Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1428845
MD5:	c9ad12873e4b3f8ae042800ab6ca01b5
SHA1:	4a687ce2dddd416b7da22724c312588d737b36b1
SHA256:	3eb812720aa52ff562da685c76976d20a569c2f0a929bde19558bdd4241e9867
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Snort IDS alert for network traffic

Yara detected RedLine Stealer

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6496 cmdline: "C:\Users\user\Desktop\file.exe" MD5: C9AD12873E4B3F8AE042800AB6CA01B5)

conhost.exe (PID: 6512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 6680 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6708 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["5.42.65.50:33080"], "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.1820163569.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.1826891636.0000000002CF3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6496	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6708	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6708	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.101eac0.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.101eac0.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.ff0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Snort Signatures

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 5.42.65.50

Timestamp:	04/19/24-17:46:01.373743
SID:	2046045
Source Port:	49730
Destination Port:	33080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 5.42.65.50 - Destination IP: 192.168.2.4

Timestamp:	04/19/24-17:46:06.860200
SID:	2046056
Source Port:	33080
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.65.50

Timestamp:	04/19/24-17:46:13.759629
SID:	2043231
Source Port:	49730
Destination Port:	33080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 5.42.65.50 - Destination IP: 192.168.2.4

Timestamp:	04/19/24-17:46:01.590722
SID:	2043234
Source Port:	33080
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.101eac0.1.raw.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["5.42.65.50:33080"], "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_010090D1 FindFirstFileExW,

0_2_010090D1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06B80E07h	3_2_06B806A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06B80605h	3_2_06B80340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06B842F0h	3_2_06B83DF8

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.4:49730 -> 5.42.65.50:33080
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49730 -> 5.42.65.50:33080
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 5.42.65.50:33080 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 5.42.65.50:33080 -> 192.168.2.4:49730

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 5.42.65.50:33080

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 5.42.65.50:33080

Source: Joe Sandbox View

IP Address: 5.42.65.50 5.42.65.50

Source: Joe Sandbox View

ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU

Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.50

Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9_
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/PreparelB
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002C57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002F4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002CF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002EDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002F4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002ED5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response2
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002F4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1826891636.0000000002F4A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002F4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002CD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002EDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: RegAsm.exe, 00000003.00000002.1831297599.0000000003D25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D09000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, file.exe, 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1820163569.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: RegAsm.exe, 00000003.00000002.1831297599.0000000003D25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D09000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegAsm.exe, 00000003.00000002.1831297599.0000000003D25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D09000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegAsm.exe, 00000003.00000002.1831297599.0000000003D25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D09000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000003.00000002.1831297599.0000000003D25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D09000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegAsm.exe, 00000003.00000002.1831297599.0000000003D25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegAsm.exe, 00000003.00000002.1831297599.0000000003D09000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: RegAsm.exe, 00000003.00000002.1831297599.0000000003D25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D09000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 00000003.00000002.1831297599.0000000003D25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D09000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RegAsm.exe, 00000003.00000002.1831297599.0000000003D25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D09000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp8EC7.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp8EB7.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01024850	0_2_01024850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01003092	0_2_01003092
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFB962	0_2_00FFB962
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01004C60	0_2_01004C60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100B736	0_2_0100B736
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFF680	0_2_00FFF680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100CF9B	0_2_0100CF9B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01024FD5	0_2_01024FD5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00E625D8	3_2_00E625D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00E6DC74	3_2_00E6DC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05006948	3_2_05006948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05007C20	3_2_05007C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05000007	3_2_05000007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05000040	3_2_05000040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05007C12	3_2_05007C12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05005A45	3_2_05005A45
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_064667D8	3_2_064667D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0646A3E8	3_2_0646A3E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06463F50	3_2_06463F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0646A3D8	3_2_0646A3D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06466FE8	3_2_06466FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06466FF8	3_2_06466FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06B8BB70	3_2_06B8BB70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06B8F8E0	3_2_06B8F8E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06B806A8	3_2_06B806A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06B810F0	3_2_06B810F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06B83138	3_2_06B83138
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06B83148	3_2_06B83148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06B83DF8	3_2_06B83DF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06B81BA0	3_2_06B81BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06B86BD8	3_2_06B86BD8

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00FF6A00 appears 49 times

Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameZymosis.exe8 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/5@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6512:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\Tmp8EB7.tmp

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000003.00000002.1826891636.0000000003025000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1826891636.00000000030CD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1826891636.000000000303C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1826891636.00000000030B6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1826891636.000000000304A000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.3.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF61CC push ecx; ret	0_2_00FF61DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01024503 push es; retn 0000h	0_2_01024556
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01024559 push es; retn 0000h	0_2_01024556
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01024559 push es; ret	0_2_01024565
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01024568 push es; retn 0000h	0_2_01024556
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01024568 push es; ret	0_2_01024565
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010245D5 push es; retf 0000h	0_2_010245C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010245D5 push es; retf	0_2_010245D2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0646E060 push es; ret	3_2_0646E070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06460006 push es; iretd	3_2_0646001C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0646ECF2 push eax; ret	3_2_0646ED01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06463B4F push dword ptr [esp+ecx*2-75h]; ret	3_2_06463B53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_064649AB push FFFFFF8Bh; retf	3_2_064649AD

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2AF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2940000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1346			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 6786			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7044	Thread sleep time: -23980767295822402s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6788	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_010090D1 FindFirstFileExW,

0_2_010090D1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: RegAsm.exe, 00000003.00000002.1835777026.000000000542B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FFD209 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00FFD209

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01000947 mov ecx, dword ptr fs:[00000030h]		0_2_01000947
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100A24C mov eax, dword ptr fs:[00000030h]		0_2_0100A24C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0100C84B GetProcessHeap,

0_2_0100C84B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF693B SetUnhandledExceptionFilter,	0_2_00FF693B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFD209 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00FFD209
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF64D0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00FF64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF67DF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00FF67DF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0106AC4D CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

0_2_0106AC4D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 839008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FF62BC cpuid

0_2_00FF62BC

Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_0100C00D
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0100C098
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_010052B3
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_0100C2EB
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_0100C51A
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0100C5E9
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0100C414
Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0100BC85
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_0100BF27
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_0100BF72
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_010057D9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FF66D2 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00FF66D2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000003.00000002.1836283330.00000000054B7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.101eac0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.101eac0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1820163569.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6708, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002CF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002CF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR^qX
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002CF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR^q
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002CF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q%appdata%`,^qdC:\Users\user\AppData\Roaming`,^qdC:\Users\user\AppData\Roaming\Binance
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002CF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q&%localappdata%\Coinomi\Coinomi\walletsLR^q
Source: RegAsm.exe, 00000003.00000002.1826891636.0000000002CF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1826891636.0000000002CF3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6708, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.101eac0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.101eac0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1820163569.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6708, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	251 Security Software Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Install Root Certificate	DCSync	134 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	HEUR/AGEN.1352999
file.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://api.ip.sb/ip	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
5.42.65.50:33080	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	RegAsm.exe, 00000003.00000002.1831297599.0000000003D25000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	RegAsm.exe, 00000003.00000002.1831297599.0000000003D25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D09000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D75000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id14ResponseD	RegAsm.exe, 00000003.00000002.1826891636.0000000002F4A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id23ResponseD	RegAsm.exe, 00000003.00000002.1826891636.0000000002F4A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id2Response	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id6ResponseD	RegAsm.exe, 00000003.00000002.1826891636.0000000002CD3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id4	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id7	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id6	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id22Response2	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id19Response	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13ResponseD	RegAsm.exe, 00000003.00000002.1826891636.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5ResponseD	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	file.exe, file.exe, 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1820163569.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1ResponseD	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegAsm.exe, 00000003.00000002.1831297599.0000000003D25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D09000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D75000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id20	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id21	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id22	RegAsm.exe, 00000003.00000002.1826891636.0000000002ED5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	RegAsm.exe, 00000003.00000002.1831297599.0000000003D25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D09000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1831297599.0000000003D75000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1Response	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21ResponseD	RegAsm.exe, 00000003.00000002.1826891636.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id11	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id10ResponseD	RegAsm.exe, 00000003.00000002.1826891636.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id12	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id16Response	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id14	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id15	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id16	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id18	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5Response	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id19	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15ResponseD	RegAsm.exe, 00000003.00000002.1826891636.0000000002CF3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id10Response	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id11ResponseD	RegAsm.exe, 00000003.00000002.1826891636.0000000002C57000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id8Response	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	RegAsm.exe, 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17ResponseD	RegAsm.exe, 00000003.00000002.1826891636.0000000002CD7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/soap/envelope/	RegAsm.exe, 00000003.00000002.1826891636.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.42.65.50	unknown	Russian Federation		39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428845
Start date and time:	2024-04-19 17:45:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 140 Number of non-executed functions: 65
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
17:46:08	API Interceptor	41x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
5.42.65.50	SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	SecuriteInfo.com.Win32.PWSX-gen.900.19500.exe	Get hash	malicious	RedLine, Xmrig	Browse
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe	Get hash	malicious	Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	80OrFCsz0u.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	5.42.66.10
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.50
	9IseFevRH6.elf	Get hash	malicious	Mirai	Browse	78.25.186.40
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.50
	SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Get hash	malicious	Glupteba, PureLog Stealer, zgRAT	Browse	5.42.64.17
	SecuriteInfo.com.Win32.PWSX-gen.900.19500.exe	Get hash	malicious	RedLine, Xmrig	Browse	5.42.65.50
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	5.42.65.50
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	5.42.65.50
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.50
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.50

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:33 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.4599413576416165
Encrypted:	false
SSDEEP:	48:8SmdPTndGRYrnvPdAKRkdAGdAKRFdAKR/U:8Su5
MD5:	450CE6DA8A3164388BE258615BD4DD84
SHA1:	0E91F56AE2CD108498972E1951B27CB6530F2AD8
SHA-256:	10439D716F5C2AF93F3DA91F27D0EC4803BD0BEF71746C70379B5D94866BC803
SHA-512:	BB619858A4F5659BC8E4832FCDDAD3BCB8D4FBB56FFACE007653EDC4A5994B5CD8AAFC59E8548193AD22FBDABED78B3DDB34D5396805C5EA477ECC4BE1B29D37
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,....v.b........q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW5`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWQ`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWQ`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWQ`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDWI`..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlq0
MD5:	0C1110E9B7BBBCB651A0B7568D796468
SHA1:	7AEE00407EE27655FFF0ADFBC96CF7FAD9610AAA
SHA-256:	112E21404A85963FB5DF8388F97429D6A46E9D4663435CC86267C563C0951FA2
SHA-512:	46E37552764B4E61006AB99F8C542D55B2418668B097D3C6647D306604C3D7CA3FAF34F8B4121D94B0E7168295B2ABEB7C21C3B96F37208943537B887BC81590
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\Tmp8EB7.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp8EC7.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.676537576463092
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	503'296 bytes
MD5:	c9ad12873e4b3f8ae042800ab6ca01b5
SHA1:	4a687ce2dddd416b7da22724c312588d737b36b1
SHA256:	3eb812720aa52ff562da685c76976d20a569c2f0a929bde19558bdd4241e9867
SHA512:	6b4e5a2b296d00bc2179616aaa4a040cc1938872ea9b309683226fe8979c39e6976d3c9980b1983378f081cfd76ce6af37e3b9196fbd05c584caf1e0ddf3e016
SSDEEP:	12288:Z0fa1MGNMpySMcLnZ+LdfdyQPT7tnirfoCe:ka1zNM3zZIddB7tyQR
TLSH:	E3B4E15571C08073D5A728324AF4D7B9AA3DF9300B52698F67A94F7F4F30381D621AAB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E\..+...+...+.B.(...+.B...;.+.B./...+.B....+......+.SN/...+.SN(...+.SN....+.bM"...+.bM)...+.Rich..+.........PE..L....~"f...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x405f71
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66227EEA [Fri Apr 19 14:25:46 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f578d161341ba8161650c97fe866d0ab

Entrypoint Preview

Instruction
call 00007F9585656AFEh
jmp 00007F95856561C9h
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F958565636Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F958565635Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F958565635Eh
add edx, 28h
cmp edx, esi
jne 00007F958565633Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F958565634Bh
push esi
call 00007F9585656DD5h
test eax, eax
je 00007F9585656372h
mov eax, dword ptr fs:[00000018h]
mov esi, 0047B70Ch
mov edx, dword ptr [eax+04h]
jmp 00007F9585656356h
cmp edx, eax
je 00007F9585656362h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F9585656342h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F9585656359h
mov byte ptr [0047B710h], 00000001h
call 00007F958565660Bh
call 00007F9585659378h
test al, al
jne 00007F9585656356h
xor al, al
pop ebp
ret
call 00007F95856629A8h
test al, al
jne 00007F958565635Ch
push 00000000h
call 00007F958565937Fh
pop ecx
jmp 00007F958565633Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [0047B711h], 00000000h
je 00007F9585656356h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2d5e8	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7d000	0x1ad8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2bbe0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2bb20	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x24000	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2141f	0x21600	45f90ba7fec42844709dd5a33ed30d49	False	0.5795148642322098	data	6.630131576402872	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.bss	0x23000	0x3c2	0x400	d14c206ab71341ede3901479a932d666	False	0.751953125	data	6.255853854636498	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x24000	0x9d20	0x9e00	d71ca39436edf52c27bf3a24c00f4a58	False	0.43623912183544306	DIY-Thermocam raw data (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 8589934592.000000, slope 2418061182712720643850240.000000	4.979954979638253	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2e000	0x4e228	0x4d600	ae3ebae5a68388bac78a1b17700af1b7	False	0.9879152362681745	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.989782811225375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x7d000	0x1ad8	0x1c00	ab8e07fb057287a476331407b0e45295	False	0.7296316964285714	data	6.374869257528181	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

WaitForSingleObjectEx, CloseHandle, FreeConsole, VirtualProtectEx, CreateRemoteThread, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, GetFileType, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/19/24-17:46:01.373743	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49730	33080	192.168.2.4	5.42.65.50
04/19/24-17:46:06.860200	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	33080	49730	5.42.65.50	192.168.2.4
04/19/24-17:46:13.759629	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49730	33080	192.168.2.4	5.42.65.50
04/19/24-17:46:01.590722	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	33080	49730	5.42.65.50	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 17:46:00.888281107 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:01.100178957 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:01.100322008 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:01.112889051 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:01.325066090 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:01.373743057 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:01.590722084 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:01.640321016 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:06.644601107 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:06.860199928 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:06.860219955 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:06.860230923 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:06.860238075 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:06.860249043 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:06.860361099 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:06.860419035 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:06.988401890 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:07.200787067 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:07.249732971 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:07.268594027 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:07.480577946 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:07.480690956 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:07.480725050 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:07.480767012 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:07.480849981 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:07.692831993 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:07.692878008 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:07.692962885 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:07.693847895 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:07.693919897 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:07.909338951 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:07.909400940 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:07.909562111 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:07.909733057 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:07.909940958 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.121476889 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.121505976 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.121686935 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:08.121910095 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.122005939 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:08.122097969 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.122162104 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:08.122179031 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.122390032 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.122467995 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.122836113 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.122908115 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.123148918 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:08.123219013 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.123254061 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:08.123298883 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.164016008 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.333925009 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.333945036 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.334233999 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.334748030 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.334803104 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.334889889 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.335299969 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.335335016 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.335520029 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.335853100 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.335958004 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:08.335979939 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.336014986 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.336150885 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:08.336282969 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.336807013 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.336941957 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.337244987 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.337361097 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.337604046 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:08.337740898 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:08.547889948 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.547947884 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.548032045 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.548197031 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.548516035 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.548929930 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.549055099 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.549201965 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.549444914 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.549576998 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.549731016 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.550076008 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.550101995 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:08.550302982 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:08.550316095 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.550520897 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.550719976 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.550812960 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.550889015 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.551369905 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.551402092 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.551476002 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.551914930 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.552198887 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:08.552325964 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:08.762012959 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.762125969 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.762159109 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.762192965 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.762609959 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.762638092 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.762947083 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.762968063 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.763359070 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.763370037 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.764142036 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.764226913 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.764491081 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:08.764708042 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:08.764812946 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.764825106 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.765007019 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.765017986 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.765273094 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.765539885 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.765826941 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.766084909 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:08.766241074 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:08.976330042 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.976388931 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.976423979 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.976983070 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.977094889 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.977129936 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.977164030 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.977200031 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.977269888 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.977503061 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:08.979368925 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.979403019 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.979435921 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:08.979469061 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:09.189744949 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:09.191483021 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:09.234066963 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:09.582618952 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:09.796258926 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:09.799221039 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:09.823612928 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:10.036582947 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:10.041766882 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:10.254038095 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:10.262917995 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:10.475959063 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:10.478504896 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:10.690783024 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:10.694576025 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:10.907038927 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:10.943166971 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:11.155931950 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:11.159832001 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:11.371942043 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:11.375854015 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:11.589466095 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:11.594537020 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:11.807043076 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:11.808047056 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:12.020556927 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:12.062203884 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:12.156868935 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:12.373675108 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:12.421550989 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:12.424582005 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:12.636460066 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:12.636480093 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:12.636778116 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:12.636797905 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:12.637672901 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:12.639383078 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:12.851864100 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:12.905921936 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:12.939644098 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:13.154464006 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:13.159665108 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:13.371655941 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:13.372818947 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:13.373600006 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:13.586390972 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:13.640291929 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:13.759629011 CEST	49730	33080	192.168.2.4	5.42.65.50
Apr 19, 2024 17:46:13.976141930 CEST	33080	49730	5.42.65.50	192.168.2.4
Apr 19, 2024 17:46:14.021796942 CEST	49730	33080	192.168.2.4	5.42.65.50

Target ID:	0
Start time:	17:45:58
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xff0000
File size:	503'296 bytes
MD5 hash:	C9AD12873E4B3F8AE042800AB6CA01B5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:45:58
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:45:58
Start date:	19/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x200000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:45:58
Start date:	19/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x740000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.1820163569.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.1826891636.0000000002B99000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1826891636.0000000002CF3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	1.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	47

Executed Functions

Function 0106AC4D Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 0106ADBC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0106ADCF
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 0106ADED
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0106AE11
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 0106AE3C
TerminateProcess.KERNELBASE(?,00000000), ref: 0106AE5B
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 0106AE94
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 0106AEDF
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0106AF1D
Wow64SetThreadContext.KERNEL32(?,?), ref: 0106AF59
ResumeThread.KERNELBASE(?), ref: 0106AF68

Strings

aryA, xrefs: 0106AC93
GetP, xrefs: 0106ACCF
ress, xrefs: 0106ACD7
Load, xrefs: 0106AC8B

Memory Dump Source

Source File: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: GetP$Load$aryA$ress
API String ID: 2440066154-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 16562bed5299a8aaf82ba14fcf6834caabe8ae013231a906be7a9f315b9717bc
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: D5B1E67260024AAFDB60CF68CC80BDA77A9FF88714F158564EA0CEB345D774FA418B94

Uniqueness

Uniqueness Score: -1.00%

Function 0100A24C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e38b66b3b163b1e1dda73f3095c298aa0b210bafec3ade253d4a852505a321a7
Instruction ID: f9475abfb7e64b163f343c0811998749ae984b52532f2997f758655967d6d8e7
Opcode Fuzzy Hash: e38b66b3b163b1e1dda73f3095c298aa0b210bafec3ade253d4a852505a321a7
Instruction Fuzzy Hash: 3DE08C72A15338EBDB16DB9CC90498AFBECEB44B00F1100A6B601D3190C271DF00CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 01000947 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bcbaf13c8628ce2ae70d5bcd0ecb212c4d9f7304e299a7df17b2671f4a21fa0
Instruction ID: fd55528f7aec600d9fceacffe87165cb11802a505c942b2fac2ec53baec05b9a
Opcode Fuzzy Hash: 0bcbaf13c8628ce2ae70d5bcd0ecb212c4d9f7304e299a7df17b2671f4a21fa0
Instruction Fuzzy Hash: DCC08C34101A0087FE2B891CC3703A63395E392AC2F8004CCC9CA4B6CAD51F9982D600

Uniqueness

Uniqueness Score: -1.00%

Function 010132DF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FF1D41: _strlen.LIBCMT ref: 00FF1D59

VirtualProtectEx.KERNELBASE(000000FF,0106AAC0,000004AC,00000040,?,?,006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@), ref: 01013338
FreeConsole.KERNELBASE ref: 0101333E
CreateRemoteThread.KERNELBASE(000000FF,00000000,00000000,Function_0007AC48,0101EAC0,00000000,?), ref: 0101338C
WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000001), ref: 01013399
CloseHandle.KERNEL32(00000000), ref: 010133A0

