communications use DNS rule Network_DNS
description Communications over RAW Socket rule Network_TCP_Socket
description Create a windows service rule Create_Service
description Record Audio rule Sniff_Audio
description Communications over HTTP rule Network_HTTP
description Escalate priviledges rule Escalate_priviledges
description Run a KeyLogger rule KeyLogger
description Communications over FTP rule Network_FTP
description Win.Trojan.agentTesla rule Win_Trojan_agentTesla_Zero
description Hijack network configuration rule Hijack_Network
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description Match Windows Http API call rule Str_Win32_Http_API
description Match Windows Inet API call rule Str_Win32_Internet_API
description Steal credential rule local_credential_Steal
description Take ScreenShot rule ScreenShot
description File Downloader rule Network_Downloader
description Communications over P2P network rule Network_P2P_Win
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Install itself for autorun at Windows startup rule Persistence
cmdline "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1772 CREDAT:145409
host 117.18.232.200
count 102 name heapspray process iexplore.exe total_mb 73 length 757760 protection PAGE_READWRITE
Process injection Process 1772 resumed a thread in remote process 1332
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000000000000310
suspend_count: 1
process_identifier: 1332
1 0 0