Strings

006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@, xrefs: 010132F5

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: CloseConsoleCreateFreeHandleObjectProtectRemoteSingleThreadVirtualWait_strlen
String ID: 006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@
API String ID: 3638600928-32248209
Opcode ID: f75ef089bd4a76fdd8e021e61c68779dc629d8f1d7c0b5d374ab09780a83fb90
Instruction ID: 69cd459421ea5b236dcd672be278bba3267fc7a030bbb06861ad53b87a57d025
Opcode Fuzzy Hash: f75ef089bd4a76fdd8e021e61c68779dc629d8f1d7c0b5d374ab09780a83fb90
Instruction Fuzzy Hash: BC217972204310ABD714AB319C09EAF3BE8FF45B30F14071DF5A6AB1D1DB28A9028399

Uniqueness

Uniqueness Score: -1.00%

Function 0100547C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,916321FF,?,01005589,00FFB2B6,?,F8250000,00000000), ref: 0100553D

Strings

api-ms-, xrefs: 010054D3
ext-ms-, xrefs: 010054E7

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 2c6f9164f870c529d39f9c18295b64cc5d89e3e4533c10de513b2c5b331b4fcb
Instruction ID: 4dc82204125e9adabc538762d634372a96e8f682b9e6d5239d56210e48d74bc6
Opcode Fuzzy Hash: 2c6f9164f870c529d39f9c18295b64cc5d89e3e4533c10de513b2c5b331b4fcb
Instruction Fuzzy Hash: 82210531A01211ABFB339A69EC50A5E3799DF42365F150150F9C5EB2D1EB7AEA00CFE0

Uniqueness

Uniqueness Score: -1.00%

Function 010083DF Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 01008466
__alloca_probe_16.LIBCMT ref: 01008527
__freea.LIBCMT ref: 0100858E

Part of subcall function 01002E83: HeapAlloc.KERNEL32(00000000,01009981,?,?,01009981,00000220,?,?,?), ref: 01002EB5

__freea.LIBCMT ref: 010085A3
__freea.LIBCMT ref: 010085B3

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 45c567573b589d1d32f5280b91547df8e69a46398e56a5b0fad59798860a1c95
Instruction ID: 4ce3a582c4a3c3a740497ce6a9b159b6d666a8d7da343bcdb46d7d9a751f8a30
Opcode Fuzzy Hash: 45c567573b589d1d32f5280b91547df8e69a46398e56a5b0fad59798860a1c95
Instruction Fuzzy Hash: C351B672A00216AFFB265F64CC81EBF3AE9FF44750F15816AFE84D6194EB35CD1086A1

Uniqueness

Uniqueness Score: -1.00%

Function 010008D3 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(01000A29,?,010008CD,00000000,?,?,01000A29,916321FF,?,01000A29), ref: 010008E4
TerminateProcess.KERNEL32(00000000,?,010008CD,00000000,?,?,01000A29,916321FF,?,01000A29), ref: 010008EB
ExitProcess.KERNEL32 ref: 010008FD

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f441dc6e1e3203d7547d2aa7341b9cce7442b9a595476aca6e4bfb3984750207
Instruction ID: b470d288857d5e5273f131daaf2ac6abf715b6db31149db5ea50e459ada04207
Opcode Fuzzy Hash: f441dc6e1e3203d7547d2aa7341b9cce7442b9a595476aca6e4bfb3984750207
Instruction Fuzzy Hash: 6AD09E31004109EFEF132FA1E80CA9D3F6AFF40391B054020BA999A078CF7E99529B90

Uniqueness

Uniqueness Score: -1.00%

Function 010075AE Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01006CF8: GetConsoleOutputCP.KERNEL32(916321FF,00000000,00000000,00000000), ref: 01006D5B

WriteFile.KERNEL32(?,00000000,?,0101D348,00000000,0000000C,00000000,00000000,?,00000000,0101D348,00000010,00FFEC7F,00000000,00000000,00000000), ref: 01007717
GetLastError.KERNEL32(?,00000000), ref: 01007721

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 90e89feb05e8d53ad0918e6f6ffbe66536387e2dc357b83348376720444868db
Instruction ID: 448aa057338039d0611c4a305b7801c7fba4c6aae7b8016330d80d3af4f68de7
Opcode Fuzzy Hash: 90e89feb05e8d53ad0918e6f6ffbe66536387e2dc357b83348376720444868db
Instruction Fuzzy Hash: B06193B1D00149AAFF129FACCC44EEEBFB9AF49344F044095E9C5A7292D379E901CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01009B7D Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 010096AD: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 010096D8

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,010099C4,?,00000000,?,?,?), ref: 01009BDE
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,010099C4,?,00000000,?,?,?), ref: 01009C20

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 7bc6b7152ae4bc9f90511a2192fccb7fc85ad2913c4365ff959df18f836e493f
Instruction ID: 02ab8ee4649ecf4a16df03c4866a4b3fc5988856fb402a3198c96ce76be30644
Opcode Fuzzy Hash: 7bc6b7152ae4bc9f90511a2192fccb7fc85ad2913c4365ff959df18f836e493f
Instruction Fuzzy Hash: D5510471E042499EEB22DF79C880AEABBF5EF45308F1440AAD1CA872D3D7799545CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FF4FA8 Relevance: 3.1, APIs: 2, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Fputc.LIBCPMT ref: 00FF5081

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Fputc
String ID:
API String ID: 3078413507-0
Opcode ID: d46b14db0b7d13291ca615869a18099462fd0332dee4c5210a2adce2768b1fe4
Instruction ID: 80a358018bab140fa2d46e5f5ab80962f0fd4532775e2882ef0492e9c24930ae
Opcode Fuzzy Hash: d46b14db0b7d13291ca615869a18099462fd0332dee4c5210a2adce2768b1fe4
Instruction Fuzzy Hash: 7041613690061EABCF15DF64D8449FEB7B8BF08324B140156E701AB660EB35F954EB94

Uniqueness

Uniqueness Score: -1.00%

Function 010071B0 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,00000000,?,010076FD,00000000,00000000,00000000,?,0000000C,00000000), ref: 0100724C
GetLastError.KERNEL32(?,010076FD,00000000,00000000,00000000,?,0000000C,00000000,00000000,?,00000000,0101D348,00000010,00FFEC7F,00000000,00000000), ref: 01007272

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 8ed377d89a452b8ce551d8b9da2b8d563ca78b688d7a5708ed27c0c7ccfa3062
Instruction ID: fb852512108f6f066784caa1b2e32428f2112121c51fc3af6aad990009d9c01a
Opcode Fuzzy Hash: 8ed377d89a452b8ce551d8b9da2b8d563ca78b688d7a5708ed27c0c7ccfa3062
Instruction Fuzzy Hash: D2218531A002199BDF1ACF69D9809DDB7B5FB4C311F1440A9FA86D7251D634ED42CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01004652 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0100469E
GetFileType.KERNELBASE(00000000), ref: 010046B0

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 4f367ebe45108b8c2144c88a14b88d3df662b17e5ae3f38c3962001bc9d7fd40
Instruction ID: be4ac7e803fece0e784df3e4ded2e2a232798606bf5ec3efc122fb25787d6fec
Opcode Fuzzy Hash: 4f367ebe45108b8c2144c88a14b88d3df662b17e5ae3f38c3962001bc9d7fd40
Instruction Fuzzy Hash: 1411DA71604741CAF7328D3E9C885277ED4A76A230F280759D3F6C65F1E774D485C64A

Uniqueness

Uniqueness Score: -1.00%

Function 01005916 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,010084CD,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0100594A
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,010084CD,?,?,00000000,?,00000000), ref: 01005968

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 9953388dc9723a4a035682cd4b79f34fd1929fe95c112fe8c228ae7c5399c844
Instruction ID: 6b490f7c8029b8c6665bdfd962708fe7e9bff4455f39dd1e350238a5fcc1f1cd
Opcode Fuzzy Hash: 9953388dc9723a4a035682cd4b79f34fd1929fe95c112fe8c228ae7c5399c844
Instruction Fuzzy Hash: 80F0643250011ABBDF136E91ED04DDE3E6AAB593A0F098011FA5866060CB3AC932AF91

Uniqueness

Uniqueness Score: -1.00%

Function 01009781 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,010099D0,010099C4,00000000), ref: 010097B3

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: d08bf57d4a7bf5467b43da924ced0bd345f23c5bd46a0ddf771b3aa3a3b02749
Instruction ID: 96c340dc9955ee30b0a64bf483589bde1f0da09c8785de15fab12a59fbab831f
Opcode Fuzzy Hash: d08bf57d4a7bf5467b43da924ced0bd345f23c5bd46a0ddf771b3aa3a3b02749
Instruction Fuzzy Hash: 925128719042589EEB238E28CD84AEA7BF8EB55308F1405EDD5DED71C3D3359A468F20

Uniqueness

Uniqueness Score: -1.00%

Function 00FF1BFF Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 00FF1C06

Part of subcall function 00FF2F91: std::_Lockit::_Lockit.LIBCPMT ref: 00FF2F9D
Part of subcall function 00FF2F91: int.LIBCPMT ref: 00FF2FB0
Part of subcall function 00FF2F91: std::_Lockit::~_Lockit.LIBCPMT ref: 00FF2FF9

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3_catchLockit::_Lockit::~_
String ID:
API String ID: 1693569656-0
Opcode ID: 05817bf99ab8db6f625da1d5550466635ce65fea573f948f36eb4c08ec2b4377
Instruction ID: 06a63f6a4c1e6460dfe0842707e75604598f64c0bbb856c1d4798f99a5ed3fdb
Opcode Fuzzy Hash: 05817bf99ab8db6f625da1d5550466635ce65fea573f948f36eb4c08ec2b4377
Instruction Fuzzy Hash: 52214F71B00208DFDB14DF68C989BEDBBF5BF48314F18805AE605E72A2DA35AD05DB10

Uniqueness

Uniqueness Score: -1.00%

Function 01005547 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f75601af5336737ff20fecb63d61e15ef4c87d4d95b10aebe9f758ec22f4e7a
Instruction ID: 4ea278f6f20ae3e3c752af025b7bba24653f1d00f5a59eefe0902aa3bacc1049
Opcode Fuzzy Hash: 9f75601af5336737ff20fecb63d61e15ef4c87d4d95b10aebe9f758ec22f4e7a
Instruction Fuzzy Hash: 2901DE336042155FBB23CD6DEC50A9E3BD7AB84361B184120FA80DB1D8EA3AD8408B81

Uniqueness

Uniqueness Score: -1.00%

Function 00FF2323 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_swprintf.LIBCMT ref: 00FF2363

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: _swprintf
String ID:
API String ID: 589789837-0
Opcode ID: 3e26a9de2dfe4a439ae1fc78841da66500f5d0692f3eb4f6edf646f9f5865f84
Instruction ID: 7f06389255e9e4b3db3fa0a7cb6b2d3a9835316a5cbed5442da31fa6643e8e47
Opcode Fuzzy Hash: 3e26a9de2dfe4a439ae1fc78841da66500f5d0692f3eb4f6edf646f9f5865f84
Instruction Fuzzy Hash: B501DF73100208BFCB11AF54CC82CBBBBACFF48714F00061AFA5592151EA39E92497E2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0100CF9B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0100D17F

Strings

1#QNAN, xrefs: 0100D0AE
1#SNAN, xrefs: 0100D0A7
1#INF, xrefs: 0100D0D1
1#IND, xrefs: 0100D0A0

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: e1fe597de75b924406aed6f1699bef3aac316c56c047e6c2d91f459459c706f6
Instruction ID: 14b25207c6d4954314b42bf8ce276448a37946e2805291d42d65ecd73dd44189
Opcode Fuzzy Hash: e1fe597de75b924406aed6f1699bef3aac316c56c047e6c2d91f459459c706f6
Instruction Fuzzy Hash: 40D25C71E082298FEB66CE68CC407E9B7F5EB44304F1445EAD58DE7280DB78AE858F51

Uniqueness

Uniqueness Score: -1.00%

Function 0100C414 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0100C732,00000002,00000000,?,?,?,0100C732,?,00000000), ref: 0100C4AD
GetLocaleInfoW.KERNEL32(?,20001004,0100C732,00000002,00000000,?,?,?,0100C732,?,00000000), ref: 0100C4D6
GetACP.KERNEL32(?,?,0100C732,?,00000000), ref: 0100C4EB

Strings

ACP, xrefs: 0100C432
OCP, xrefs: 0100C468

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: b2b5c98cb242311fb8bcc5b60b98c4fd0fb82dbf6018d0f7f7180e2570db9f4d
Instruction ID: 069a7b3568e4f0c0652cccbf557957fa638e641a19d5aca44b461204ab976956
Opcode Fuzzy Hash: b2b5c98cb242311fb8bcc5b60b98c4fd0fb82dbf6018d0f7f7180e2570db9f4d
Instruction Fuzzy Hash: D2219222600110A6FB738F58CB40ABB77E6FB44E50F4786E4EA89D7196EF32DA41C350

Uniqueness

Uniqueness Score: -1.00%

Function 0100C5E9 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 010042B1: GetLastError.KERNEL32(?,00000008,010089CA), ref: 010042B5
Part of subcall function 010042B1: SetLastError.KERNEL32(00000000,0101D3A8,00000024,00FFFBA9), ref: 01004357

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0100C6F5
IsValidCodePage.KERNEL32(00000000), ref: 0100C73E
IsValidLocale.KERNEL32(?,00000001), ref: 0100C74D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0100C795
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0100C7B4

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: df5a2756222a0bfa889c5360130031b06300f43746c1c6f1fb8a31fb5bea9ba2
Instruction ID: ba3712f54ede7bb0a399405099c509fdc84ad89958f87559086b987aa81ce385
Opcode Fuzzy Hash: df5a2756222a0bfa889c5360130031b06300f43746c1c6f1fb8a31fb5bea9ba2
Instruction Fuzzy Hash: 0151A671A002069BFB22DFA9CD40ABE77F8FF18700F1541A9EA95E71D0EB759904CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0100BC85 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 010042B1: GetLastError.KERNEL32(?,00000008,010089CA), ref: 010042B5
Part of subcall function 010042B1: SetLastError.KERNEL32(00000000,0101D3A8,00000024,00FFFBA9), ref: 01004357

GetACP.KERNEL32(?,?,?,?,?,?,01001286,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0100BD46
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,01001286,?,?,?,00000055,?,-00000050,?,?), ref: 0100BD71
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0100BED4

Strings

utf8, xrefs: 0100BE43

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 26d7572a7eb440229be03d1961c3420ca33e917f2d4443d9b8bb9276f174383e
Instruction ID: adfe7dd642ecd9f761efa0d5055b141564c53c8e6ad2232b442a989cba0711c9
Opcode Fuzzy Hash: 26d7572a7eb440229be03d1961c3420ca33e917f2d4443d9b8bb9276f174383e
Instruction Fuzzy Hash: 66712679600206AAFB27BB38CC41BBA77E8EF54740F14446AEB85D71C1FB74D9408761

Uniqueness

Uniqueness Score: -1.00%

Function 01003092 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0100311F

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 8dad789afd6d51dda9cbc5801a1597c603c4f5d55282779db2e220a882f4d380
Instruction ID: 4110ad49c65f72d2c09d7a3a541fd6bd6baf25bfa74f428b5f8f1c830a89da26
Opcode Fuzzy Hash: 8dad789afd6d51dda9cbc5801a1597c603c4f5d55282779db2e220a882f4d380
Instruction Fuzzy Hash: D8B127329042469FEB178F68C8817EEBBF5FF59310F1481AAE985AF381D7349905C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00FF67DF Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00FF67EB
IsDebuggerPresent.KERNEL32 ref: 00FF68B7
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00FF68D0
UnhandledExceptionFilter.KERNEL32(?), ref: 00FF68DA

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: d0eac42c6a6bab444334eb192f84491e81a1bb46801c73fe2087a2da26532e60
Instruction ID: f39d5e46fac26290d20e8875d4dd4708e8e27d9de7d4e49de5ef8764c5e30db4
Opcode Fuzzy Hash: d0eac42c6a6bab444334eb192f84491e81a1bb46801c73fe2087a2da26532e60
Instruction Fuzzy Hash: 89312975D0131C9BDF21EF64D9497CDBBB8AF08300F1041AAE50CAB250EB799A84DF44

Uniqueness

Uniqueness Score: -1.00%

Function 0100C098 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 010042B1: GetLastError.KERNEL32(?,00000008,010089CA), ref: 010042B5
Part of subcall function 010042B1: SetLastError.KERNEL32(00000000,0101D3A8,00000024,00FFFBA9), ref: 01004357

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0100C0EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0100C136
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0100C1FC

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 81b0606a00958b742fadc70b7da863ad98e4d0d3581f829681ca10d56b0b9219
Instruction ID: fff26be94c0d258c6a5436ebb41fe449702b0e42eaa684609595488454e0f3ea
Opcode Fuzzy Hash: 81b0606a00958b742fadc70b7da863ad98e4d0d3581f829681ca10d56b0b9219
Instruction Fuzzy Hash: BF61A1729401079BFB6A9F68CE81BBA77E9EF04300F1042FAE949C65C5E738D985CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FFD209 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00FFD301
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00FFD30B
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00FFD318

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d1d4adb4e568bcc4747ae628739281c1738881ea012a2ef067c0217d320890c0
Instruction ID: 47e3c070676db399dafd3c590dd3d197bc9fc9676cb8240b8916d4feebb48b99
Opcode Fuzzy Hash: d1d4adb4e568bcc4747ae628739281c1738881ea012a2ef067c0217d320890c0
Instruction Fuzzy Hash: E631C47590122C9BCB21DF64DD89B9CBBB8BF08310F5041EAE51CA7260EB749B859F45

Uniqueness

Uniqueness Score: -1.00%

Function 00FFF680 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84c6b3c7577c3d8be5159056f1df0cc0a083e065d44da9bff4d557b3e001d670
Instruction ID: 117d30ef0ff2238bf023e0f7cb02745c9eb4bb2ee2f4dade7116623fed1676ee
Opcode Fuzzy Hash: 84c6b3c7577c3d8be5159056f1df0cc0a083e065d44da9bff4d557b3e001d670
Instruction Fuzzy Hash: DEF14071E002199FDF14CF68D880AADF7B1FF88324F158269D919AB394D734AD05DB94

Uniqueness

Uniqueness Score: -1.00%

Function 01004C60 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,01004C5B,?,?,00000008,?,?,01011825,00000000), ref: 01004E8D

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 5ab1a697387b61209f83ec565c6eee3ecbf8522dc3140b26f1518feb88b34e5d
Instruction ID: 493dd65d3e04c24ca7c3765efdab0e32646a836d6de75f757c909d18a08930e4
Opcode Fuzzy Hash: 5ab1a697387b61209f83ec565c6eee3ecbf8522dc3140b26f1518feb88b34e5d
Instruction Fuzzy Hash: 8EB138316106088FE756CF2CC48AA657BE0FF45364F158699EADACF2E1C335E992CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00FF62BC Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00FF62D2

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 060a6bfb398eea9664a3ced7fca300f28dc5b25c0ee634f59de90598b147ae0a
Instruction ID: 45600ac329e587874ff1ed00f8b382887bf0e79cb90ab37b550d668cdeda2b84
Opcode Fuzzy Hash: 060a6bfb398eea9664a3ced7fca300f28dc5b25c0ee634f59de90598b147ae0a
Instruction Fuzzy Hash: 2551AAB1E006098BEB25CF69D4817BEBBF0FB48325F14842AD945EB365D77A9940CF90

Uniqueness

Uniqueness Score: -1.00%

Function 010090D1 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 133d4ef61683a6f29600190d7a2e6f08ef8e5dd29dd59467c7c8688fb899f5a8
Instruction ID: 388e3d8e8952a39c3f3c80b6d5ecbee236479214526911c1c8fca39344290dd9
Opcode Fuzzy Hash: 133d4ef61683a6f29600190d7a2e6f08ef8e5dd29dd59467c7c8688fb899f5a8
Instruction Fuzzy Hash: 4241C375C0521DAEEB21DF68CC88AEABBB9AF45304F1442EDE44CD3241DA359E848F10

Uniqueness

Uniqueness Score: -1.00%

Function 00FFB962 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00FFBAF0

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 3d24ad09acaf8b51d1e2c0bb8435783f165883491e95b5ec29eafc16832df5bf
Instruction ID: 7cae9c6ae5c9fb38f110eba2bec3614c5ed3aedf2ff30ec726f742d46470d967
Opcode Fuzzy Hash: 3d24ad09acaf8b51d1e2c0bb8435783f165883491e95b5ec29eafc16832df5bf
Instruction Fuzzy Hash: A5C1C070A0060E8FCB38CF28C89467EB7B1AF45320F244619DB969B7B1C775AD45EB91

Uniqueness

Uniqueness Score: -1.00%

Function 0100C2EB Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 010042B1: GetLastError.KERNEL32(?,00000008,010089CA), ref: 010042B5
Part of subcall function 010042B1: SetLastError.KERNEL32(00000000,0101D3A8,00000024,00FFFBA9), ref: 01004357

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0100C33F

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: ade6355a094f4f921f18c323e457596b0edeef065e4fa3847fcc35674644bcb6
Instruction ID: e756d885eed254b14c1f8ec638a3dc273a844430bd5d975df2deb3051f7a425d
Opcode Fuzzy Hash: ade6355a094f4f921f18c323e457596b0edeef065e4fa3847fcc35674644bcb6
Instruction Fuzzy Hash: DA21C872611206ABFB2A9F68DD41EBA77E8EF44300F0081FAED45D61C1EB35EA508751

Uniqueness

Uniqueness Score: -1.00%

Function 0100BF72 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 010042B1: GetLastError.KERNEL32(?,00000008,010089CA), ref: 010042B5
Part of subcall function 010042B1: SetLastError.KERNEL32(00000000,0101D3A8,00000024,00FFFBA9), ref: 01004357

EnumSystemLocalesW.KERNEL32(0100C098,00000001,00000000,?,-00000050,?,0100C6C9,00000000,?,?,?,00000055,?), ref: 0100BFE4

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a01dbd0259cf6a976c5dec882492bc1b5f2b1d7ba5d56dbdd79f39102c61e205
Instruction ID: 81c1758ab61047cefa754e0235fa5a8b153927aeea6e1efaef957a9bc9efd6fa
Opcode Fuzzy Hash: a01dbd0259cf6a976c5dec882492bc1b5f2b1d7ba5d56dbdd79f39102c61e205
Instruction Fuzzy Hash: DE11063A2007015FEB199F39C8906BAB791FB80358F15852DEA8797A80D3726402CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0100C51A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 010042B1: GetLastError.KERNEL32(?,00000008,010089CA), ref: 010042B5
Part of subcall function 010042B1: SetLastError.KERNEL32(00000000,0101D3A8,00000024,00FFFBA9), ref: 01004357

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0100C2B4,00000000,00000000,?), ref: 0100C546

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 7663f449f670460a111441733a6cda866a4e0978da482fdb50a67d5a8d4b0b85
Instruction ID: f86b6fb6c34ece8323168d6e3ff7b016f283e32b74c3773b262492243485f6a4
Opcode Fuzzy Hash: 7663f449f670460a111441733a6cda866a4e0978da482fdb50a67d5a8d4b0b85
Instruction Fuzzy Hash: 82F0F936A00112BBFB269A648D05ABA7BA4EF40755F0506A4ED86B31C0DA35FA85C690

Uniqueness

Uniqueness Score: -1.00%

Function 0100C00D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 010042B1: GetLastError.KERNEL32(?,00000008,010089CA), ref: 010042B5
Part of subcall function 010042B1: SetLastError.KERNEL32(00000000,0101D3A8,00000024,00FFFBA9), ref: 01004357

EnumSystemLocalesW.KERNEL32(0100C2EB,00000001,?,?,-00000050,?,0100C68D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0100C057

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: cde70b72db3da2922a8393a901d34e74e063f73e3262b36f23fc2f25bd46f621
Instruction ID: fe8fb4505d3951f452e2c4958b162bdfd53dccfb27bd5137284e4707596cd319
Opcode Fuzzy Hash: cde70b72db3da2922a8393a901d34e74e063f73e3262b36f23fc2f25bd46f621
Instruction Fuzzy Hash: 1BF0C2362003045FFB269E79D980ABA7BD1EB81768F0545ADFA868BA90C6759802C650

Uniqueness

Uniqueness Score: -1.00%

Function 010052B3 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FFD557: EnterCriticalSection.KERNEL32(?,?,01003F89,?,0101D208,00000008,0100414D,?,00FFB2B6,?), ref: 00FFD566

EnumSystemLocalesW.KERNEL32(010052A6,00000001,0101D2C8,0000000C,010056D5,00000000), ref: 010052EB

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 1bc47d84165924b901de82a799942e0172feb171bf24eecf363cef0991da7a28
Instruction ID: 9e2e54c5ac7a2d1a55ebb8e3eddf5d9767a97027984d3091cd713535723cb2c7
Opcode Fuzzy Hash: 1bc47d84165924b901de82a799942e0172feb171bf24eecf363cef0991da7a28
Instruction Fuzzy Hash: AFF03736A402049FE712EF98E841B9D77B0EB09725F10852AF595EB2A0CBBE5944CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0100BF27 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 010042B1: GetLastError.KERNEL32(?,00000008,010089CA), ref: 010042B5
Part of subcall function 010042B1: SetLastError.KERNEL32(00000000,0101D3A8,00000024,00FFFBA9), ref: 01004357

EnumSystemLocalesW.KERNEL32(0100BE80,00000001,?,?,?,0100C6EB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0100BF5E

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a215683f4f55bfd3d6e8095d39c93cb83ddffe50aaf8f6920005253b164ffd71
Instruction ID: e8c10926be31d3bf9cd39c7a290374e0d492daf4b0ff116406d90dbbd3f78d76
Opcode Fuzzy Hash: a215683f4f55bfd3d6e8095d39c93cb83ddffe50aaf8f6920005253b164ffd71
Instruction Fuzzy Hash: F1F0553E30020557DB16AF3AC8156BA7FD0EFC1B10F0640ADEF49CB291C6369842CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010057D9 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,01001DEC,?,20001004,00000000,00000002,?,?,010013EE), ref: 0100580D

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 4b28c354e24ea1cfdd977ff0b51ce06b491e3d0e4edcacb47dbc3e096922276f
Instruction ID: f22c6b3272a0182896f3e86b44a4cc273cf01f2aa183773c60f30cbe1a7ac487
Opcode Fuzzy Hash: 4b28c354e24ea1cfdd977ff0b51ce06b491e3d0e4edcacb47dbc3e096922276f
Instruction Fuzzy Hash: B6E04F32500218BBDF232FA1EC04EDE3F59EF44760F048421FD85661A0CB768A21AF94

Uniqueness

Uniqueness Score: -1.00%

Function 00FF693B Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00006947,00FF5DE2), ref: 00FF6940

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2c2f61930d6ef767832b79c10bcf908251f867068eaf13882e998995c76d8823
Instruction ID: 6962180c16050a8537492b80d54b10c84408c8d075ae3771bd3c360c5270a979
Opcode Fuzzy Hash: 2c2f61930d6ef767832b79c10bcf908251f867068eaf13882e998995c76d8823
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0100C84B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0100C84B

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: b3168618997adf61849a68cf775c40160eb07f3d29d9f5a173aedce8f42a6164
Instruction ID: b930cacbe666d72de8172376942a3c9a9ffe9ab8758b19167152b703dc930029
Opcode Fuzzy Hash: b3168618997adf61849a68cf775c40160eb07f3d29d9f5a173aedce8f42a6164
Instruction Fuzzy Hash: 5FA01130200200CFA3208EB2A208A083AA8AA0B2823008028E8C2C8228EB3E80008F00

Uniqueness

Uniqueness Score: -1.00%

Function 01024FD5 Relevance: .9, Instructions: 943COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71f4dcc32ce9e6fbb1b92ebdf2b4dc27e2300bab1910a7a62dcc47cce8feb757
Instruction ID: e3b69860a012969f342c5788f2778dd79bb91b48e59821f22676d42c36f85530
Opcode Fuzzy Hash: 71f4dcc32ce9e6fbb1b92ebdf2b4dc27e2300bab1910a7a62dcc47cce8feb757
Instruction Fuzzy Hash: 9272326144F3D29FD7238B749C709E27FB0AE5721432E08DBD4C18B0A3E2191A6AD776

Uniqueness

Uniqueness Score: -1.00%

Function 01024850 Relevance: .6, Instructions: 555COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e0ce883132efa017280f122d4b71a9406364044b925c37b209814bfe8e86b68
Instruction ID: 9fe673ccebdc3f16084b68b7e8dfb574928319d6d9bf9ae986fa2aa5a3f126af
Opcode Fuzzy Hash: 3e0ce883132efa017280f122d4b71a9406364044b925c37b209814bfe8e86b68
Instruction Fuzzy Hash: 5322F26144E3C28FC7138B749CB56D17FB0AE6722471E45DBD8C0CF4A3E2291A5ADB62

Uniqueness

Uniqueness Score: -1.00%

Function 0100B736 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 70e115640d5b0dadb9239e7d8d2b5c53688ee33b6287de9dfa3294a4b2ca3f9c
Instruction ID: 3805a5f353fc14f7585420205b17493a523b016a0f9685a439e0df0493a98187
Opcode Fuzzy Hash: 70e115640d5b0dadb9239e7d8d2b5c53688ee33b6287de9dfa3294a4b2ca3f9c
Instruction Fuzzy Hash: 36B1F4795007468FEB3A9B29CC91ABBB3E8FF44308F04446DDAC3C65D1EA75A681CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00FF9438 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00FF9557
___TypeMatch.LIBVCRUNTIME ref: 00FF9665
_UnwindNestedFrames.LIBCMT ref: 00FF97B7
CallUnexpected.LIBVCRUNTIME ref: 00FF97D2

Strings

csm, xrefs: 00FF94E2
csm, xrefs: 00FF9475
csm, xrefs: 00FF958E

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 78c5c1231e9560321a0f36ebec748fd4ff9de6a10b255ff6613838b1efa2f5a9
Instruction ID: c95e59282c90a9bbdb5c6ee093bf0fbf2951267cf9c3e4c4f21cbdd0eb5cdb82
Opcode Fuzzy Hash: 78c5c1231e9560321a0f36ebec748fd4ff9de6a10b255ff6613838b1efa2f5a9
Instruction Fuzzy Hash: 9EB15E72C0820DEFCF15EFA4C881ABEB7B5BF04320B14415AEA116B225D7B5DA51EF91

Uniqueness

Uniqueness Score: -1.00%

Function 010106EA Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(012B0520,012B0520,?,7FFFFFFF,?,010109BA,012B0520,012B0520,?,012B0520,?,?,?,?,012B0520,?), ref: 01010790
__alloca_probe_16.LIBCMT ref: 0101084B
__alloca_probe_16.LIBCMT ref: 010108DA
__freea.LIBCMT ref: 01010925
__freea.LIBCMT ref: 0101092B
__freea.LIBCMT ref: 01010961
__freea.LIBCMT ref: 01010967
__freea.LIBCMT ref: 01010977

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: bd98dad855449c25197178c43301b80de2f643b97bf63541ba2378d29f6e90d9
Instruction ID: 3ca094d4605f37cc36b1478a0b80df33ad43170e8e54986bbadb9386baf4fe04
Opcode Fuzzy Hash: bd98dad855449c25197178c43301b80de2f643b97bf63541ba2378d29f6e90d9
Instruction Fuzzy Hash: D171DA72D042096BFF219F688C51BEE7BE6AF49710F180095FAC4B719DD63D9880CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FF4457 Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FF445E
std::_Lockit::_Lockit.LIBCPMT ref: 00FF4468
int.LIBCPMT ref: 00FF447F

Part of subcall function 00FF16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00FF16C5
Part of subcall function 00FF16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00FF16DF

codecvt.LIBCPMT ref: 00FF44A2
std::_Facet_Register.LIBCPMT ref: 00FF44B9
std::_Lockit::~_Lockit.LIBCPMT ref: 00FF44D9
Concurrency::cancel_current_task.LIBCPMT ref: 00FF44E6

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 27efecf2685b22a3168c949f05191e8a5baef9d6cad7ee3f7ba9cd4c2c9fdd29
Instruction ID: 9bb50ef30acc87440e38212a08ba0b8c86c124cb4760058db54c845fb902cfdb
Opcode Fuzzy Hash: 27efecf2685b22a3168c949f05191e8a5baef9d6cad7ee3f7ba9cd4c2c9fdd29
Instruction Fuzzy Hash: 3E11AF75A0021D9BCB10EF64D9057BEB7B4BF94720F140409FA45E72A1DF78AE04AB90

Uniqueness

Uniqueness Score: -1.00%

Function 0100EF6F Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f12c9d4bfc294751e94ad218b15b99e0fae80d7650c1764b324c2800cf7dcf
Instruction ID: 5770d653d5c9dee5fb03454371713af95a4ad43f65f5a98600d5798a9e6111fd
Opcode Fuzzy Hash: 39f12c9d4bfc294751e94ad218b15b99e0fae80d7650c1764b324c2800cf7dcf
Instruction Fuzzy Hash: 02B1D474A0424B9FFB22DF98D840BBDBBF2BF45314F184199E680A72D2C7759941DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FF90CA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00FF90C1,00FF77F5,00FF698B), ref: 00FF90D8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00FF90E6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00FF90FF
SetLastError.KERNEL32(00000000,00FF90C1,00FF77F5,00FF698B), ref: 00FF9151

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 965ba1e4bf6db304d0f657b17a8f1b45d6b21ba42500d0cc43e6001b2ccd9fdb
Instruction ID: 2d92cc18dacd3e6b715c2f3716b83e088a740e940b433cdd270ff74d35f83bef
Opcode Fuzzy Hash: 965ba1e4bf6db304d0f657b17a8f1b45d6b21ba42500d0cc43e6001b2ccd9fdb
Instruction Fuzzy Hash: 5701F172A0C21A9EA62726B5BC8973A2645EF017747300239F714911F1EF9F4C00B241

Uniqueness

Uniqueness Score: -1.00%

Function 01000969 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,916321FF,?,?,00000000,010122F7,000000FF,?,010008F9,01000A29,?,010008CD,00000000), ref: 0100099E
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 010009B0
FreeLibrary.KERNEL32(00000000,?,?,00000000,010122F7,000000FF,?,010008F9,01000A29,?,010008CD,00000000), ref: 010009D2

Strings

CorExitProcess, xrefs: 010009A8
mscoree.dll, xrefs: 01000997

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 5c9573ceeb9a1438c650899553a3f7be5da41f74175896b25818bf6db0b743ae
Instruction ID: 82e93fb85bae520215f7b5cf2d399458b2265d60fa5cd2430788c5642db9bd8b
Opcode Fuzzy Hash: 5c9573ceeb9a1438c650899553a3f7be5da41f74175896b25818bf6db0b743ae
Instruction Fuzzy Hash: 7D01A275940619EFEB228F55DC09FAEBBB8FB04B54F040529F851E2298DB7D9900CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FF36B0 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00FF36BC
int.LIBCPMT ref: 00FF36CF

Part of subcall function 00FF16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00FF16C5
Part of subcall function 00FF16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00FF16DF

std::_Facet_Register.LIBCPMT ref: 00FF3702
std::_Lockit::~_Lockit.LIBCPMT ref: 00FF3718
Concurrency::cancel_current_task.LIBCPMT ref: 00FF3723

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: f728741e3a21dee10686cb6980b4f4f71323cdec97f2e0838daaa3818667926f
Instruction ID: d1e750b75d5dac8faadac0cb4e87feadb266e21c734e638cee40e1aaa4790a93
Opcode Fuzzy Hash: f728741e3a21dee10686cb6980b4f4f71323cdec97f2e0838daaa3818667926f
Instruction Fuzzy Hash: 7E01F7B390401CEBCB24BB54DD059BD7768EF80370B100149FA41AB2B0EB349F01EB80

Uniqueness

Uniqueness Score: -1.00%

Function 00FF2F91 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00FF2F9D
int.LIBCPMT ref: 00FF2FB0

Part of subcall function 00FF16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00FF16C5
Part of subcall function 00FF16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00FF16DF

std::_Facet_Register.LIBCPMT ref: 00FF2FE3
std::_Lockit::~_Lockit.LIBCPMT ref: 00FF2FF9
Concurrency::cancel_current_task.LIBCPMT ref: 00FF3004

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: dfa0090a857cb707da3f612bb5cb9cf376b375ac623cbfec9d68ada31a3c1860
Instruction ID: 60a5b6acb5b77d20d88ec263c0f180b76c3983a229c6e5aec58b7aaa4fd60538
Opcode Fuzzy Hash: dfa0090a857cb707da3f612bb5cb9cf376b375ac623cbfec9d68ada31a3c1860
Instruction Fuzzy Hash: DD01A272A0011DEBDB25AB94DD058BE7778AF80760B140249FB55972B0EF78AF01E790

Uniqueness

Uniqueness Score: -1.00%

Function 00FF34E8 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00FF34F5
int.LIBCPMT ref: 00FF3508

Part of subcall function 00FF16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00FF16C5
Part of subcall function 00FF16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00FF16DF

std::_Facet_Register.LIBCPMT ref: 00FF353B
std::_Lockit::~_Lockit.LIBCPMT ref: 00FF3551
Concurrency::cancel_current_task.LIBCPMT ref: 00FF355C

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 0e82eb80d9ef3501ca78e722ad03510b5a03f1697656a8e66857e2fc49d5a3ba
Instruction ID: a9b9ff81429f3f090a7ce6f265bf5df7398b00791575e7b2312bdeae443f1b1d
Opcode Fuzzy Hash: 0e82eb80d9ef3501ca78e722ad03510b5a03f1697656a8e66857e2fc49d5a3ba
Instruction Fuzzy Hash: F701F77290011DE7CB24FB64DD058BD7768AF80720B190149FA65AB2B1EB34DF41E780

Uniqueness

Uniqueness Score: -1.00%

Function 00FF41DA Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FF41E1
std::_Lockit::_Lockit.LIBCPMT ref: 00FF41EC
std::locale::_Setgloballocale.LIBCPMT ref: 00FF4207
_Yarn.LIBCPMT ref: 00FF421D
std::_Lockit::~_Lockit.LIBCPMT ref: 00FF425A

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID:
API String ID: 156189095-0
Opcode ID: e58bccb1cf43917e28b6e850ea09ca9237c800f878b438c296fd5ef3200dcf09
Instruction ID: d7d2780a3f13e0fe45e5d3f909b2e9a0cac1d2db2f692f36bbd1270b67f1709a
Opcode Fuzzy Hash: e58bccb1cf43917e28b6e850ea09ca9237c800f878b438c296fd5ef3200dcf09
Instruction Fuzzy Hash: EC01DFB5B002298BC706EF20E845ABD7B71BF94740B180008EA51973A5DF3DBE42EBC5

Uniqueness

Uniqueness Score: -1.00%

Function 00FFA212 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00FFA1C3,00000000,?,0106BA9C,?,?,?,00FFA366,00000004,InitializeCriticalSectionEx,01015BD8,InitializeCriticalSectionEx), ref: 00FFA21F
GetLastError.KERNEL32(?,00FFA1C3,00000000,?,0106BA9C,?,?,?,00FFA366,00000004,InitializeCriticalSectionEx,01015BD8,InitializeCriticalSectionEx,00000000,?,00FFA11D), ref: 00FFA229
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00FFA251

Strings

api-ms-, xrefs: 00FFA236

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 7c684d4b6979f7de07365677e0262bdd75c6e89e8b1805997388527b93cd36b2
Instruction ID: 6a2cc9946a02b6210e760425f3b67398bf55fd2bd4282a5a58905c270a7b7a1d
Opcode Fuzzy Hash: 7c684d4b6979f7de07365677e0262bdd75c6e89e8b1805997388527b93cd36b2
Instruction Fuzzy Hash: 96E01274740209BBEF211F61ED05B693F58BF40B50F100020FB4CE80E4D77B99109685

Uniqueness

Uniqueness Score: -1.00%

Function 01006CF8 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(916321FF,00000000,00000000,00000000), ref: 01006D5B

Part of subcall function 01008A72: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,01008584,?,00000000,-00000008), ref: 01008B1E

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 01006FB6
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 01006FFE
GetLastError.KERNEL32 ref: 010070A1

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 1cb805cfef64c5a3adf29bb32faa581e0bec00417701d73c64a4b23ade9bc50b
Instruction ID: 7c74a3efd9c3c872b6a8d36efe63906c3d8a4541d949c25b11e6acce808c1788
Opcode Fuzzy Hash: 1cb805cfef64c5a3adf29bb32faa581e0bec00417701d73c64a4b23ade9bc50b
Instruction Fuzzy Hash: B8D17AB5E00249EFDB12CFA8D8809EDBBB5FF08300F18426AE995E7391D735A851CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FF91E1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00FF92A8
___AdjustPointer.LIBCMT ref: 00FF92CB
___AdjustPointer.LIBCMT ref: 00FF9367

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: f06ea4a44a3328caa6c4f98f34b4cfcbe29a9386d80b31a513799eda65859f40
Instruction ID: 4d2719860747d6e43bdeb6d5ee32b3300e78555d066feac75debbfc4393a7500
Opcode Fuzzy Hash: f06ea4a44a3328caa6c4f98f34b4cfcbe29a9386d80b31a513799eda65859f40
Instruction Fuzzy Hash: B551C572E0820AAFDB259F54D881B7AB7A8EF44324F14412DEB05972B1E7B5EC81E750

Uniqueness

Uniqueness Score: -1.00%

Function 01008E8E Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 01008A72: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,01008584,?,00000000,-00000008), ref: 01008B1E

GetLastError.KERNEL32 ref: 01008EF2
__dosmaperr.LIBCMT ref: 01008EF9
GetLastError.KERNEL32(?,?,?,?), ref: 01008F33
__dosmaperr.LIBCMT ref: 01008F3A

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 87e84e5c33ce098f1ac0549ff1c80dcd1a376fc3dda68c27364c2018b585f9f8
Instruction ID: 08eb222ff1af0bf986219da05c6439729ef4133a28208bf945830fa695f35b10
Opcode Fuzzy Hash: 87e84e5c33ce098f1ac0549ff1c80dcd1a376fc3dda68c27364c2018b585f9f8
Instruction Fuzzy Hash: D921C871A04609AFEB22AF758C4097B77AAFF44364B14C55EFA99D7291DB34EC008B90

Uniqueness

Uniqueness Score: -1.00%

Function 00FFFCAB Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdc2289e45deca438154a863eb80cc543d83446a162f3e8b2d36dfc951fcf514
Instruction ID: 6848d939190b76130bf638049145f4128eecc0b0589b049cffb42229d2948c91
Opcode Fuzzy Hash: bdc2289e45deca438154a863eb80cc543d83446a162f3e8b2d36dfc951fcf514
Instruction Fuzzy Hash: 7C216D71A0020EAFDB20AF71DC80E7E77A9AF503647148939FA15D7260D734EC04A7A0

Uniqueness

Uniqueness Score: -1.00%

Function 01009E24 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 01009E2C

Part of subcall function 01008A72: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,01008584,?,00000000,-00000008), ref: 01008B1E

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 01009E64
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 01009E84

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: fbd0492386f7469d48125eaf43c4306b2ed4b54fdce210ae93fbbaac9e0f7628
Instruction ID: 4ffabb756a707899d4ff17cd6144dc467d722f9e84d45094edde0cc48ed39411
Opcode Fuzzy Hash: fbd0492386f7469d48125eaf43c4306b2ed4b54fdce210ae93fbbaac9e0f7628
Instruction Fuzzy Hash: 251126F1A041467EBB2337B66C8CCAF6D9DDE95398B100415F9C9D1182FF68CD0182B0

Uniqueness

Uniqueness Score: -1.00%

Function 0101051F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,0100F32C,00000000,00000001,00000000,00000000,?,010070F5,00000000,00000000,00000000), ref: 01010536
GetLastError.KERNEL32(?,0100F32C,00000000,00000001,00000000,00000000,?,010070F5,00000000,00000000,00000000,00000000,00000000,?,0100767C,00000000), ref: 01010542

Part of subcall function 01010508: CloseHandle.KERNEL32(FFFFFFFE,01010552,?,0100F32C,00000000,00000001,00000000,00000000,?,010070F5,00000000,00000000,00000000,00000000,00000000), ref: 01010518

___initconout.LIBCMT ref: 01010552

Part of subcall function 010104CA: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,010104F9,0100F319,00000000,?,010070F5,00000000,00000000,00000000,00000000), ref: 010104DD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,0100F32C,00000000,00000001,00000000,00000000,?,010070F5,00000000,00000000,00000000,00000000), ref: 01010567

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 25a7435fb500bd2f31e1ba52c8601fcade9a3074e29b512caeb5ad48d200af41
Instruction ID: 69e3dd69be14b79af898016e74f42bb762a55ec2e7b7b6ee5607b473a2022059
Opcode Fuzzy Hash: 25a7435fb500bd2f31e1ba52c8601fcade9a3074e29b512caeb5ad48d200af41
Instruction Fuzzy Hash: 0AF01C36941155BBCF635F95DC0499E3F66FB083B1F414010FE9985128C73B88609B90

Uniqueness

Uniqueness Score: -1.00%

Function 00FF8ED0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00FF8F0F
__IsNonwritableInCurrentImage.LIBCMT ref: 00FF8FC3

Strings

csm, xrefs: 00FF8FAD

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: d2238445064a6d6928ff662c42093679df23781a2a7b74d544a564c59752855f
Instruction ID: 7f99d3e8d57c77abd2d23adfebc36d8415897cbae601573ca9919df4050eb863
Opcode Fuzzy Hash: d2238445064a6d6928ff662c42093679df23781a2a7b74d544a564c59752855f
Instruction Fuzzy Hash: DF41C734E0020D9FCF10DF68CC81AAE7BB6AF45364F148155FA189B3A6DB39D942DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FF97DD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00FF9802

Strings

RCC, xrefs: 00FF981C
MOC, xrefs: 00FF9814

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ed25f2848ac868db54af6f219322eeffd85461a1e2dfd12b005fa094b813616c
Instruction ID: 21f17b32b937ca5c14cde9fc81f3980084f961bd9a91bf35c87330d640aeb524
Opcode Fuzzy Hash: ed25f2848ac868db54af6f219322eeffd85461a1e2dfd12b005fa094b813616c
Instruction Fuzzy Hash: AA418772D0420DEFCF16DFA8CC81AEEBBB5BF49350F184069FA14A6221D3B59950EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FF15DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00FF15E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00FF161E

Part of subcall function 00FF42D8: _Yarn.LIBCPMT ref: 00FF42F7
Part of subcall function 00FF42D8: _Yarn.LIBCPMT ref: 00FF431B

Strings

bad locale name, xrefs: 00FF162C

Memory Dump Source

Source File: 00000000.00000002.1671452555.0000000000FF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.1671437659.0000000000FF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671474617.0000000001014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671490410.000000000101E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671523622.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671538522.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671552385.000000000106D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 844d6f8fd10cc5709927a76b70f04c09dc57a2b6d492700da8a4e46976ca2c1a
Instruction ID: c4e7e96f69ee44d52bf7bc24d22293196533f41cfadeaf00ccf9d93e3a033694
Opcode Fuzzy Hash: 844d6f8fd10cc5709927a76b70f04c09dc57a2b6d492700da8a4e46976ca2c1a
Instruction Fuzzy Hash: C5F03071509B849E83309F7A9881457FBE4BF283207948E2FE2DEC3A21D774E404CB69

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 6708, Parent PID: 6496COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	95
Total number of Limit Nodes:	10

Executed Functions

Function 06B8BB70 Relevance: 14.9, Strings: 11, Instructions: 1127COMMON

Download Yara Rule

Strings

4c^q, xrefs: 06B8C4EA
c^q, xrefs: 06B8C524
,bq, xrefs: 06B8C78F
Nv]q, xrefs: 06B8BE78
$^q, xrefs: 06B8C1FB
Hbq, xrefs: 06B8C92A
(_^q, xrefs: 06B8C626
$^q, xrefs: 06B8C215
4c^q, xrefs: 06B8C504
(_^q, xrefs: 06B8C60C
c^q, xrefs: 06B8C53E

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$,bq$4c^q$4c^q$Hbq$Nv]q$$^q$$^q$c^q$c^q
API String ID: 0-3459267885
Opcode ID: 30fcd952f2e59edfa6bfeb07b8b98030478e832e108d08330799cc079a133474
Instruction ID: 9d2b888e9c142dc07fa4d9124fda68d58c6c0aec3658cf960522bd0667b523ce
Opcode Fuzzy Hash: 30fcd952f2e59edfa6bfeb07b8b98030478e832e108d08330799cc079a133474
Instruction Fuzzy Hash: C38233B0B801288FCB69BB7E445427D6AD3BBCC740B6058E9D406DB394EF25DD46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06B8F8E0 Relevance: 6.8, Strings: 5, Instructions: 515
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR^q, xrefs: 06B8F8ED
Hbq, xrefs: 06B8FD13
Hbq, xrefs: 06B8FCCC
Hbq, xrefs: 06B8FD44
Hbq, xrefs: 06B8FC9B

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID: Hbq$Hbq$Hbq$Hbq$LR^q
API String ID: 0-890361779
Opcode ID: b6b2e52e7e5361de52293330d151fc934255eac752567f07857d349335419168
Instruction ID: 2a7fc02825d964b45b96f4e91114ea8d1a04ffef545720d429f8072d16685944
Opcode Fuzzy Hash: b6b2e52e7e5361de52293330d151fc934255eac752567f07857d349335419168
Instruction Fuzzy Hash: 3002D7B0E042559FDB59EF79C4542BEBBF6EF85340F1484A9D445DB282EB38CA41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06463F50 Relevance: 1.8, Strings: 1, Instructions: 520
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 064641E4

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: 2ac5b969f0604715ffceaf36a89575359470fda249108a539147371c86a27782
Instruction ID: e010e7b194a1c317da8cb8b65e7ad9cb104629157c951440cf59e64a8fc63fc4
Opcode Fuzzy Hash: 2ac5b969f0604715ffceaf36a89575359470fda249108a539147371c86a27782
Instruction Fuzzy Hash: DD126034B002158FCB55DF79D584AAEBBF2BF88700B14856AE906EB3A5DB31DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 064667D8 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3a5d03b51c9f33cedd38eec495628432a6e14ad46e16946da4e0ecdf5d8aad5
Instruction ID: ffce4b91823ad38807ca3a104e036d7284c40ed9a827e4132cf7f0cb562736f1
Opcode Fuzzy Hash: f3a5d03b51c9f33cedd38eec495628432a6e14ad46e16946da4e0ecdf5d8aad5
Instruction Fuzzy Hash: 06F19F30A002099FDB15DF69D884B9EBBF2EF84300F15856AF505AB3A5DB31ED45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0646A3D8 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b6255aed50780cb8ce6092173f04d3eebdcc264e1cbaed14666dd6c69d54e53
Instruction ID: b79082ab8e6a3a226e4b9591b59c088ef3d5c4ff9bc0fd21fddd9addec991278
Opcode Fuzzy Hash: 8b6255aed50780cb8ce6092173f04d3eebdcc264e1cbaed14666dd6c69d54e53
Instruction Fuzzy Hash: 13D1E934900258CFCB58EFB4D854AADBBB2FF8A305F1081A9E55AA7354DB31598ACF11

Uniqueness

Uniqueness Score: -1.00%

Function 0646A3E8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 609e0542855370114b14aaa831ce44469e04ba80ae0556cb1542d4d58c628fd3
Instruction ID: f44e2ed657a7a001f1d2128cfca9af8da2d5df3b3c2ee5fd765d8c243309dd95
Opcode Fuzzy Hash: 609e0542855370114b14aaa831ce44469e04ba80ae0556cb1542d4d58c628fd3
Instruction Fuzzy Hash: D9D1D934D00218CFCB58EFB4D844AADBBB2FF8A305F1085A9D51AA7254DF31998ACF51

Uniqueness

Uniqueness Score: -1.00%

Function 06440D80 Relevance: 21.9, Strings: 17, Instructions: 621
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

al, publickeytoken=b03f5f7f11d50a3a, xrefs: 06440D65, 06440D84
$^q, xrefs: 06441461
$^q, xrefs: 06440F36
$^q, xrefs: 064413EB
$^q, xrefs: 06440FAC
$^q, xrefs: 0644137B
$^q, xrefs: 06440FB8
$^q, xrefs: 06441336
$^q, xrefs: 06441455
$^q, xrefs: 064413A0
$^q, xrefs: 06441430
$^q, xrefs: 06440E52
$^q, xrefs: 06440E02
$^q, xrefs: 06440E84
$^q, xrefs: 06440F86
$^q, xrefs: 06440E78
$^q, xrefs: 064413AC

Memory Dump Source

Source File: 00000003.00000002.1836859885.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: al, publickeytoken=b03f5f7f11d50a3a$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-685739421
Opcode ID: da2debb247d4bff1960b24ff6f5e33007437fdc341f927f4784a190d284af073
Instruction ID: d41340f2f5abb1ca872ba0e872908b7ea7a4de7ae98c3f1b13001da4ae70cdd8
Opcode Fuzzy Hash: da2debb247d4bff1960b24ff6f5e33007437fdc341f927f4784a190d284af073
Instruction Fuzzy Hash: DE22B430B002059FEB45AB69C845A7EBBF6BF89700F14845AE506DB3A6CF35DC52CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B8D450 Relevance: 19.5, Strings: 15, Instructions: 714
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(_^q, xrefs: 06B8D767
(_^q, xrefs: 06B8D8E6
(_^q, xrefs: 06B8D853
$^q, xrefs: 06B8D9AE
(_^q, xrefs: 06B8DA9C
$^q, xrefs: 06B8DDA3
(_^q, xrefs: 06B8D836
(_^q, xrefs: 06B8D74D
(_^q, xrefs: 06B8D8C9
$^q, xrefs: 06B8DA2D
$^q, xrefs: 06B8D7E4
$^q, xrefs: 06B8DCED
$^q, xrefs: 06B8D95C
(_^q, xrefs: 06B8DA7F
$^q, xrefs: 06B8D704

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$(_^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-441867370
Opcode ID: 33a63244ea817e846a0247962dd1fb1ea67a211fbd881d7190d581c7ba479462
Instruction ID: b6d3eaefd538ff472ea4e7fcd1f0d4a601a30408a3f703e40569f7a49b9e0581
Opcode Fuzzy Hash: 33a63244ea817e846a0247962dd1fb1ea67a211fbd881d7190d581c7ba479462
Instruction Fuzzy Hash: 76625070A002089FDB15EFB9D950BAEBBB2FF89304F1045A9D105AB365DB31AE45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06441530 Relevance: 17.0, Strings: 12, Instructions: 1959COMMON

Download Yara Rule

Strings

$^q, xrefs: 064418A4
$^q, xrefs: 06441898
$^q, xrefs: 06441873
$^q, xrefs: 06441A12
$^q, xrefs: 064418E3
$^q, xrefs: 06441A57
$^q, xrefs: 0644182E
$^q, xrefs: 06441928
$^q, xrefs: 06441A7C
$^q, xrefs: 0644194D
$^q, xrefs: 06441A88
$^q, xrefs: 06441959

Memory Dump Source

Source File: 00000003.00000002.1836859885.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-1826369576
Opcode ID: e3d8604fa962dbbb2e6d996b5c57295f0ca405f65e9319b16eebd4cc7ba51693
Instruction ID: d42ba1d9b59d8306ed21e5148a33c1c5176295004b80cb7a95778fe86fefc810
Opcode Fuzzy Hash: e3d8604fa962dbbb2e6d996b5c57295f0ca405f65e9319b16eebd4cc7ba51693
Instruction Fuzzy Hash: 31F2A070B401189FDB55EF68C854AAEBBB6FF88700F10409AE6069B3A1DF71ED46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06B8F680 Relevance: 2.7, Strings: 2, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

c^q, xrefs: 06B8F809
Hbq, xrefs: 06B8F8A4

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID: Hbq$c^q
API String ID: 0-2670449518
Opcode ID: 8ce82b21bbd527a82e616d71b5088fce4d61d44099bbaf66786d545cff2e6802
Instruction ID: 8fcebc87b762b7898027772c641a03dbebc0e02db1979474eceebee7b26e79eb
Opcode Fuzzy Hash: 8ce82b21bbd527a82e616d71b5088fce4d61d44099bbaf66786d545cff2e6802
Instruction Fuzzy Hash: A851C275B00245DFDB45BABAC45037E77EAEBC8740F144469E90ADB385EE24DC06C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 06B8A97F Relevance: 2.7, Strings: 2, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xbq, xrefs: 06B8AA6D
xbq, xrefs: 06B8AA91

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID: xbq$xbq
API String ID: 0-4275011135
Opcode ID: 07dfa93d48eed3dce6ec8fbc31572f89bf47f8ec849d2326434e403e2f99805a
Instruction ID: 85cc0e06e40b15d689c8ae46d5d2b865436f2b451db0f319a03caa201116f756
Opcode Fuzzy Hash: 07dfa93d48eed3dce6ec8fbc31572f89bf47f8ec849d2326434e403e2f99805a
Instruction Fuzzy Hash: 4D618F715452905FC712FF3CD9650EFBBA2EF82304701896AC0828F6A6DE35A94ECBD5

Uniqueness

Uniqueness Score: -1.00%

Function 06B8E191 Relevance: 2.5, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06B8E1BD
$^q, xrefs: 06B8E1C9

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 98ada0a65e927b9d8a8550736ff83e53d037986c2b9139dce9635e31c3aa84cb
Instruction ID: a5f623033a2b730fbbea0eb5484f8b1e66478443d44f84aea78f4307859cd970
Opcode Fuzzy Hash: 98ada0a65e927b9d8a8550736ff83e53d037986c2b9139dce9635e31c3aa84cb
Instruction Fuzzy Hash: DCF02770F043685FE7B9B735D4003567FE4AB49614F0014AEC945CB746EBB5E906CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06440598 Relevance: 1.7, Strings: 1, Instructions: 462
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hlPj, xrefs: 0644059C

Memory Dump Source

Source File: 00000003.00000002.1836859885.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: hlPj
API String ID: 0-2311579558
Opcode ID: dec600ff6b4ec68905197d1fae28f6b325ca9f7b3f33414f396314887e11313b
Instruction ID: eb1de6cb9279a0ab5bd47e17b4aba98b048d44d9cf0d077e352cf3ff6e7e8a42
Opcode Fuzzy Hash: dec600ff6b4ec68905197d1fae28f6b325ca9f7b3f33414f396314887e11313b
Instruction Fuzzy Hash: D502CE30B402188FEB55AF68D855A2E7BB2FF85704F004859D6029F3A1CF76ED1ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 00E6AE30 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00E6B086

Memory Dump Source

Source File: 00000003.00000002.1825926694.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a130bb6f158abb934cb74b0a696b67a8e2b07bde6b09cacd5156fd468945829d
Instruction ID: 23b94055e1f87cb38ed32a05f833381c5f352755f89ee57ffe796c2d8071e322
Opcode Fuzzy Hash: a130bb6f158abb934cb74b0a696b67a8e2b07bde6b09cacd5156fd468945829d
Instruction Fuzzy Hash: B37113B0A00B058FD724DF29E14575ABBF1FB88344F04892DE48AE7A50D775E946CF92

Uniqueness

Uniqueness Score: -1.00%

Function 05000BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05004381

Memory Dump Source

Source File: 00000003.00000002.1835223654.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5000000_RegAsm.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: a01981dd94d69f42a098e8ef31674adac4d7b9a056d86380f17a7320ca00e659
Instruction ID: 9d3230e686fae2bca3d610d31f6b372bcab89665866274097d2f45bed9fbad3b
Opcode Fuzzy Hash: a01981dd94d69f42a098e8ef31674adac4d7b9a056d86380f17a7320ca00e659
Instruction Fuzzy Hash: C64156B4A00309DFDB14CF89D488AAEBBF5FF88314F24D459D519AB360C730A841CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00E64248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00E659F1

Memory Dump Source

Source File: 00000003.00000002.1825926694.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 91699d090532a2cc91493a0642c683ed566e429c75838148036271147e9e536d
Instruction ID: 59220ffdde1b5b4acf03589621b984ca8cc08eb11139433c397717f3f40aa82f
Opcode Fuzzy Hash: 91699d090532a2cc91493a0642c683ed566e429c75838148036271147e9e536d
Instruction Fuzzy Hash: AD41E0B1D00619CBDB24DFA9C884B9DBBB5FF45304F24816AD408BB251DB756986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00E65935 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00E659F1

Memory Dump Source

Source File: 00000003.00000002.1825926694.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8c5c899fd9dcd21e0a9aca0bad57ac21394b3cf3121ac059d38efb1a0b9f5268
Instruction ID: d06000b90ec2a4709cce2a5518ad15a5ded97e13a12f633c2dd4f84a8fb7ab79
Opcode Fuzzy Hash: 8c5c899fd9dcd21e0a9aca0bad57ac21394b3cf3121ac059d38efb1a0b9f5268
Instruction Fuzzy Hash: 7241F0B1D00719CFDB24DFA9C884B9DBBB5BF48304F24816AD408BB251DB756986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00E6C9A0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00E6D2C6,?,?,?,?,?), ref: 00E6D387

Memory Dump Source

Source File: 00000003.00000002.1825926694.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 53c8d768b714d8caaf0e9153f9115c09910a456a2f0004160e2c0b7101917961
Instruction ID: 6a24f7d6ae530b84262c04d9fa3476f45d09e06c36ddedd3c599e1b0da0f9976
Opcode Fuzzy Hash: 53c8d768b714d8caaf0e9153f9115c09910a456a2f0004160e2c0b7101917961
Instruction Fuzzy Hash: 0321E4B5D00258DFDB10CF9AE984ADEBBF4EB48324F14841AE958B7310D374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00E6D2F9 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00E6D2C6,?,?,?,?,?), ref: 00E6D387

Memory Dump Source

Source File: 00000003.00000002.1825926694.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 982cc5cd25677528c3917a024c2d56e20930c151d71fcaf909f696f070944868
Instruction ID: e479842c244e2f859b86e33f1c5abc9bfd27a5c8fcbca4466573bd0a93437178
Opcode Fuzzy Hash: 982cc5cd25677528c3917a024c2d56e20930c151d71fcaf909f696f070944868
Instruction Fuzzy Hash: 4B2103B5D00218DFDB10CFAAE984ADEBBF4EB48324F14801AE958B7310D374A940CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E6A870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00E6B101,00000800,00000000,00000000), ref: 00E6B312

Memory Dump Source

Source File: 00000003.00000002.1825926694.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 975ddba749c52e494ea8a7d1a2b1c2f8b7b8fc6652a2fccddf6cc2874b16b564
Instruction ID: a5f9aecc021ae67b51bd64bf8db5389ae6d02c777ba7faa1dab0f695160fdfe8
Opcode Fuzzy Hash: 975ddba749c52e494ea8a7d1a2b1c2f8b7b8fc6652a2fccddf6cc2874b16b564
Instruction Fuzzy Hash: 811103B69402499FDB10CF9AD444ADEFBF4EB88314F10842AD419B7210C3B5A985CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00E6B2A0 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00E6B101,00000800,00000000,00000000), ref: 00E6B312

Memory Dump Source

Source File: 00000003.00000002.1825926694.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 821dffc5b94d8a809550826a844c02d9bb8d61810ace93985eec0543999ec259
Instruction ID: 642a8221fdee7f98ba7784e2ac483c5c50bfa8c184a494cecd1af59fcea67df9
Opcode Fuzzy Hash: 821dffc5b94d8a809550826a844c02d9bb8d61810ace93985eec0543999ec259
Instruction Fuzzy Hash: BA1112B6900349CFCB10CF9AD444ADEFBF4EB88324F10842AD859A7310C3B5A985CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E6B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00E6B086

Memory Dump Source

Source File: 00000003.00000002.1825926694.0000000000E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e60000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ecd8afc6837172e7f3a109652a23a740cc9685d986cef0693acdfc30683cc4db
Instruction ID: 35f34e9e9833f043639a05c7fe81e9ee1b888e9d02d497a018631658802ecd99
Opcode Fuzzy Hash: ecd8afc6837172e7f3a109652a23a740cc9685d986cef0693acdfc30683cc4db
Instruction Fuzzy Hash: 2B1110B6C00349CFCB20CF9AD444ADEFBF4AB88324F10842AD468B7210D375A585CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06463DE0 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06463F25

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 629def88dc96c629153be400a492b1495628079e7688916e5381d59eb5a6d018
Instruction ID: 440816c233b2b903697191355d741abddcd59775e1221ad7dc8bdf64459c1e93
Opcode Fuzzy Hash: 629def88dc96c629153be400a492b1495628079e7688916e5381d59eb5a6d018
Instruction Fuzzy Hash: 3331E132B002508FC71AAB78E45866E7BE6EFCA350715486AE409CB794DE35EC0787A1

Uniqueness

Uniqueness Score: -1.00%

Function 064684D8 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

4'^q, xrefs: 064685B1

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 9292083360cb9ae41e3634dfceac7606b67204653dc8ff9b939d2710f070b2b4
Instruction ID: eabf630b693124cb43b45f1771fa5de92a4b42a558be6cbcf303081079f79396
Opcode Fuzzy Hash: 9292083360cb9ae41e3634dfceac7606b67204653dc8ff9b939d2710f070b2b4
Instruction Fuzzy Hash: 1E319A31B002088BDB19BB79A49457F77E3EBC8215B504439E60ACB384EE35CD0687E2

Uniqueness

Uniqueness Score: -1.00%

Function 06B8B385 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

sqq, xrefs: 06B8B388

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID: sqq
API String ID: 0-3100640774
Opcode ID: 0d2e68973caf1cd040de1019ddf6ab1570f3f0c380b02fcf5dac0be39601c87b
Instruction ID: 1a6441c090646724abcb41ed9e250d9eda1653c3680c3635f06de87bbddbc16d
Opcode Fuzzy Hash: 0d2e68973caf1cd040de1019ddf6ab1570f3f0c380b02fcf5dac0be39601c87b
Instruction Fuzzy Hash: E531D1B0A0838A8FDB55DF38D8A4A9ABBF5EF49300F1040AAE44497215DB30C944CB61

Uniqueness

Uniqueness Score: -1.00%

Function 064684C8 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

4'^q, xrefs: 064685B1

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: e213ecb3d33f199084efeabd24553e545111fc29e602a4fff3c2ea71dfdff189
Instruction ID: 0a3d3feeae0091a784b4ef5409cc44d4380e29ef2cdd3c44ce6952a9a86770ae
Opcode Fuzzy Hash: e213ecb3d33f199084efeabd24553e545111fc29e602a4fff3c2ea71dfdff189
Instruction Fuzzy Hash: 3F219E307102098FDB19BB78959427F36E3AFC8215754583DD50BDB385EE35CD0687A2

Uniqueness

Uniqueness Score: -1.00%

Function 06B8AC47 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

a^q, xrefs: 06B8ACEE

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID: a^q
API String ID: 0-3411664965
Opcode ID: f93bbeb9705188937f2cb5c999f45b55c60550daf95dffb27929312cfe00683f
Instruction ID: 30fe87b44ae35e01a1dfbd1011cc9a8809152bf995e5ab60f862a25afe4cd5cd
Opcode Fuzzy Hash: f93bbeb9705188937f2cb5c999f45b55c60550daf95dffb27929312cfe00683f
Instruction Fuzzy Hash: B821A2706007009FC355EF6AC944566FBE6EF81300B04CA6ED04A9B666EF70E94ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B8AC58 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

a^q, xrefs: 06B8ACEE

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID: a^q
API String ID: 0-3411664965
Opcode ID: e81d97d9c698d95e4dc0ef87eb28ff326e20bced30371b4a896e0356d67c095b
Instruction ID: b919ee93381352e87b1d5cf5b8b6ff0ff7fffd65b29c93f3ba5ecb40daabe465
Opcode Fuzzy Hash: e81d97d9c698d95e4dc0ef87eb28ff326e20bced30371b4a896e0356d67c095b
Instruction Fuzzy Hash: D5215E70600B049FC354EF6AC94466AFBE6EFC4300B44CA6DD04A9B665EF70E94ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 0646B358 Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0646B399

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: a1e615a835433b1a0a881bd21b427fbed830479a8c90e84733fdcd01a26398c4
Instruction ID: cc5bab4ab3bee3d83b4c197f466f32f1de95cf959e3172e6d4428f046d1f7adc
Opcode Fuzzy Hash: a1e615a835433b1a0a881bd21b427fbed830479a8c90e84733fdcd01a26398c4
Instruction Fuzzy Hash: 2D01D434906249EFCB04FFB8E9944ADBFB1FF45204B1041AAE445D7751DB305E8ADB61

Uniqueness

Uniqueness Score: -1.00%

Function 06B8F8DA Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

LR^q, xrefs: 06B8F8ED

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 2958d51f8e2bee698870b1f0ab4a13b6956ddb2dc43d6864b758dc85f9e9dd43
Instruction ID: c6c9f3731eb63d73926f1ce13d02db6df32dbc92ef494e347f0f5dd166fd736b
Opcode Fuzzy Hash: 2958d51f8e2bee698870b1f0ab4a13b6956ddb2dc43d6864b758dc85f9e9dd43
Instruction Fuzzy Hash: 1E016DB1B00205AFD758EF69D815ABE77FAEFC6311B1480BEE056DB250EA309901CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06463EC8 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06463F25

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 4b3c9aa9b7ceb2b565b0a4c2e9f0f30aac680d626777696c2ec9c4fea7a2beab
Instruction ID: 91487ed6aa24a627afcc0f15b5b94fcdac3b670d35c018d668dc673467eb117b
Opcode Fuzzy Hash: 4b3c9aa9b7ceb2b565b0a4c2e9f0f30aac680d626777696c2ec9c4fea7a2beab
Instruction Fuzzy Hash: 0FF090313402014FC608FB69E454A6F77E7EBC92503505928D15A8B398EF30ED4B87E1

Uniqueness

Uniqueness Score: -1.00%

Function 0646B368 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0646B399

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 0370ec67feec28ae4fcd96995057a1f2bda1eb2954e5e607b811cdab483b5776
Instruction ID: 740a6b17615675f53c74b29d81a715f9ac68e789d1a333477df30d399cf825a0
Opcode Fuzzy Hash: 0370ec67feec28ae4fcd96995057a1f2bda1eb2954e5e607b811cdab483b5776
Instruction Fuzzy Hash: 2AF03C74A01249EFCB04FFB8E59856CBBB2FB44204B1045A9E406D7754DB305A49DB51

Uniqueness

Uniqueness Score: -1.00%

Function 064400D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836859885.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c112472928bd6b2de06587393523cd4e813042645dfbad60d2306f5fa2ae435f
Instruction ID: e1fd8f1f83608b048158e5488803501da69239bfa6d3cebbeff0661184ca37cb
Opcode Fuzzy Hash: c112472928bd6b2de06587393523cd4e813042645dfbad60d2306f5fa2ae435f
Instruction Fuzzy Hash: 094299307406188FDB65AF68D950A2EBBE2FBC5704B01495CD5039F3A1CF76ED0A8B96

Uniqueness

Uniqueness Score: -1.00%

Function 06442070 Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836859885.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6af051d4bb1b0376aa556776e65b3e883b40868c24f13a7ed04db6a0e43a800b
Instruction ID: 6213543b7e6a7bb2aafcc8d18d8f473925fef949d44bb6deb2833937e8133520
Opcode Fuzzy Hash: 6af051d4bb1b0376aa556776e65b3e883b40868c24f13a7ed04db6a0e43a800b
Instruction Fuzzy Hash: 3122A970B401189FDB55AB24C995EAF77B2EFC8704F108499EA065B391CFB1ED828F91

Uniqueness

Uniqueness Score: -1.00%

Function 06440610 Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836859885.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d2f0b2c0fa587f0f269539362ba1483b05214d8ccf053e67f259f34cd529fa4
Instruction ID: 64fa3db9e49a255887099dbc7292922e88599a095b4903d4804d0d24229c9a41
Opcode Fuzzy Hash: 0d2f0b2c0fa587f0f269539362ba1483b05214d8ccf053e67f259f34cd529fa4
Instruction Fuzzy Hash: 5702B130B402048FEB55AF68D955A2E7BA2FF89704F004459E6029F3A1CF76ED5ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 06443B22 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836859885.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ace545221cd550294fdee1d2ca34d3b283cadbdc84c06fd368bb10e293667db
Instruction ID: 26e682c4acf064a5700e1b86405d29995a5706f722ed411a9cfa9b21ff21165b
Opcode Fuzzy Hash: 7ace545221cd550294fdee1d2ca34d3b283cadbdc84c06fd368bb10e293667db
Instruction Fuzzy Hash: 2BF13931B402049FDB45DF69C994EAEBBF6BF88704F1040AAE506DB3A2DA71ED41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06440688 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836859885.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f141065ba6f1004dfcfa85bf57c4cb4eba30b7572bc0156143a40a242142e42
Instruction ID: 7dc3baf1027e8c706eaea9fb0966a897437c4d88c4c32fa98538742324861872
Opcode Fuzzy Hash: 1f141065ba6f1004dfcfa85bf57c4cb4eba30b7572bc0156143a40a242142e42
Instruction Fuzzy Hash: 5AE19330B402048FEB55AF64C955A2E7BA2FF89B04F104459EA029F3A1CF76ED56CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06B8B4B0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2208ef4ddf63dc1c064b9faaab1a987fb1e37dc4755707d8f1bf0ed5974988ca
Instruction ID: 0dba11fbefdc8d1292912c71b2580dc39e9766fb7df9744e6456398ce7af142e
Opcode Fuzzy Hash: 2208ef4ddf63dc1c064b9faaab1a987fb1e37dc4755707d8f1bf0ed5974988ca
Instruction Fuzzy Hash: 6AF11971D1061ACFDB50DF69C950A99F7B1FF88300F15C699E908AB225EB70E985CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06440700 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836859885.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 400f90f49b96b21301c5477c14da6dbb8c9b7552fa06c424e1fd1ed55e6b3fba
Instruction ID: bbeda459110dfedf3a0e71bfca89ee08e3f658f7947ea53e149430b2756afc1c
Opcode Fuzzy Hash: 400f90f49b96b21301c5477c14da6dbb8c9b7552fa06c424e1fd1ed55e6b3fba
Instruction Fuzzy Hash: 01D19530B402048FEB55AB64C955B2A7BA2FF89B04F14845AEA029F3A1CF75DC56CF91

Uniqueness

Uniqueness Score: -1.00%

Function 064400B7 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836859885.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2d0c886b02965783f6ba7158354f88c0941e83508fcff053475f6e073e2d4bd
Instruction ID: e8487b634b20f74ab2dce26c4348524bf60eea38ea0b2711fcd3d6b87bbb375d
Opcode Fuzzy Hash: f2d0c886b02965783f6ba7158354f88c0941e83508fcff053475f6e073e2d4bd
Instruction Fuzzy Hash: ADC19630B40204CFEB45AB64C955B6A7BA6FF89B04F04405AEA02DB3A1CF75DC56CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06464AFF Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54549cacf813d5d292a4bee15e0321af1d38347174b01ed805fcf1509d60fe5d
Instruction ID: 967b3cf07f3dc2c1c826fd971c1cb6ec63927996c132d6996532b9204f42ae55
Opcode Fuzzy Hash: 54549cacf813d5d292a4bee15e0321af1d38347174b01ed805fcf1509d60fe5d
Instruction Fuzzy Hash: 8AC15C34B006058FCB45DF7AD588A6ABBF2FF88300B1581A9E506DB3A5DB30EC45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 06467D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b626bc77e341989aeb0625823c80706015636a753d6b55763fa395898a09d477
Instruction ID: 38660daad8a416ed62e08e4a88ca0434f727b0f1e569c4e6301da8acf5c6da80
Opcode Fuzzy Hash: b626bc77e341989aeb0625823c80706015636a753d6b55763fa395898a09d477
Instruction Fuzzy Hash: 86514BB1E00218CFDB55CFAAD980BDEBBF6AF48314F14852AE415AB354DB749845CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06443328 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836859885.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9164e5d21eafd0033d6ab3e455738c3b0a11f9b68b95529ff161993029717bfa
Instruction ID: 3e6598a609787af2d7384f03b02b71de6468df9c4bd0f704f67adb7596258ddf
Opcode Fuzzy Hash: 9164e5d21eafd0033d6ab3e455738c3b0a11f9b68b95529ff161993029717bfa
Instruction Fuzzy Hash: E1514935B50119AFDB45DF69C88499EBBF2FF88710F15806AE905AB361DB31EC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06467D4C Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb4ee9077677a33c328f5788d42924dfc3bf2478682e13222346070f8783bc8
Instruction ID: c899e272dd506ba3feca0093ce5c7cbf180dad9b73210249e96b14c1ca756bb7
Opcode Fuzzy Hash: 0bb4ee9077677a33c328f5788d42924dfc3bf2478682e13222346070f8783bc8
Instruction Fuzzy Hash: 845159B1E00219CFDB55CFAAD985BDEBBF1AF48304F14852AE415AB344DB749845CF81

Uniqueness

Uniqueness Score: -1.00%

Function 064659C8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cebb69eab30497fed305c9d92fbc6b59d75da804d1c7672d050f7efafeb89b05
Instruction ID: d1bfb064b2671a7d3a0aedad9e6cbaa7b8def6c98b5ef28863c04413216ba8c7
Opcode Fuzzy Hash: cebb69eab30497fed305c9d92fbc6b59d75da804d1c7672d050f7efafeb89b05
Instruction Fuzzy Hash: 70416A35A00606CFCB19CF5AC980DAABBF2FF89310B19C95AE5599B361D730F801CB94

Uniqueness

Uniqueness Score: -1.00%

Function 06443308 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836859885.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3761a36335c7554cea9d1c7ccb5d699f51e5888bce4697d68de4a55d1af7967
Instruction ID: 33150915a5bdaec999c7cc31a4177e51ecec8e02f153c3e891aa47cc22d01e64
Opcode Fuzzy Hash: f3761a36335c7554cea9d1c7ccb5d699f51e5888bce4697d68de4a55d1af7967
Instruction Fuzzy Hash: 9A419E35E102589FDB46DF69C89499EBBB2FF89310B1580A6EC05EB361DB31EC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06465579 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ed268cc4bd57c7afd53b9fa9ce7b3465d58fb74856cbc030bdfdefa224d929
Instruction ID: eb9c4a2c765fde6c7546a77526f2db97821ebd8944232a7e2aad40027d411e04
Opcode Fuzzy Hash: 55ed268cc4bd57c7afd53b9fa9ce7b3465d58fb74856cbc030bdfdefa224d929
Instruction Fuzzy Hash: 6B3139357012109FCB55DF39E88895EBBB2BF99200B108469E905CB3A9DF31ED05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0646F920 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081519ad526c1a5882088613c2ffcd81bb610349265e0bdb361cf481689d3f95
Instruction ID: b98aac258437d13789fa9848e6b94043e4f135cbfa6c50889609735867c0e1c4
Opcode Fuzzy Hash: 081519ad526c1a5882088613c2ffcd81bb610349265e0bdb361cf481689d3f95
Instruction Fuzzy Hash: 013136397093449FCB496F79E81846A3FBBEBC621870004ABF601CB395EE318C09C761

Uniqueness

Uniqueness Score: -1.00%

Function 06465588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9eab810a3f4e65fde5d62daaa376746abcff62d62b363227fa75c50092de0de
Instruction ID: 014e50a5aa573a2687d7c79d4250548edab85a610b4ddc489c76456b09029088
Opcode Fuzzy Hash: b9eab810a3f4e65fde5d62daaa376746abcff62d62b363227fa75c50092de0de
Instruction Fuzzy Hash: D5313835B012109FCB59DF39E88896EBBB2BF89200B508469E9058B3A5DB31ED05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B8AE30 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d110d6d52f4055e7e985c6b5e4baffa5cd678aec7264855b9a985efdaf0ee1e
Instruction ID: d088e2b9c69ab0945b0ee3f01f5059f13d80f315e4c4206af94be0a0a528cc55
Opcode Fuzzy Hash: 6d110d6d52f4055e7e985c6b5e4baffa5cd678aec7264855b9a985efdaf0ee1e
Instruction Fuzzy Hash: 6B31B6716046009FD718FF66D884A6A73A3FBC4715F104E29D11A4B7A4DF70E8C9CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 064687A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0854fd487c2f664019f89b86a29a392e83874f5899f7e366b3536a65af2bbead
Instruction ID: db5a5a1dcec194713fafd1b63de536ddde7d5353daba83553b1b7563c96be838
Opcode Fuzzy Hash: 0854fd487c2f664019f89b86a29a392e83874f5899f7e366b3536a65af2bbead
Instruction Fuzzy Hash: 2241F2B1D01248DFDB54DFAAD990ADEFBF6AF88310F24802AE415B7250DB34A945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06441514 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836859885.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccddeb925129cd3fee3d855508dfaf42973b78114130a9af040be59ea3ef3633
Instruction ID: 03cbaf02039e5bbf92e4652afb7caa0640f7855b3d9eea0a58dac9bbbf1e76e7
Opcode Fuzzy Hash: ccddeb925129cd3fee3d855508dfaf42973b78114130a9af040be59ea3ef3633
Instruction Fuzzy Hash: C831CF30B042489FDB41AF68CC459BEBBF6EF85210B14416AE522D73A2DA30DC06CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06468796 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b263c53131725824454964bc6b0b0f3393c554fde654e8adeb5159b708f2e35d
Instruction ID: ea207ace1359a5d0595f97fca33097f3de4c457b396d806be8ea5f152045d057
Opcode Fuzzy Hash: b263c53131725824454964bc6b0b0f3393c554fde654e8adeb5159b708f2e35d
Instruction Fuzzy Hash: D431F2B1D012489FDB58CFAAD995ADEBFF5AF88300F14802AE415B7250DB349945CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0644360B Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836859885.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0fbc16c11a426c11850498de4fa2bc79c832ef2beeece3a8f766f467658ad22
Instruction ID: be9e4158cbf5cf9aed01bacaf1a7065840629fa145ec960e7601d850d93e09fa
Opcode Fuzzy Hash: f0fbc16c11a426c11850498de4fa2bc79c832ef2beeece3a8f766f467658ad22
Instruction Fuzzy Hash: 64215C35B400049FDB54EF69C894DAABBB2FF88714F1180A9EA099B3A5DA31EC05CB10

Uniqueness

Uniqueness Score: -1.00%

Function 06468A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a16862d84cbd0bc6319919272652c12aedcef32594c5e006e88f4edfcdbdc329
Instruction ID: 78662cbc1bccb4219ed81695717ba702ab40de0d26a32e589fdd7fddae7792b3
Opcode Fuzzy Hash: a16862d84cbd0bc6319919272652c12aedcef32594c5e006e88f4edfcdbdc329
Instruction Fuzzy Hash: B53112B1D0125CDFCB14CFAAD890BDEBBF5AF48310F24842AE405B7240CB74A845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DED3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1825689440.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ded000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6af4c458d9b3f145ca6a9f170ae6c95976af000ddf9b709d6138657f3fa7337
Instruction ID: ee5a0e8858bced8fdfcfac5d4e84b782a2c5873b58a1787bdd15ca9002e46309
Opcode Fuzzy Hash: b6af4c458d9b3f145ca6a9f170ae6c95976af000ddf9b709d6138657f3fa7337
Instruction Fuzzy Hash: 16216A71100284DFCB01EF04C9C0B16BFA6FBA4314F24C169D8094F296C736E846C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00DED4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1825689440.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ded000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1bf12b593b1aed1d154fd55d06ec812aed3df4afe385a0ec62e07913131d6c4
Instruction ID: 0aa3c0fb3d60bcfe72620dc0e9ac21c7e6c40ee264fa6e006de429a87faec9fc
Opcode Fuzzy Hash: a1bf12b593b1aed1d154fd55d06ec812aed3df4afe385a0ec62e07913131d6c4
Instruction Fuzzy Hash: AD213771504280DFCB05EF15D9C0B2BBF66FB94318F24C569D8494B256C736D856CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 06B8FF20 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a09022bae460c983903cc1e077ae70a2c3094da12dd9ee963288bbf20be48363
Instruction ID: c28e84d6b66842f55c3fa8fae60fcf76776e46051464077754d77450179dddd5
Opcode Fuzzy Hash: a09022bae460c983903cc1e077ae70a2c3094da12dd9ee963288bbf20be48363
Instruction Fuzzy Hash: 0A216076E012188FDB14EFA5E4486EDFBF5EF49351F1091AAE805B3250CB354A45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06B8BB61 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5702e0bbb06274680b0bc4be154adf2167f53a67d6e93b852646820e72b04b8
Instruction ID: acd246b9aac0f7e54c2193d0089d636ef0b9e37367ea141d06b7aa96294e9651
Opcode Fuzzy Hash: c5702e0bbb06274680b0bc4be154adf2167f53a67d6e93b852646820e72b04b8
Instruction Fuzzy Hash: 2C11E6B1B042295BDB26373A58101BEBAEAEBC9654F0400BAD506E7385DF70CD06C7F1

Uniqueness

Uniqueness Score: -1.00%

Function 06441068 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836859885.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca5a893c9400a603d625a21fec4d4c4a923c8322dd681a726a8dbc5548ed3961
Instruction ID: 840207095ac09bafd232aaf8224c01ad6d7713abde603f05e28deab7b19fe673
Opcode Fuzzy Hash: ca5a893c9400a603d625a21fec4d4c4a923c8322dd681a726a8dbc5548ed3961
Instruction Fuzzy Hash: 1B21F5307001049FDB45AB69DD4597EBBEAFFC8220B15856AE425873A6CF30CC51C791

Uniqueness

Uniqueness Score: -1.00%

Function 00DFD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1825729749.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dfd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fb44c580e1d83aee1a549d4458a75c6fc9c88dcd0a47d576c842619a02407f8
Instruction ID: 110a07c35a8d12a421aa71de7c0e963330d8580520c4e2d1217a76bd7509d175
Opcode Fuzzy Hash: 5fb44c580e1d83aee1a549d4458a75c6fc9c88dcd0a47d576c842619a02407f8
Instruction Fuzzy Hash: B2212271604248DFCB14DF14D984B26BBA3EB84314F24C569EA494B256CB3AD847CA71

Uniqueness

Uniqueness Score: -1.00%

Function 06B8B021 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b326da6c4142ea0c9d4f14fcc24cab7f2fc70ba52e1ce847886e6a370c08a990
Instruction ID: a57a0e5b93e59f4323c554bd0caf1f4b00200350aebfc7eac99267bbac2176df
Opcode Fuzzy Hash: b326da6c4142ea0c9d4f14fcc24cab7f2fc70ba52e1ce847886e6a370c08a990
Instruction Fuzzy Hash: 8D21C2B2C04B858BCB119F69D8003CAFBF0BF96300F14874ED19867651D7B5A595CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0646549F Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a951c90f5205978245e84dd4cec00c6c3f47963177f4c620e62471ecd5aedaa
Instruction ID: f736b18bc49cd32b64a433216de42b5365b7e2c15956352c9b294c965c9ed076
Opcode Fuzzy Hash: 8a951c90f5205978245e84dd4cec00c6c3f47963177f4c620e62471ecd5aedaa
Instruction Fuzzy Hash: B6113D31A083818FC76BCA7A654856B7FF2AF81201308849FF040C36AAD571D846C752

Uniqueness

Uniqueness Score: -1.00%

Function 06468A8C Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b697aab9107d2baef70435507cf18499ef47a3b93ea38e085e2c52609b08350
Instruction ID: 5afe369c3ff247dc3f3d46283df783f6092fe05e24a5f65ff97bea58607e9bde
Opcode Fuzzy Hash: 8b697aab9107d2baef70435507cf18499ef47a3b93ea38e085e2c52609b08350
Instruction Fuzzy Hash: 052127B1D00258DFDB14CFAAC994BDEBFF5AF08310F24842AE045B7240DB749845CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00DFD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1825729749.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dfd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 391a25452de55e9684cea63d159981b4f5af38bce48a82f86caba01e778ef6f2
Instruction ID: b4462ed75e16d5a0d045aa136fd0f6ba1104de2864b1ac5b3550048af8bb7f0c
Opcode Fuzzy Hash: 391a25452de55e9684cea63d159981b4f5af38bce48a82f86caba01e778ef6f2
Instruction Fuzzy Hash: B5218E755093C48FCB02CF24D994715BF72EB46314F29C5EAD9498F6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0646BC5F Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a78adcdf1b8b76f9a3e5d46892be88bb3b2115f59578911244ce713cd128ef
Instruction ID: 5bf7aba5e8d3f7748d687486a756dcd2936818b9dee7f2cf6efa83d6e276e63d
Opcode Fuzzy Hash: 81a78adcdf1b8b76f9a3e5d46892be88bb3b2115f59578911244ce713cd128ef
Instruction Fuzzy Hash: 6811E5312112045FC685B739EC2887EBBA7EEC22507494829E207CBBD6CD21A94A87B5

Uniqueness

Uniqueness Score: -1.00%

Function 06468C58 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bb3a1d25199f76b69b55b4a6775408168e87648582a7eba54a9adbcab904c92
Instruction ID: e4902a88fe0602cfec7f0e4bda4a5757aa005a62ac9342716aa61edcc7cb882c
Opcode Fuzzy Hash: 6bb3a1d25199f76b69b55b4a6775408168e87648582a7eba54a9adbcab904c92
Instruction Fuzzy Hash: C421B0B5E052189FCB48DFA9E848ADDBBB5FF8C310F10912AE805B3360EB741945CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00DED3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1825689440.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ded000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction ID: 2bf6f6aa3ff0275e4a701f24dbd3e8eb92325cbc53ae452fa22f1efbe44d99dc
Opcode Fuzzy Hash: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction Fuzzy Hash: 5C112976404280CFCB01DF00D5C4B16BF72FBA4314F28C6A9DC090B656C33AD456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DED4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1825689440.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ded000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction ID: 1fb2d18efbd828e5bc37e73e846a3babcc1cf1bba14404ad0cc0b9fc7d1f4674
Opcode Fuzzy Hash: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction Fuzzy Hash: 1111E676504280CFCB16DF14D9C4B16BF72FB94318F28C6AADC494B656C336D85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0646C499 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e04ea366cf4b260afabc8d7bf7ce31d472f40628acd1c8ce12a08914c0cb9e35
Instruction ID: ef2638f2d90f8a31ae11f3e9b3522ef5d3162ed2c3d4e23cf695368228badad6
Opcode Fuzzy Hash: e04ea366cf4b260afabc8d7bf7ce31d472f40628acd1c8ce12a08914c0cb9e35
Instruction Fuzzy Hash: C90104302042458FD325AF75E50866A7BE3EFC5315B108A6AE14687785CF75990E8BA1

Uniqueness

Uniqueness Score: -1.00%

Function 06468350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9504f2dd392dd8537db5d4da1b095666fb104b57bfc183026bcfb0cecb1f28e0
Instruction ID: 097e5abe09160e44661c476db8d2af86db351e2f7a4284cd407754697c1b0446
Opcode Fuzzy Hash: 9504f2dd392dd8537db5d4da1b095666fb104b57bfc183026bcfb0cecb1f28e0
Instruction Fuzzy Hash: DA017171B1021D9FDF10DAA9AC45ABFBBAAEB84251B14403AF614D3240DF31991587A1

Uniqueness

Uniqueness Score: -1.00%

Function 0646BC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e430c829c187e0672b91b20500c8270745ab7a5e332d70fec4d56621f8419b76
Instruction ID: eb0248647e9de23f808f95749a1e270153ffd5b16ed73b8b8bb291ca1e968bb9
Opcode Fuzzy Hash: e430c829c187e0672b91b20500c8270745ab7a5e332d70fec4d56621f8419b76
Instruction Fuzzy Hash: AA01B1312101014F8684BB39E96853EBBE3FEC13507494828E207CB7D6DE70BD8E87A5

Uniqueness

Uniqueness Score: -1.00%

Function 06B8AF90 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc1a02ec24c2a99e284a506c3f4687ed403b3da9f9574662ef0a59f126a3bb00
Instruction ID: f3d640dfb28e1c59327bd73f4f63ca9e23317f633609ea1122a745b9cfe50f04
Opcode Fuzzy Hash: cc1a02ec24c2a99e284a506c3f4687ed403b3da9f9574662ef0a59f126a3bb00
Instruction Fuzzy Hash: 1611FEB5C00649DFCB20DFAAD944ACEFBF0EB49324F10846AD558A3210D378A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0646E8B0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8761193045fadba9fe11b1260c3ff1fc6e67ee948e4aab3d1c8690477da7139b
Instruction ID: ce496df741449fe7431cf57265e7b2ca1564a9acde4629d28db54319cd956dbe
Opcode Fuzzy Hash: 8761193045fadba9fe11b1260c3ff1fc6e67ee948e4aab3d1c8690477da7139b
Instruction Fuzzy Hash: 7A01D634609348AFCB02DF79DC148AA7FBAEF86200B1484E9E501CB362DA32DD15D792

Uniqueness

Uniqueness Score: -1.00%

Function 00DEDA25 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1825689440.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ded000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abb3f1c0dc4e38ea1daec8b5c5e608cfb5f1b3982ed684f1849b223f854a1bcb
Instruction ID: 6873ad4f964ad9a02ad87760441c0a1e4df45ecce1baec51edbf1421e5171e83
Opcode Fuzzy Hash: abb3f1c0dc4e38ea1daec8b5c5e608cfb5f1b3982ed684f1849b223f854a1bcb
Instruction Fuzzy Hash: 11012B7100C3849AE710AF17CD84767BF99DF61324F2CC43AED484B145CA78D940C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 06466E90 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae41a830f2722eec162030dbb3dd48951bbb66217dfd0dc648d91a3573bee0c
Instruction ID: a1c12982aa6681d04b0b1cb73ac3a7b73d8de01ad5e5a7e68e59f49e206ae4ec
Opcode Fuzzy Hash: aae41a830f2722eec162030dbb3dd48951bbb66217dfd0dc648d91a3573bee0c
Instruction Fuzzy Hash: 91F028671041D86FCB518EABAC14EFB3FEDDB8D151B084056FE94C2281C439C921D774

Uniqueness

Uniqueness Score: -1.00%

Function 06B8A778 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfecd74dcf413d14fe5f83a128d30c674a830ebdf8f229f5fe288e72d1814e37
Instruction ID: 6dc4e3cd0c7713f81b4427aea6d1ce3dd647100852ce61b3b9b524523a108a55
Opcode Fuzzy Hash: bfecd74dcf413d14fe5f83a128d30c674a830ebdf8f229f5fe288e72d1814e37
Instruction Fuzzy Hash: CE1100B5C04689CFCB20DF9AD984BDEFBF4EB48324F14846AD868A7210D374A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0646C4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ec76ec0055f4afee458a0cf8cf91eb7580efb2f5c1f56c5dfc73e711f41ed16
Instruction ID: e3abb192d003be7323f1c3966ca953e89a0be1f0647824ea8da06cdaf98dd018
Opcode Fuzzy Hash: 3ec76ec0055f4afee458a0cf8cf91eb7580efb2f5c1f56c5dfc73e711f41ed16
Instruction Fuzzy Hash: 17015E30200605CFD325BF75D54866A7BE3FBC9315B508A29D15A87784CF75A90A8BA1

Uniqueness

Uniqueness Score: -1.00%

Function 06465508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87fbc93a3da9d7b69797f8e78b3d153ead4aebbc2b840ad943d05c1a9b18cc53
Instruction ID: e2384a516476ee3ab61d984ef195fe27760b39ddc52b0d342ccb6526639c4404
Opcode Fuzzy Hash: 87fbc93a3da9d7b69797f8e78b3d153ead4aebbc2b840ad943d05c1a9b18cc53
Instruction Fuzzy Hash: C1016D30A11712CFDBAE9A3AA508527B7E7BF84205754883AF40686658EA71E485CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0646C170 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea93dc56c8ffde37bcfb329375b8ec438d44eebb3ebf28434bdadb60bcd2cee0
Instruction ID: d276739d75628859d0adac0f4fab7a251fbc22f964705fc3f267445e85676c1f
Opcode Fuzzy Hash: ea93dc56c8ffde37bcfb329375b8ec438d44eebb3ebf28434bdadb60bcd2cee0
Instruction Fuzzy Hash: A301D135102B04AFD325EF66E808462BFFAFF89314700861AE48AC3A11CB31A54ECF94

Uniqueness

Uniqueness Score: -1.00%

Function 06B8BA9A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03bb632786ba6f530eed04a7f7eead348b2a0fc73c8f145e1fda6acf8796ab6
Instruction ID: 891b15940b05ab83a1e2632a253c2635dbda28c8f033764c464f5ecf6c61d1ea
Opcode Fuzzy Hash: e03bb632786ba6f530eed04a7f7eead348b2a0fc73c8f145e1fda6acf8796ab6
Instruction Fuzzy Hash: 21F024723402446FC700B6BDF4115AA7BEAEBC67943054066E101CB389EE62DC0B87F2

Uniqueness

Uniqueness Score: -1.00%

Function 06468F42 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf3a15d78c3efed4885508e41a964165cfce5f92fe51c14361f421c23c533678
Instruction ID: fa570d1be9688dfe737385ff9b9e9ee4c0b4b6bb5154e9e591b46bc81756eb15
Opcode Fuzzy Hash: cf3a15d78c3efed4885508e41a964165cfce5f92fe51c14361f421c23c533678
Instruction Fuzzy Hash: C50116B4D0420ADFCB44DFA8E9447AEBBF1FB08300F1081AAE815A3340D7341A51CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0646ADE9 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5172554123e785095016a94028bc5a52340bbf92e8597b892d7c72a89131a51
Instruction ID: b529313829d273f1bf57513457d9cea3901ac43fecf1ee935c08de72ef3f7a42
Opcode Fuzzy Hash: a5172554123e785095016a94028bc5a52340bbf92e8597b892d7c72a89131a51
Instruction Fuzzy Hash: 59F0E9312491406FC3407B6EA859AEF7FDAEBCB268B0540A9F10EC3243CA25184843B5

Uniqueness

Uniqueness Score: -1.00%

Function 06468F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f9959bff14cc99847aa017ad18405a5e5b17c477be26a81bb1382ad01e909b9
Instruction ID: 9f1b81adf461bab83408e57e7ff9858c2b55ba3ec28c240819786168981c4a5f
Opcode Fuzzy Hash: 4f9959bff14cc99847aa017ad18405a5e5b17c477be26a81bb1382ad01e909b9
Instruction Fuzzy Hash: 6D01D6B4D0420ADFCB44DFA9D9446AEBBF2FB48301F1080AAE415A3350E7740A55CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0646ACB8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d51261a278419e6d9d9fc940c089bf5b27f599ee9ab2ffcaa86df07329ae0f07
Instruction ID: 9bc19eef7bddb4a238cab9df25f5de81599b8cb771190e3f9e0091930252f108
Opcode Fuzzy Hash: d51261a278419e6d9d9fc940c089bf5b27f599ee9ab2ffcaa86df07329ae0f07
Instruction Fuzzy Hash: 09F09E713091A41FC35217396C190BE3FA5E8C329530400DFF143C7296CA048507C3F6

Uniqueness

Uniqueness Score: -1.00%

Function 06B8FF30 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c2c0dc2effe3fbff8993d58de8db2157d9021e28d343112def9b39b0a4ec30c
Instruction ID: fc138cb1c554d8f95845abd341e5acf79bcdc95b12feb267017d6ba105815297
Opcode Fuzzy Hash: 4c2c0dc2effe3fbff8993d58de8db2157d9021e28d343112def9b39b0a4ec30c
Instruction Fuzzy Hash: 23F01474E002188FCF04DFAAE804AEDBBF5EB8D310F00906AE404B3350CB345904CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00DEDA24 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1825689440.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ded000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3bea76fa37602824df6e038ea034bcddf2161cf00938c4a617820aa110dd728
Instruction ID: 8f48ca8ab81e233a10d4782623be136f770033822dc2ca82f34cc581379dce36
Opcode Fuzzy Hash: f3bea76fa37602824df6e038ea034bcddf2161cf00938c4a617820aa110dd728
Instruction Fuzzy Hash: 91F0F6710083849EE7108E16DCC8B62FFA8EF50734F2CC45AED084F286C6789C40CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0646C110 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c65ccffdf76aa8d6389099d9c90a54df0cfcdbb9f3d47e0bc1d7d2fc34042441
Instruction ID: 0cd7bd90b5e5a03fbe4dd261ef628ca2e64585fd0f298ce6992b949cf19fca1a
Opcode Fuzzy Hash: c65ccffdf76aa8d6389099d9c90a54df0cfcdbb9f3d47e0bc1d7d2fc34042441
Instruction Fuzzy Hash: 5EF0F6312457E45FC322A729E9186AB7FE6DF82208B0804AAE182CB652CA61594987E1

Uniqueness

Uniqueness Score: -1.00%

Function 06466EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dff7b291cc60777111d7e6be58e4cefcf81b6fa8a04a518c776329adac22f11
Instruction ID: 7aa3157d1b72bf6fa046e8ae5835bd97233a0e971c5c69f4a9a9ae4cb7c0d9c8
Opcode Fuzzy Hash: 1dff7b291cc60777111d7e6be58e4cefcf81b6fa8a04a518c776329adac22f11
Instruction Fuzzy Hash: 0DF0A7722041E83F8B118E9B5C14CFF3FEDDE8E1617084156FED8C2141C429C921ABB0

Uniqueness

Uniqueness Score: -1.00%

Function 0646FF50 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51c4365da8da44918ecc706a0e29475b3655c7628d00454d3b882c9f00c0323a
Instruction ID: c83f814de9e5be83da0c69ef66f40c70848b853b3a8586afb2f0c96b26944c7d
Opcode Fuzzy Hash: 51c4365da8da44918ecc706a0e29475b3655c7628d00454d3b882c9f00c0323a
Instruction Fuzzy Hash: EBF0E2717042545FD3049B6E9C54DA7FFEEEFC962071580ABE184C7362CA70AC0487B8

Uniqueness

Uniqueness Score: -1.00%

Function 06B8AE21 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1629f00c1ea665c81355c8532c82212e227cbf3d2f47e1cbfe2694490a035491
Instruction ID: 52d47ca1b94308dd80bc116211afeee812a3818688174cce3c7d9418609c1d08
Opcode Fuzzy Hash: 1629f00c1ea665c81355c8532c82212e227cbf3d2f47e1cbfe2694490a035491
Instruction Fuzzy Hash: 32F0A7F1519754EEE3A06A12DC40463BBE9EB47A36B200DABD04A83460C575A8C5C3A5

Uniqueness

Uniqueness Score: -1.00%

Function 064667C8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bdc260a4235052a975a22fd3384890f1b0430c834bf39c1f781c366761017b2
Instruction ID: 402e8cf9fd9ed27fe90749f6067ebd05d4715e9e7656f3ea36dbd58bbd0de165
Opcode Fuzzy Hash: 8bdc260a4235052a975a22fd3384890f1b0430c834bf39c1f781c366761017b2
Instruction Fuzzy Hash: 6CF0F031B003009FC7218A69E805F527FE9EF82710F158266F210CB2E6DBB1E809C781

Uniqueness

Uniqueness Score: -1.00%

Function 06468FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d507842a822015487ad07052357adc76499ccbfba3c8198664632b18b4cf1fdf
Instruction ID: 42d34b2a72e156cf0eaa9a993318ebc81131c6e870d0010b295ae12c70877078
Opcode Fuzzy Hash: d507842a822015487ad07052357adc76499ccbfba3c8198664632b18b4cf1fdf
Instruction Fuzzy Hash: B5F0CDB4C08259DFDB40CFA1D8051AEBFB1FB5A201F0041D7E406E7351E2398A12CB61

Uniqueness

Uniqueness Score: -1.00%

Function 06B8BB0A Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e21eb7bb53effc481ca2a0dc8656ae31216690130564b414e4bff8e6ff4eee79
Instruction ID: 29d4dbab2854363c394494dba7f946cae3a0ef70d2d53e8ec821f4d35ebe58e4
Opcode Fuzzy Hash: e21eb7bb53effc481ca2a0dc8656ae31216690130564b414e4bff8e6ff4eee79
Instruction Fuzzy Hash: 28F0A071A05214AFDB00DBACE450BAEBFF9FB45264F0140ABE509C7244DB79AC41CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 06468341 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bae9f2b999da5f79897c521a35be57f3eedbe1a6a62b16fcb41c4774ba7dbf51
Instruction ID: 15077dc49cbd3f270bcf738b019e9e8cece8f6a2d150da6ea989c027b5efe019
Opcode Fuzzy Hash: bae9f2b999da5f79897c521a35be57f3eedbe1a6a62b16fcb41c4774ba7dbf51
Instruction Fuzzy Hash: 6BF0A772F1011D5F8F11EA6AAC489BF7BB9EB852617080037F614C3200EB30981587A1

Uniqueness

Uniqueness Score: -1.00%

Function 06B8AD30 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4dc23efd4973ecb052528b7d5cf4e56d3c6f3a1112232a7723339ea16e7f9dd
Instruction ID: ea4d47d9b047242cdbd29b5c58d66424d1d0dcdc103cb8efcc4c20370e62cbd6
Opcode Fuzzy Hash: d4dc23efd4973ecb052528b7d5cf4e56d3c6f3a1112232a7723339ea16e7f9dd
Instruction Fuzzy Hash: 8EF01CB1A00215EFCB80EBBDD50569EB7F4EF4A254B5040A6E95AD7350EB309A11CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 064654F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 761edd23d2f7c059490962d5b114e5b6491c4a8b1de97bfd2e3e0882d438fcc7
Instruction ID: c3b777e79a9f326f2c6d7834e39e180ed803ea49406344b68737ab369aecebde
Opcode Fuzzy Hash: 761edd23d2f7c059490962d5b114e5b6491c4a8b1de97bfd2e3e0882d438fcc7
Instruction Fuzzy Hash: 4EF0B4315007418FDBA9CE62E508767BBB2AF80315F48896EE04646A69DA75E589CB40

Uniqueness

Uniqueness Score: -1.00%

Function 06B8F67A Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e56334d51c19f4f34ca494a4fed93a3538ebde8c32ba10155ceaf81da9c080a
Instruction ID: c2d1ed06560a71e583dc5bb83521c47ea8804f5a8c5a30bcc3811a5d22dd8d7c
Opcode Fuzzy Hash: 9e56334d51c19f4f34ca494a4fed93a3538ebde8c32ba10155ceaf81da9c080a
Instruction Fuzzy Hash: F3E0683BB00214BFDB696175EC045DEB3EDE789390F800675EA02E7300EA319806C3D1

Uniqueness

Uniqueness Score: -1.00%

Function 06B8BAA8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13bf130ff85f7ae14ac9ca2035e20b2163de5c2991fcfaa721a6c5c18b1b6dda
Instruction ID: 06d5ee9c7a6d74fe7f9fcd039c6dabb3597b1e364d73d22e3bb402e7a624c9c0
Opcode Fuzzy Hash: 13bf130ff85f7ae14ac9ca2035e20b2163de5c2991fcfaa721a6c5c18b1b6dda
Instruction Fuzzy Hash: D3F0A0323801045FC600FAADE41566E77EAEBC9A957144466E105C7388EEA6DC0B87A2

Uniqueness

Uniqueness Score: -1.00%

Function 0646FF60 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6eb475d9cd5a032096b753a52e967c6cbf479b58a36d2c638a625630de19cef
Instruction ID: 112c48cb55ab7ed4014df003e9485a8fc23f250528cfce35b544c1c57e04834f
Opcode Fuzzy Hash: e6eb475d9cd5a032096b753a52e967c6cbf479b58a36d2c638a625630de19cef
Instruction Fuzzy Hash: 53E065717001145FD3049A5E9C84E6BFBEEEFC9620B11407AF544D7351CA70AC0086A4

Uniqueness

Uniqueness Score: -1.00%

Function 06B8FD78 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48efcc39aeeb5e208367a4808ccab5c5aa1a15e4413e61cb373d89f0b1ec87f8
Instruction ID: 55917de8226277f70c2e355c63dce3abcbacb0fd4cac15acd19905cca48fc0d1
Opcode Fuzzy Hash: 48efcc39aeeb5e208367a4808ccab5c5aa1a15e4413e61cb373d89f0b1ec87f8
Instruction Fuzzy Hash: F5F0EC725891805FD326AB59D864A791F5ADFC635071954AFD00CCF267C8148995C371

Uniqueness

Uniqueness Score: -1.00%

Function 0646ADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4cf4558ab1e2cd7cd972ebaf447bf3d5b0099aded523c3e4084085545e64776
Instruction ID: a6cb40aaadbbb940de3374a0d6918e2eceb304a317c1a9c300e0a86984bbf16a
Opcode Fuzzy Hash: c4cf4558ab1e2cd7cd972ebaf447bf3d5b0099aded523c3e4084085545e64776
Instruction Fuzzy Hash: FAE092312441006FC7547B5EA848AAFBADAEBC9369B00406CF20EC3286DA65580947B5

Uniqueness

Uniqueness Score: -1.00%

Function 06B8D3F0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f26d090b53b75fdf63fafb6725f7f823e786a9c2f9d86af2cd4ac7796c4db93c
Instruction ID: 968a3b36b08aa603cba18a242d46ca40d9acb68ca2dcde37585bc535aa656b8c
Opcode Fuzzy Hash: f26d090b53b75fdf63fafb6725f7f823e786a9c2f9d86af2cd4ac7796c4db93c
Instruction Fuzzy Hash: 82E068F4B043006FE3757724A4107EB27A59F8A310B0B3083D405EB2C4FA108C82C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0646C180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a19ad4d4edc824b4998e2c6544468cd66af76091fd0bb913e78a3f68d75a8be
Instruction ID: e8cdf013e77d7da5624507dcb3689f1483f23b9d52a9d3415aca9a0bbb0c7a4d
Opcode Fuzzy Hash: 8a19ad4d4edc824b4998e2c6544468cd66af76091fd0bb913e78a3f68d75a8be
Instruction Fuzzy Hash: B0F06D75501B018FD725DF66E508512BBF6FB88304B00C62EE58B83A10DB70A50ADF84

Uniqueness

Uniqueness Score: -1.00%

Function 0646CC38 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0864dbb17dab0210ad809cdb692c23a74abbeeaea95eb687db01e3cd1f4b5a50
Instruction ID: a6682a8c73250668c0f6a459e7d3d86990b39f547dd72c6ff8fe6d3f22e8fe72
Opcode Fuzzy Hash: 0864dbb17dab0210ad809cdb692c23a74abbeeaea95eb687db01e3cd1f4b5a50
Instruction Fuzzy Hash: 9EE026322022505FC712FB66FC00AEA3F61DB83621B014263F100C7B6ACA31094F8BF6

Uniqueness

Uniqueness Score: -1.00%

Function 0646B500 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a10233bf854da351e148bcfb92fa79b24cc4f1c46669f6a2a25a1de9efe2e2fb
Instruction ID: d2e8383d5b1b75dcff2e18c7d5ab1d98cfd6771ad217489d48c5a557d5fb21e4
Opcode Fuzzy Hash: a10233bf854da351e148bcfb92fa79b24cc4f1c46669f6a2a25a1de9efe2e2fb
Instruction Fuzzy Hash: A9F01535D0120CEFCB11DFB5E9489CEBFB9EB84200F1042A6E805E2284EA305B49DB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B8BB18 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d26160fbb761dd9e9af8acdc21694af0e687a061ba6c28f16e7e720f0ef90246
Instruction ID: 8c463db42a2154e8db3eb513294aa58dd27117c3fdd2c2a1c422b7b65b9269d1
Opcode Fuzzy Hash: d26160fbb761dd9e9af8acdc21694af0e687a061ba6c28f16e7e720f0ef90246
Instruction Fuzzy Hash: 70E0ED316001149FDB14DAACE444B9EBBFAEB44665F004059E509C7248DB75E9418795

Uniqueness

Uniqueness Score: -1.00%

Function 06B8E948 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d037393097b3139d046b2be45000e722c51b8b1b5e54fc1ed428081e6fe05c6c
Instruction ID: f2d9ce66c491f9db353d725b54e87eb1870a8af6b483b1dfc69c7ccfccff9b07
Opcode Fuzzy Hash: d037393097b3139d046b2be45000e722c51b8b1b5e54fc1ed428081e6fe05c6c
Instruction Fuzzy Hash: 19E0D8F66083609FD6E5B628580057617968F8920070534C394449B2E6D9A1EC43D671

Uniqueness

Uniqueness Score: -1.00%

Function 0646C120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd3658a88a4cb120be49786c1cd8cb60c798b6ced2ef2e3c641f99715fa21c3
Instruction ID: e61bc7ccd04063770ce27301655f38747961f89fe1c4be254613fa588519a690
Opcode Fuzzy Hash: 5fd3658a88a4cb120be49786c1cd8cb60c798b6ced2ef2e3c641f99715fa21c3
Instruction Fuzzy Hash: EDE03031200B518FC621A72DE6087AE7BE6DB95319F040529E246C7755CBA1A80987A5

Uniqueness

Uniqueness Score: -1.00%

Function 0646CE88 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcad70240d5c6037534c06ecff2b4e3c0d80f526a6cd0326ed3703a2ee9521a5
Instruction ID: a9ef4ef64784e25c36839cd99d05a112db85615df8a58845abdee9ae493797e5
Opcode Fuzzy Hash: dcad70240d5c6037534c06ecff2b4e3c0d80f526a6cd0326ed3703a2ee9521a5
Instruction Fuzzy Hash: 4BE020701073D0BFD712B764F4459AA3FB5DB4221070542A6F84087A6DC6304D87C3F5

Uniqueness

Uniqueness Score: -1.00%

Function 06B8AD40 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 356dc265984558a210e8104bf847643ef1b651228acc0209aa6904b15e4e042d
Instruction ID: e746220ce22a3ff903526f46a09b49282667ed357835e3815922d2fc874a6b8c
Opcode Fuzzy Hash: 356dc265984558a210e8104bf847643ef1b651228acc0209aa6904b15e4e042d
Instruction Fuzzy Hash: F0E0EDB1E001199FC780EBBC950559E77F4EF48251B5040A5D55AD7351EA309A108BE1

Uniqueness

Uniqueness Score: -1.00%

Function 06465698 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40dde029ac338a799a27772b9b18c68b7dcfcf2510aefb79ed5879fb387c4fd3
Instruction ID: 3f5d49b15440a6ee7847102352f90c27ffd48f6a5cfae29ba41b8ea74dde5f13
Opcode Fuzzy Hash: 40dde029ac338a799a27772b9b18c68b7dcfcf2510aefb79ed5879fb387c4fd3
Instruction Fuzzy Hash: B6E092B210C3009FE345DF24E84589B7BE4EF91321B01886FE484C7141E732E841C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 0646E8F8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e0f56fad8c61f0b0bdaaf3e8a22ec0ddd6edec96bc0b8dcf6be9443a5e84c0c
Instruction ID: 06dacbcd7c7e0d911486b878a93c3e7224866d04481d15b35feb14cfa8083f6a
Opcode Fuzzy Hash: 8e0f56fad8c61f0b0bdaaf3e8a22ec0ddd6edec96bc0b8dcf6be9443a5e84c0c
Instruction Fuzzy Hash: 6CE0173A256248BFC7029B66EC41CA73F7DEF4AA6430540C6F5418F672C623A921DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0646F910 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 917f490c5e9abfa6b2bb8d6da18f8d4869be6f08ea0f5b6e2818f0448716fcb6
Instruction ID: 2d49b5ec8c4497cc5e14bf4b3d382c45d122db2e16eaebf7e7720a27f6d9e2cb
Opcode Fuzzy Hash: 917f490c5e9abfa6b2bb8d6da18f8d4869be6f08ea0f5b6e2818f0448716fcb6
Instruction Fuzzy Hash: 99E02B3A3457256FC706166EB8301F77FABDA8752836680A3F140CB61ADE234C0E83E1

Uniqueness

Uniqueness Score: -1.00%

Function 0646E280 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22cafb4594167b2fe5e64e6654ecc499595e488ee49fc4ed4a72aee5105a9b64
Instruction ID: cb1455d980c36dad9502c8bf503dedb25c758df1a3a9c0424ab7886929928f76
Opcode Fuzzy Hash: 22cafb4594167b2fe5e64e6654ecc499595e488ee49fc4ed4a72aee5105a9b64
Instruction Fuzzy Hash: 95E026740067809FCB02FBA4FC81AE63BA6E74AB00B010245E8005B2EAC7740E4BD7E9

Uniqueness

Uniqueness Score: -1.00%

Function 0646E1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31c0dded046fd3b2a158a8944c36b14e1304b314f9d8dff68a2030c411daba9d
Instruction ID: edc0215f576d2cb7b1bc9b054bb77ab6ef7a83105fe39e961c8fa4b5ccc9df6f
Opcode Fuzzy Hash: 31c0dded046fd3b2a158a8944c36b14e1304b314f9d8dff68a2030c411daba9d
Instruction Fuzzy Hash: 9FE0DF71A45244EFCB11EFA8E8019AE7BB1DB82200F2041DBE909D7292D6300F1587A1

Uniqueness

Uniqueness Score: -1.00%

Function 0646AC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 658a55b3517e214d62f9b33a97e4a31eca57c238943643e0053e1dfac4583263
Instruction ID: bcffd223272c01dcbc3c3e67497424adc0287a347537da565e08b214558fa1c9
Opcode Fuzzy Hash: 658a55b3517e214d62f9b33a97e4a31eca57c238943643e0053e1dfac4583263
Instruction Fuzzy Hash: B1D05E353401295B8A45776DF41D4BF7BABEAC566A30000AEE60BC3344CF655D0A97E9

Uniqueness

Uniqueness Score: -1.00%

Function 0646B510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96438905734e879da622ad71187258c6a7b35dc33757f60169e68891f1075c1f
Instruction ID: d2387e948010ff4a4310e4a13472a9c4fcfe923518faee2923b5f931d6db1760
Opcode Fuzzy Hash: 96438905734e879da622ad71187258c6a7b35dc33757f60169e68891f1075c1f
Instruction Fuzzy Hash: 61E09275D0020CEFCB50DFE5E9448DDBBB9EB48200F1082AAE909E3204EB316B59DF80

Uniqueness

Uniqueness Score: -1.00%

Function 06B8EB90 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f3dbe7d87186d791e2e5c98d9f03f4730cbbe33425b1289e258499449bd501
Instruction ID: 9062166c7efc12ffd053f99c9b01e426d0035dde4c93363eaad38871168a5413
Opcode Fuzzy Hash: b7f3dbe7d87186d791e2e5c98d9f03f4730cbbe33425b1289e258499449bd501
Instruction Fuzzy Hash: F3E0C2F4B09345AFDBD1B230C6D108627E1AF86200B1104D2C001C76A6E525D906D6A2

Uniqueness

Uniqueness Score: -1.00%

Function 0646E210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e875fc0dd3cba503c147c97fbf1f13ad4837015ae00fba3d63de736ed129a2a6
Instruction ID: 8630e68f1f8245e49c824ba932a3a84a73e208df71706a44d70b6a8df4ff1684
Opcode Fuzzy Hash: e875fc0dd3cba503c147c97fbf1f13ad4837015ae00fba3d63de736ed129a2a6
Instruction Fuzzy Hash: A3D05EB1A0020CFFCB40FFA8E90196DB7F9EF44204B1041A9D609E7304EA316F049BE0

Uniqueness

Uniqueness Score: -1.00%

Function 0646F8EA Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87117894bc624c96ed9beaba5470b4bd018210c5b68648b41726af56c1232fb1
Instruction ID: 183ee63e45333798ffaaa676cdbe3ac5be0f6a1ebdf19c975a912f21b99ff3b5
Opcode Fuzzy Hash: 87117894bc624c96ed9beaba5470b4bd018210c5b68648b41726af56c1232fb1
Instruction Fuzzy Hash: 61C012327401200B4284BB6DB01807D7AD7D2E82E7396006BF60EC3388EDB28C4A43A4

Uniqueness

Uniqueness Score: -1.00%

Function 0646DFD1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9258cf72f002a5b38205bde98de07a1003e41b31a86f872b2891ca382355ba25
Instruction ID: 369bd04003c4fb83cdf78cbec245f19e13f8215de38e8c941ab907f37f9c9b1a
Opcode Fuzzy Hash: 9258cf72f002a5b38205bde98de07a1003e41b31a86f872b2891ca382355ba25
Instruction Fuzzy Hash: 1AC04C6154A6D45AEB1607649C0D9453F559F9372171640D6A241CE0A7D5110045CA91

Uniqueness

Uniqueness Score: -1.00%

Function 06463721 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdfbfaba15c1299b2731196e7c0aab453001cf192e90c2add932b9f84c361944
Instruction ID: e37d287eb56910e37b8d6d09724da74f14caacbbe4316d915bf23d8bb0eb86f7
Opcode Fuzzy Hash: fdfbfaba15c1299b2731196e7c0aab453001cf192e90c2add932b9f84c361944
Instruction Fuzzy Hash: E4C09B75610201DFF700DF74B94DF713E70FF54711F014115A75586085D7654411CB79

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06B83DF8 Relevance: 2.9, Strings: 2, Instructions: 364COMMON

Download Yara Rule

Strings

1, xrefs: 06B840FD
., xrefs: 06B84078

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: f6e19ea46b7ef4fefd42f64c2933db6681d31545b41f3e11228a2561396d21e0
Instruction ID: bfe52f6120d2218e5dd4ffa0aee6dee2fc1d30fcc477d7ac8a1010fd57125a2b
Opcode Fuzzy Hash: f6e19ea46b7ef4fefd42f64c2933db6681d31545b41f3e11228a2561396d21e0
Instruction Fuzzy Hash: 59F1D0B4E01229CFDB68DF65C884B9DBBB2FF89301F5085A9D50AAB254DB315E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06B806A8 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1c6700c83ba323d49a5f605f2f5feb2d49994f91fa52aafa08ec5e10f8c4d59
Instruction ID: 0fc81ce0663c647ccbdcb505ef4c56e2e7f1ddab44a30e89ab99a9e36eda9d17
Opcode Fuzzy Hash: a1c6700c83ba323d49a5f605f2f5feb2d49994f91fa52aafa08ec5e10f8c4d59
Instruction Fuzzy Hash: E5228F70D01229CFDBA5EF68C990BD9B7B2BF49300F1095E9D549A7250EB316E85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06B80340 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95ecade588cc996c8e0eeab127501da3c63288b495038a466fa95d5bebca5502
Instruction ID: dde86fd0b950c78a005e670710312c01db8ce08f80849bb3b7439619bb1889b6
Opcode Fuzzy Hash: 95ecade588cc996c8e0eeab127501da3c63288b495038a466fa95d5bebca5502
Instruction Fuzzy Hash: FB912574D00229DFDB64EFA9C984B9DBBB2FF49300F1091A9D409A7351EB306A89CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0646E2C7 Relevance: 46.6, Strings: 37, Instructions: 391COMMON

Download Yara Rule

Strings

DGj, xrefs: 0646E40C
DGj, xrefs: 0646E770
DGj, xrefs: 0646E2E4
DGj, xrefs: 0646E56B
DGj, xrefs: 0646E51B
DGj, xrefs: 0646E819
DGj, xrefs: 0646E431
DGj, xrefs: 0646E658
DGj, xrefs: 0646E4CB
DGj, xrefs: 0646E4F3
DGj, xrefs: 0646E543
DGj, xrefs: 0646E353
DGj, xrefs: 0646E5E3
DGj, xrefs: 0646E6A8
DGj, xrefs: 0646E630
DGj, xrefs: 0646E47B
DGj, xrefs: 0646E680
DGj, xrefs: 0646E593
DGj, xrefs: 0646E798
DGj, xrefs: 0646E3C2
DGj, xrefs: 0646E86F
DGj, xrefs: 0646E7EE
DGj, xrefs: 0646E5BB
DGj, xrefs: 0646E844
DGj, xrefs: 0646E309
DGj, xrefs: 0646E32E
DGj, xrefs: 0646E3E7
DGj, xrefs: 0646E4A3
DGj, xrefs: 0646E6F8
DGj, xrefs: 0646E720
DGj, xrefs: 0646E39D
DGj, xrefs: 0646E748
DGj, xrefs: 0646E7C3
DGj, xrefs: 0646E378
DGj, xrefs: 0646E6D0
DGj, xrefs: 0646E608
DGj, xrefs: 0646E456

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-3760891704
Opcode ID: b6971550df7f36a1af3e14189e89cb8cc5835d63c48ec6a1424f1a77e84f5b71
Instruction ID: bd92dee52cc4ef009a1fbe08dffc45f4c02d726f4c0922ee514da3f10b42aeca
Opcode Fuzzy Hash: b6971550df7f36a1af3e14189e89cb8cc5835d63c48ec6a1424f1a77e84f5b71
Instruction Fuzzy Hash: E3D192343006416FC605BAA99D93EBDA753FB86304B40453CD12A4FB9AEFB1AD1943E7

Uniqueness

Uniqueness Score: -1.00%

Function 0646E2D8 Relevance: 46.6, Strings: 37, Instructions: 383COMMON

Download Yara Rule

Strings

DGj, xrefs: 0646E40C
DGj, xrefs: 0646E770
DGj, xrefs: 0646E2E4
DGj, xrefs: 0646E56B
DGj, xrefs: 0646E51B
DGj, xrefs: 0646E819
DGj, xrefs: 0646E431
DGj, xrefs: 0646E658
DGj, xrefs: 0646E4CB
DGj, xrefs: 0646E4F3
DGj, xrefs: 0646E543
DGj, xrefs: 0646E353
DGj, xrefs: 0646E5E3
DGj, xrefs: 0646E6A8
DGj, xrefs: 0646E630
DGj, xrefs: 0646E47B
DGj, xrefs: 0646E680
DGj, xrefs: 0646E593
DGj, xrefs: 0646E798
DGj, xrefs: 0646E3C2
DGj, xrefs: 0646E86F
DGj, xrefs: 0646E7EE
DGj, xrefs: 0646E5BB
DGj, xrefs: 0646E844
DGj, xrefs: 0646E309
DGj, xrefs: 0646E32E
DGj, xrefs: 0646E3E7
DGj, xrefs: 0646E4A3
DGj, xrefs: 0646E6F8
DGj, xrefs: 0646E720
DGj, xrefs: 0646E39D
DGj, xrefs: 0646E748
DGj, xrefs: 0646E7C3
DGj, xrefs: 0646E378
DGj, xrefs: 0646E6D0
DGj, xrefs: 0646E608
DGj, xrefs: 0646E456

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-3760891704
Opcode ID: a49fb2023bdd797dbe6ede823d5060808bbc7456da82ec7179677ee65232314d
Instruction ID: 2ad492795134769f621e4f560b0f8fa70f57996f8b24b5212490775a9bed86dc
Opcode Fuzzy Hash: a49fb2023bdd797dbe6ede823d5060808bbc7456da82ec7179677ee65232314d
Instruction Fuzzy Hash: DDD192343006416BC605BAA99D93EBDA753FB87304B40453CD12A4FB9AEFB1AD1943E7

Uniqueness

Uniqueness Score: -1.00%

Function 0646CC7F Relevance: 16.4, Strings: 13, Instructions: 152COMMON

Download Yara Rule

Strings

DGj, xrefs: 0646CDC4
DGj, xrefs: 0646CD7A
DGj, xrefs: 0646CCE6
DGj, xrefs: 0646CCC1
DGj, xrefs: 0646CE33
DGj, xrefs: 0646CC9C
DGj, xrefs: 0646CE58
DGj, xrefs: 0646CD55
DGj, xrefs: 0646CDE9
DGj, xrefs: 0646CD0B
DGj, xrefs: 0646CD30
DGj, xrefs: 0646CE0E
DGj, xrefs: 0646CD9F

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-2950335420
Opcode ID: b97704f0ca3c0d240c417dac1fbf7bc12f419c0a23b26117de414d431faad09d
Instruction ID: b7cd9b01b1adb98e725b69cc42a841ad151473781fe7eab8011e45a2b3663be2
Opcode Fuzzy Hash: b97704f0ca3c0d240c417dac1fbf7bc12f419c0a23b26117de414d431faad09d
Instruction Fuzzy Hash: 2C41B8343006402FD6057AA99D87EBDA753FB87304B404538E22A4FB9ADFB5AD4943E7

Uniqueness

Uniqueness Score: -1.00%

Function 0646CC90 Relevance: 16.4, Strings: 13, Instructions: 143COMMON

Download Yara Rule

Strings

DGj, xrefs: 0646CDC4
DGj, xrefs: 0646CD7A
DGj, xrefs: 0646CCE6
DGj, xrefs: 0646CCC1
DGj, xrefs: 0646CE33
DGj, xrefs: 0646CC9C
DGj, xrefs: 0646CE58
DGj, xrefs: 0646CD55
DGj, xrefs: 0646CDE9
DGj, xrefs: 0646CD0B
DGj, xrefs: 0646CD30
DGj, xrefs: 0646CE0E
DGj, xrefs: 0646CD9F

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-2950335420
Opcode ID: 2582319b2909a4c6d177b7e722401c5b5633e1aba83155aea2f2307558d2aa6d
Instruction ID: 94a12afb232f78ab8e6a80ef5b9368ef171e47b04336c8369ead5f295beed944
Opcode Fuzzy Hash: 2582319b2909a4c6d177b7e722401c5b5633e1aba83155aea2f2307558d2aa6d
Instruction Fuzzy Hash: 9F4198343006412FD6057AA99D87E7DA753FB87304B404538D22A4FB9ADFB5AD0943E7

Uniqueness

Uniqueness Score: -1.00%

Function 06B880C0 Relevance: 15.1, Strings: 12, Instructions: 144COMMON

Download Yara Rule

Strings

`Q^q, xrefs: 06B881B2
`Q^q, xrefs: 06B88188
`Q^q, xrefs: 06B8820A
`Q^q, xrefs: 06B8815E
`Q^q, xrefs: 06B880E3
`Q^q, xrefs: 06B8828C
`Q^q, xrefs: 06B881DE
`Q^q, xrefs: 06B88260
`Q^q, xrefs: 06B8810A
`Q^q, xrefs: 06B882B8
`Q^q, xrefs: 06B88234
`Q^q, xrefs: 06B88134

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID: `Q^q$`Q^q$`Q^q$`Q^q$`Q^q$`Q^q$`Q^q$`Q^q$`Q^q$`Q^q$`Q^q$`Q^q
API String ID: 0-2561617282
Opcode ID: a7e00047f4a5f0a97881e21be49639586675dd8c524f7dc442d00d18d5bc3fde
Instruction ID: 858e245b62d3fe13de273ab453e30a449d73d2dee67a5a81785cd45d2876f2f1
Opcode Fuzzy Hash: a7e00047f4a5f0a97881e21be49639586675dd8c524f7dc442d00d18d5bc3fde
Instruction Fuzzy Hash: D8516C74E0020E9FDB05EFA5E945BBEB7B2FB84708F104428D5042F398DB71AD098BA1

Uniqueness

Uniqueness Score: -1.00%

Function 06B880D0 Relevance: 15.1, Strings: 12, Instructions: 140COMMON

Download Yara Rule

Strings

`Q^q, xrefs: 06B881B2
`Q^q, xrefs: 06B88188
`Q^q, xrefs: 06B8820A
`Q^q, xrefs: 06B8815E
`Q^q, xrefs: 06B880E3
`Q^q, xrefs: 06B8828C
`Q^q, xrefs: 06B881DE
`Q^q, xrefs: 06B88260
`Q^q, xrefs: 06B8810A
`Q^q, xrefs: 06B882B8
`Q^q, xrefs: 06B88234
`Q^q, xrefs: 06B88134

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID: `Q^q$`Q^q$`Q^q$`Q^q$`Q^q$`Q^q$`Q^q$`Q^q$`Q^q$`Q^q$`Q^q$`Q^q
API String ID: 0-2561617282
Opcode ID: cc7bb66e232b6c10090eb4e1c3c4f9ebfc88792cd9efd0e4ca1d7c22566535fa
Instruction ID: c571c19a24e2e0aebfb87d5fc898511230f20d9bcd230cc079f6b3eb97bac6c5
Opcode Fuzzy Hash: cc7bb66e232b6c10090eb4e1c3c4f9ebfc88792cd9efd0e4ca1d7c22566535fa
Instruction Fuzzy Hash: 74514C74E0010E9FDB05EFA5E945BBEB7B2FB84708F104528E5046F398DB71AD098BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0646CED1 Relevance: 10.1, Strings: 8, Instructions: 106COMMON

Download Yara Rule

Strings

DGj, xrefs: 0646CF80
DGj, xrefs: 0646CEEC
DGj, xrefs: 0646CFA5
DGj, xrefs: 0646CF11
DGj, xrefs: 0646CF5B
DGj, xrefs: 0646CFEF
DGj, xrefs: 0646CFCA
DGj, xrefs: 0646CF36

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-4266538241
Opcode ID: 312c9d42cd81bf259ea6ab6a93f470edf5af6c4a3975207c83b0d33846e6ba2e
Instruction ID: c2b1b5fc07cb7f91360077c3a1de0a39c3acd433a396dcbbf69a62b2fdb1d1e7
Opcode Fuzzy Hash: 312c9d42cd81bf259ea6ab6a93f470edf5af6c4a3975207c83b0d33846e6ba2e
Instruction Fuzzy Hash: 9431C4343402413FC6056AAA9C83EBDA756EB87304B404538E1294FB9ADFB5AD4943E7

Uniqueness

Uniqueness Score: -1.00%

Function 0646CEE0 Relevance: 10.1, Strings: 8, Instructions: 93COMMON

Download Yara Rule

Strings

DGj, xrefs: 0646CF80
DGj, xrefs: 0646CEEC
DGj, xrefs: 0646CFA5
DGj, xrefs: 0646CF11
DGj, xrefs: 0646CF5B
DGj, xrefs: 0646CFEF
DGj, xrefs: 0646CFCA
DGj, xrefs: 0646CF36

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-4266538241
Opcode ID: 375160fbced03c27cddfbc7eea0414459cc23a3ae481f04ab44f37ec3e079f91
Instruction ID: cbe50cf5bdf0cdfd9ab48e100daa800453ae3dbb2cff6640a3c9692567549a09
Opcode Fuzzy Hash: 375160fbced03c27cddfbc7eea0414459cc23a3ae481f04ab44f37ec3e079f91
Instruction Fuzzy Hash: 5E21A9343002512BC605BAA99D83EBDA753FB87304B40453CE12A5FB9ADFB5AD4943E7

Uniqueness

Uniqueness Score: -1.00%

Function 06B8EBFA Relevance: 9.2, Strings: 7, Instructions: 471COMMON

Download Yara Rule

Strings

$^q, xrefs: 06B8ED8F
$^q, xrefs: 06B8ECE3
(_^q, xrefs: 06B8EE5B
$^q, xrefs: 06B8EF2F
(_^q, xrefs: 06B8EE41
$^q, xrefs: 06B8F0C3
$^q, xrefs: 06B8ED39

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2667574237
Opcode ID: 566818de1ddf814edaa363a75f362dc08aa5c43b5c7bbe8ec820cca17ac6783d
Instruction ID: ce3dbbd0179cc12c686ce0c1fba798f183028e9915dc246011cf70d260fd8269
Opcode Fuzzy Hash: 566818de1ddf814edaa363a75f362dc08aa5c43b5c7bbe8ec820cca17ac6783d
Instruction Fuzzy Hash: C2223C74A00208DFDB15EFB8DA45AAEBBB2FF85308F104569D005AB369DB319E45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06B8EC08 Relevance: 9.2, Strings: 7, Instructions: 464COMMON

Download Yara Rule

Strings

$^q, xrefs: 06B8ED8F
$^q, xrefs: 06B8ECE3
(_^q, xrefs: 06B8EE5B
$^q, xrefs: 06B8EF2F
(_^q, xrefs: 06B8EE41
$^q, xrefs: 06B8F0C3
$^q, xrefs: 06B8ED39

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2667574237
Opcode ID: 5499b093ae20f66bc1d66d9ae744a00f90210dc727ee9d3df64d158f420904de
Instruction ID: d9efb11fb84d33e9a864a3c31e4c89963ac0ba006131f66bf360dd4f99a337f0
Opcode Fuzzy Hash: 5499b093ae20f66bc1d66d9ae744a00f90210dc727ee9d3df64d158f420904de
Instruction Fuzzy Hash: 66223C74A002089FDB15EFB8DA45AAEBBB2FF85308F104569D009AB369DB319E45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0646C968 Relevance: 8.8, Strings: 7, Instructions: 89COMMON

Download Yara Rule

Strings

DGj, xrefs: 0646CA7A
DGj, xrefs: 0646CA51
DGj, xrefs: 0646C9D6
DGj, xrefs: 0646C9AD
DGj, xrefs: 0646CA28
DGj, xrefs: 0646C984
DGj, xrefs: 0646C9FF

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-3215742008
Opcode ID: dbf43cfb5e33cb0c952f128cd7cee1bbf63af6c2e3cf8772b2ec5c33ab1756f3
Instruction ID: a03eb4aa9b424e89c328bfcf0f977ca921fadb17f3b1a462a33d661884cb5e13
Opcode Fuzzy Hash: dbf43cfb5e33cb0c952f128cd7cee1bbf63af6c2e3cf8772b2ec5c33ab1756f3
Instruction Fuzzy Hash: 9831D6303002C26FCB057BA99C45DBD7B53FB977047004538E1169FAE5CEB19E8A8B91

Uniqueness

Uniqueness Score: -1.00%

Function 0646C978 Relevance: 8.8, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

DGj, xrefs: 0646CA7A
DGj, xrefs: 0646CA51
DGj, xrefs: 0646C9D6
DGj, xrefs: 0646C9AD
DGj, xrefs: 0646CA28
DGj, xrefs: 0646C984
DGj, xrefs: 0646C9FF

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-3215742008
Opcode ID: 6cac54df27dd95ed795249b0ecbfcea3b82820980b739b19c048959a623d1d49
Instruction ID: c670bb57bb0450d818fef8d209c2b64d3aa0e0f20fbdb35576eb2a3199d40d34
Opcode Fuzzy Hash: 6cac54df27dd95ed795249b0ecbfcea3b82820980b739b19c048959a623d1d49
Instruction Fuzzy Hash: E52199303001926FCB057FA9DD46DBD7753F7967047004538E1169FB99CEB19D8A8B91

Uniqueness

Uniqueness Score: -1.00%

Function 0646ED10 Relevance: 7.9, Strings: 6, Instructions: 381COMMON

Download Yara Rule

Strings

(_^q, xrefs: 0646EEFA
(_^q, xrefs: 0646F0F9
(_^q, xrefs: 0646EF79
(_^q, xrefs: 0646ED7A
(_^q, xrefs: 0646EDF9
(_^q, xrefs: 0646F07A

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q$(_^q$(_^q
API String ID: 0-2896069617
Opcode ID: 207fc96c4d1b813b30ae78adac30bb9987296ca45d7e0c5f587cdad0f397e42d
Instruction ID: 325e885167f3963b17c5a8e7e09e2eff01a2fd79d33f8e4d8c2d37a71aba9e18
Opcode Fuzzy Hash: 207fc96c4d1b813b30ae78adac30bb9987296ca45d7e0c5f587cdad0f397e42d
Instruction Fuzzy Hash: 39D1B039B042449FCB05AF79D42456E7FF2EF86300F24856AE846DB381DA359E06CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 0646D538 Relevance: 7.6, Strings: 6, Instructions: 84COMMON

Download Yara Rule

Strings

DGj, xrefs: 0646D59E
DGj, xrefs: 0646D60D
DGj, xrefs: 0646D5C3
DGj, xrefs: 0646D5E8
DGj, xrefs: 0646D554
DGj, xrefs: 0646D579

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-1101258311
Opcode ID: bb614c878e8a86b89d376697d9ada1c067f4d351cb64c8908f3e14dfa4214e62
Instruction ID: 9f538b6d2ca03259334ba9ac0b214e909ab38ea9a87e404c3d2f530de23904c8
Opcode Fuzzy Hash: bb614c878e8a86b89d376697d9ada1c067f4d351cb64c8908f3e14dfa4214e62
Instruction Fuzzy Hash: 5E21C7313002403FC6056AAA9D83EBDA757EB87708B414538E12A4FB96DFB65D5943F3

Uniqueness

Uniqueness Score: -1.00%

Function 0646D548 Relevance: 7.6, Strings: 6, Instructions: 73COMMON

Download Yara Rule

Strings

DGj, xrefs: 0646D59E
DGj, xrefs: 0646D60D
DGj, xrefs: 0646D5C3
DGj, xrefs: 0646D5E8
DGj, xrefs: 0646D554
DGj, xrefs: 0646D579

Memory Dump Source

Source File: 00000003.00000002.1836879510.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6460000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-1101258311
Opcode ID: 24b02248ff0977e09c7b888c1741f2a4eda213bfc09452d4eacb822f8bfeb919
Instruction ID: b99b4e80f61c986ccba6babca3f565497af6650cbb3eae08ea8f90955e23f648
Opcode Fuzzy Hash: 24b02248ff0977e09c7b888c1741f2a4eda213bfc09452d4eacb822f8bfeb919
Instruction Fuzzy Hash: A21195303002502BC6057AAA9D83EBDA757EB86704B404538D12A4FB9ADFB2AD5943E3

Uniqueness

Uniqueness Score: -1.00%

Function 06B8E419 Relevance: 6.5, Strings: 5, Instructions: 277COMMON

Download Yara Rule

Strings

(_^q, xrefs: 06B8E4ED
$^q, xrefs: 06B8E573
$^q, xrefs: 06B8E496
$^q, xrefs: 06B8E73C
(_^q, xrefs: 06B8E507

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$$^q$$^q$$^q
API String ID: 0-142850551
Opcode ID: bcef616d5a39e5ceaa1fb778f3d68b0b6dee9a9330813e70ffd767ee5431d248
Instruction ID: 57c1f702da28ddfd419569cb86a814532b1a3a7e630ce9acc95b17e39987de75
Opcode Fuzzy Hash: bcef616d5a39e5ceaa1fb778f3d68b0b6dee9a9330813e70ffd767ee5431d248
Instruction Fuzzy Hash: 06C12174A402089FDB05EFB8D955AAEBBF2FF88308F108529D0156B368DB31AD45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06B8E428 Relevance: 6.5, Strings: 5, Instructions: 273COMMON

Download Yara Rule

Strings

(_^q, xrefs: 06B8E4ED
$^q, xrefs: 06B8E573
$^q, xrefs: 06B8E496
$^q, xrefs: 06B8E73C
(_^q, xrefs: 06B8E507

Memory Dump Source

Source File: 00000003.00000002.1838348662.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6b80000_RegAsm.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$$^q$$^q$$^q
API String ID: 0-142850551
Opcode ID: da3bf51b63eb8e74a3061782c814da9585aa7acf248a82dcfa16bf6baa8e94fa
Instruction ID: 9b7b5173e15e974b698af241f8233a7cd8dc77ef0ac70cec9c66062742510126
Opcode Fuzzy Hash: da3bf51b63eb8e74a3061782c814da9585aa7acf248a82dcfa16bf6baa8e94fa
Instruction Fuzzy Hash: 8DC11174A402089FDB05EFB9D955AAEBBF6FF88308F108529D0156B368DB31AD45CF50

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Users\user\AppData\Local\Temp\Tmp8EB7.tmp

C:\Users\user\AppData\Local\Temp\Tmp8EC7.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
file.exe

Function 0106AC4D Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Function 010132DF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81
threadinjectionCOMMON

Function 0100547C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 010083DF Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Function 010008D3 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 010075AE Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Function 01009B7D Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00FF4FA8 Relevance: 3.1, APIs: 2, Instructions: 116
COMMON

Function 010071B0 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 01004652 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 01005916 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Function 01009781 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Function 00FF1BFF Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Function 01005547 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Function 00FF2323 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON