Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1432174
MD5:	ea8b223863892068e3cfab601caf53d4
SHA1:	d94660b1fc88c44fddf2b330e9628b38c9e7d8d0
SHA256:	4ed2368fc3e3030a3da9930cb430b80d4611baf0a0451efe3f9e02b25ccd493d
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2364 cmdline: "C:\Users\user\Desktop\file.exe" MD5: EA8B223863892068E3CFAB601CAF53D4)

conhost.exe (PID: 2104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 2212 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 3040 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "5.42.65.96:28380", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000004.00000002.2204664213.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000004.00000002.2206870926.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2364	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 3040	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 3040	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.281040.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.281040.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
4.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.250000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Snort Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 5.42.65.96 - Destination IP: 192.168.2.5

Timestamp:	04/26/24-16:28:58.476425
SID:	2043234
Source Port:	28380
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.5 - Destination IP: 5.42.65.96

Timestamp:	04/26/24-16:29:13.331288
SID:	2043231
Source Port:	49704
Destination Port:	28380
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 5.42.65.96

Timestamp:	04/26/24-16:28:58.227042
SID:	2046045
Source Port:	49704
Destination Port:	28380
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 5.42.65.96 - Destination IP: 192.168.2.5

Timestamp:	04/26/24-16:29:03.773464
SID:	2046056
Source Port:	28380
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "5.42.65.96:28380", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 32%			Perma Link
Source: file.exe	ReversingLabs: Detection: 31%

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00269C1F FindFirstFileExW,

0_2_00269C1F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 068C4C60h	4_2_068C4768
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 068C18A7h	4_2_068C1148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 068C10A5h	4_2_068C0DE0

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.5:49704 -> 5.42.65.96:28380
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.5:49704 -> 5.42.65.96:28380
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 5.42.65.96:28380 -> 192.168.2.5:49704
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 5.42.65.96:28380 -> 192.168.2.5:49704

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 5.42.65.96:28380

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 5.42.65.96:28380

Source: Joe Sandbox View

ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU

Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96

Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: RegAsm.exe, 00000004.00000002.2205622101.0000000000C0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.exif/1
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp93
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002D80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002D80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002D5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002D5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15V
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002D80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002D80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002D80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002D80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2206870926.0000000002D80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002D90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002D80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002D90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002D90000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002D90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002BAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002D80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002D5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: file.exe, file.exe, 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000004.00000002.2204664213.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpF89F.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpF8AF.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00260160	0_2_00260160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00264213	0_2_00264213
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0026C253	0_2_0026C253
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0026DAD1	0_2_0026DAD1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00264C33	0_2_00264C33
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00287555	0_2_00287555
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00286DD0	0_2_00286DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0025CF44	0_2_0025CF44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00BDDC74	4_2_00BDDC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_02800AFC	4_2_02800AFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_02806948	4_2_02806948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_028072D0	4_2_028072D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_02807C20	4_2_02807C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_02800039	4_2_02800039
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_02800040	4_2_02800040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_02800AFB	4_2_02800AFB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_02801FFB	4_2_02801FFB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_02807C10	4_2_02807C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_061A67D8	4_2_061A67D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_061AA3D8	4_2_061AA3D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_061A3F50	4_2_061A3F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_061A6FF8	4_2_061A6FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_061A6FE8	4_2_061A6FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_068CC4F8	4_2_068CC4F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_068C76C8	4_2_068C76C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_068C4768	4_2_068C4768
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_068C2510	4_2_068C2510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_068C01E8	4_2_068C01E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_068C1148	4_2_068C1148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_068C3AA8	4_2_068C3AA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_068C3AB8	4_2_068C3AB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_068C1A60	4_2_068C1A60

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 002572C0 appears 51 times

Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBeaufin.exe8 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .bsS ZLIB complexity 0.9981459697217676

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/5@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2104:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\TmpF89F.tmp

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	Virustotal: Detection: 32%
Source: file.exe	ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.4.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002869C6 push es; retn 0000h	0_2_00286AD6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00286AE8 push es; retn 0000h	0_2_00286AD6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00286AE8 push es; ret	0_2_00286AE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00286AD9 push es; retn 0000h	0_2_00286AD6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00286AD9 push es; ret	0_2_00286AE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00286B55 push es; retf 0000h	0_2_00286B42
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00286B55 push es; retf	0_2_00286B52
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002565C2 push ecx; ret	0_2_002565D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00BD46E9 push ebx; ret	4_2_00BD46EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00BD46E1 push ebx; ret	4_2_00BD46E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00BD46E3 push edx; ret	4_2_00BD46E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00BD4661 push edx; ret	4_2_00BD4662
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00BD4658 push edx; ret	4_2_00BD465A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00BD47E0 push esi; ret	4_2_00BD47E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00BD47D7 push esi; ret	4_2_00BD47DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00BDAD09 pushfd ; ret	4_2_00BDAD0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00BDAD01 pushfd ; ret	4_2_00BDAD02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_061AC711 push es; ret	4_2_061AC720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_061AD413 push es; ret	4_2_061AD420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_061AECF2 push eax; ret	4_2_061AED01

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: B30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: B30000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1938			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 6369			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5644	Thread sleep time: -27670116110564310s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3948	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00269C1F FindFirstFileExW,

0_2_00269C1F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: RegAsm.exe, 00000004.00000002.2211253726.0000000005AB6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: RegAsm.exe, 00000004.00000002.2208757481.0000000003AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00257093 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00257093

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0026650C mov eax, dword ptr fs:[00000030h]	0_2_0026650C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002613E3 mov ecx, dword ptr fs:[00000030h]	0_2_002613E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00266550 mov eax, dword ptr fs:[00000030h]	0_2_00266550

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0026D368 GetProcessHeap,

0_2_0026D368

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00257093 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00257093
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002571EF SetUnhandledExceptionFilter,	0_2_002571EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00256D89 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00256D89
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0025ADD3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0025ADD3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 6E5008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00256B7C cpuid

0_2_00256B7C

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_0026D037
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0026D106
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_0026CA44
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_0026624C
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_0026CA8F
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_0026CB2A
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0026CBB5
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00265CE6
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_0026CE08
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0026CF31
Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0026C7A2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00256F86 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00256F86

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000004.00000002.2211713768.0000000005B5B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2215254482.000000000727A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.281040.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.281040.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2204664213.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3040, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q2C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR]q~
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR]q
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q%appdata%`,]qdC:\Users\user\AppData\Roaming`,]qdC:\Users\user\AppData\Roaming\Binance
Source: RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q&%localappdata%\Coinomi\Coinomi\walletsLR]q
Source: RegAsm.exe, 00000004.00000002.2206870926.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q6C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2206870926.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3040, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.281040.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.281040.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2204664213.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3040, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	251 Security Software Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Install Root Certificate	DCSync	134 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
file.exe	33%	Virustotal	Browse
file.exe	32%	ReversingLabs
file.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15V	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id14ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id23ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21Response	4%	Virustotal		Browse
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://tempuri.org/	2%	Virustotal		Browse
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	1%	Virustotal		Browse
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	2%	Virustotal		Browse
http://ns.exif/1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15V	1%	Virustotal		Browse
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8ResponseD	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id14ResponseD	RegAsm.exe, 00000004.00000002.2206870926.0000000002BAD000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	RegAsm.exe, 00000004.00000002.2206870926.0000000002D90000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15V	RegAsm.exe, 00000004.00000002.2206870926.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	RegAsm.exe, 00000004.00000002.2206870926.0000000002BAD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ns.exif/1	RegAsm.exe, 00000004.00000002.2205622101.0000000000C0E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13ResponseD	RegAsm.exe, 00000004.00000002.2206870926.0000000002D5F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	file.exe, file.exe, 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000004.00000002.2204664213.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1ResponseD	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23	RegAsm.exe, 00000004.00000002.2206870926.0000000002D90000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1Response	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21ResponseD	RegAsm.exe, 00000004.00000002.2206870926.0000000002D80000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	RegAsm.exe, 00000004.00000002.2206870926.0000000002D80000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15ResponseD	RegAsm.exe, 00000004.00000002.2206870926.0000000002D5F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id11ResponseD	RegAsm.exe, 00000004.00000002.2206870926.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp93	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17ResponseD	RegAsm.exe, 00000004.00000002.2206870926.0000000002D80000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	RegAsm.exe, 00000004.00000002.2206870926.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8ResponseD	RegAsm.exe, 00000004.00000002.2206870926.0000000002D5F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	RegAsm.exe, 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.42.65.96	unknown	Russian Federation		39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432174
Start date and time:	2024-04-26 16:28:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 113 Number of non-executed functions: 63
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:29:06	API Interceptor	44x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
5.42.65.96	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	file.exe	Get hash	malicious	RisePro Stealer	Browse	45.15.156.9
	file.exe	Get hash	malicious	RisePro Stealer	Browse	45.15.156.9
	j1zkOQTx4q.exe	Get hash	malicious	RisePro Stealer	Browse	5.42.66.10
	f6FauZ2CEz.exe	Get hash	malicious	RedLine	Browse	5.42.92.179
	file.exe	Get hash	malicious	PureLog Stealer, RisePro Stealer, zgRAT	Browse	45.15.156.9
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.96
	file.exe	Get hash	malicious	Unknown	Browse	5.42.66.10
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	5.42.66.10
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse	5.42.66.10
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.96

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 13:16:55 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.450987436011712
Encrypted:	false
SSDEEP:	48:8S5l2dfTXdARYrnvPdAKRkdAGdAKRFdAKRE:8S5lO7
MD5:	59C0399F8AFEF9292B3142B84076915B
SHA1:	C5D5A4DF758A6954893920E6DBBE8DE40D132155
SHA-256:	606357DF37CD552F9B24251A9FA54C682939615DD15205BF8502B8A2C8EB8F67
SHA-512:	2E5C97870B346FE731B9E098FDFDA6C45DA416761CAB7CB17C7339F27CD15DB7FEEF3F16BDB3A55660B7B886C213F5718E0C49E6F4F287D392661759785C5C07
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,......m.......q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDW.r....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWUl....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWUl....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWUl..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDW.r..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlq0
MD5:	0C1110E9B7BBBCB651A0B7568D796468
SHA1:	7AEE00407EE27655FFF0ADFBC96CF7FAD9610AAA
SHA-256:	112E21404A85963FB5DF8388F97429D6A46E9D4663435CC86267C563C0951FA2
SHA-512:	46E37552764B4E61006AB99F8C542D55B2418668B097D3C6647D306604C3D7CA3FAF34F8B4121D94B0E7168295B2ABEB7C21C3B96F37208943537B887BC81590
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\TmpF89F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpF8AF.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.672166470720766
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	507'904 bytes
MD5:	ea8b223863892068e3cfab601caf53d4
SHA1:	d94660b1fc88c44fddf2b330e9628b38c9e7d8d0
SHA256:	4ed2368fc3e3030a3da9930cb430b80d4611baf0a0451efe3f9e02b25ccd493d
SHA512:	c2e615cf996015fe3eb04ebdb345e1cad04e73850e77bc9d9ee3dee919cf10f3bb8d323d98c9d02b80cc1687cb69f8e82a5ec350ba3ef73fbdccb2be3d43d11a
SSDEEP:	12288:1dy0t/5TvliKBBV06Eqj7o38LjxixclXtKIN2rYoPlD6y:f/5jl7mEoKt9N2FR6
TLSH:	09B4F105B5C0C073D572293106F4EBB49E3DF9714F61AE9FA7940BAF4F312928225A6B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................... ....... ..._... ....... ...............1.......1.......1.................s.............Rich............PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4068ee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x662BB112 [Fri Apr 26 13:50:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	17c87c2ceba06a933957d5cd67f1cd22

Entrypoint Preview

Instruction
call 00007F3B68BC2D55h
jmp 00007F3B68BC24E9h
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F3B68BC268Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F3B68BC267Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F3B68BC267Eh
add edx, 28h
cmp edx, esi
jne 00007F3B68BC265Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F3B68BC266Bh
push esi
call 00007F3B68BC3038h
test eax, eax
je 00007F3B68BC2692h
mov eax, dword ptr fs:[00000018h]
mov esi, 00430428h
mov edx, dword ptr [eax+04h]
jmp 00007F3B68BC2676h
cmp edx, eax
je 00007F3B68BC2682h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F3B68BC2662h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F3B68BC2679h
mov byte ptr [0043042Ch], 00000001h
call 00007F3B68BC286Eh
call 00007F3B68BC55CBh
test al, al
jne 00007F3B68BC2676h
xor al, al
pop ebp
ret
call 00007F3B68BCEDE7h
test al, al
jne 00007F3B68BC267Ch
push 00000000h
call 00007F3B68BC55D2h
pop ecx
jmp 00007F3B68BC265Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [0043042Dh], 00000000h
je 00007F3B68BC2676h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2d8b4	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7e000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7f000	0x1b74	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2bd48	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2bc88	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x24000	0x158	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x21f90	0x22000	f14c05a6dca219bb2c84204cace7d040	False	0.5812198414522058	data	6.636378879087742	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.bss	0x23000	0x4ca	0x600	901a9dc1427cbd3f44b14848ccca4ba5	False	0.6354166666666666	data	5.637778724996146	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x24000	0xa078	0xa200	7bde77e9c6633ef6b87313419e06a57a	False	0.4343412422839506	data	4.962790929317122	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2f000	0x1f2c	0x1000	e43a2fd03de3710737c2e6df04231506	False	0.1962890625	data	3.1279241686690304	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bsS	0x31000	0x4c4ec	0x4c600	aa88fc301f8be989f00b54a081bcb049	False	0.9981459697217676	OpenPGP Secret Key	7.999204116583416	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7e000	0x1e0	0x200	dbe1515e25b29d6c778cce075f0cb524	False	0.53125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7f000	0x1b74	0x1c00	1b1abb7b06860478dc660f44dafe9d9c	False	0.75	data	6.50238350002894	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x7e060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

Sleep, VirtualProtect, FreeConsole, CloseHandle, WaitForSingleObjectEx, GetCurrentThreadId, GetExitCodeThread, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, QueryPerformanceCounter, ReleaseSRWLockExclusive, WakeAllConditionVariable, EncodePointer, DecodePointer, LCMapStringEx, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, WriteConsoleW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, CreateThread, ExitThread, FreeLibraryAndExitThread, GetModuleHandleExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, GetFileType, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, CreateFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/26/24-16:28:58.476425	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	28380	49704	5.42.65.96	192.168.2.5
04/26/24-16:29:13.331288	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49704	28380	192.168.2.5	5.42.65.96
04/26/24-16:28:58.227042	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49704	28380	192.168.2.5	5.42.65.96
04/26/24-16:29:03.773464	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	28380	49704	5.42.65.96	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 16:28:57.570960045 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:28:57.818397045 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:28:57.818502903 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:28:57.894654036 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:28:58.142633915 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:28:58.206533909 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:28:58.227041960 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:28:58.476424932 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:28:58.706558943 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:03.522583961 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:03.773463964 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:03.773493052 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:03.773631096 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:03.773650885 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:03.773673058 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:03.773684978 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:03.773726940 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:03.815903902 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:03.906419039 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:04.155378103 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:04.209872961 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:04.236193895 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:04.484175920 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:04.484225035 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:04.484325886 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:04.484399080 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:04.484544992 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:04.484608889 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:04.732038021 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:04.732126951 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:04.732240915 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:04.732280016 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:04.732306004 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:04.732323885 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:04.732336044 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:04.732381105 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:04.732582092 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:04.732639074 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:04.732738972 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:04.732793093 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:04.733208895 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:04.733314991 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:04.979793072 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:04.979878902 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:04.979897022 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:04.980035067 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:04.980117083 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:04.980133057 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:04.980222940 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:04.980508089 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:04.980739117 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:04.980855942 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:04.989357948 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:05.227716923 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.227891922 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:05.228352070 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.230808973 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.231471062 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.231487036 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.231504917 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.231518984 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.231534004 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.231549978 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.231564999 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.231580019 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.231595039 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.231611967 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.231626987 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.231642008 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.236129999 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:05.236224890 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:05.238785982 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.238806009 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.238931894 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.239074945 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.239384890 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.239701033 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.239716053 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.239731073 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.239993095 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.240307093 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.240597010 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.240885019 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.241504908 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.241520882 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.241535902 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.241549969 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.241564989 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.281591892 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.478866100 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.483835936 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.483943939 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.484019995 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.484035015 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.484468937 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.484509945 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.484714031 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.484932899 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.485095024 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.485249043 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.485663891 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.485719919 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.485940933 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.486152887 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.486306906 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.486635923 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.486713886 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.486932039 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.487188101 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.487783909 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.487982988 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.488234043 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.497663021 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:05.497744083 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:05.529681921 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.558732986 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:05.558821917 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:05.745501995 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.745562077 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.745771885 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.745807886 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.745901108 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.746395111 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.746849060 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.746915102 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.746948957 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.746982098 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.747015953 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.747046947 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.747240067 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.747370958 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.747575998 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.747833014 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.748171091 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.748364925 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.748490095 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.748522043 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.748836994 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.748869896 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.749013901 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.749393940 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.749425888 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.806379080 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.806499958 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.806574106 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.806792021 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.806838036 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.806977987 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.807188988 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.807339907 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.807539940 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.808171034 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.808274031 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.808326960 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.808413029 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.808445930 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.808589935 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.808980942 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.809355974 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.809686899 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.809806108 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.809987068 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.810281038 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:05.826842070 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:05.826942921 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:05.826942921 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:05.826989889 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:05.827028036 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:06.074338913 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.074697971 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.074716091 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.074810982 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.074947119 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.075191975 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.075207949 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.075398922 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.075558901 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.075959921 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.076035976 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.076189041 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.076296091 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.076442957 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.076554060 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.076811075 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.077044964 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.077138901 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.077312946 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.077459097 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.077661991 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.077760935 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.077948093 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.078124046 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.078289986 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.078471899 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.078679085 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.079037905 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.079128027 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.079305887 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.079464912 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.079673052 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.079823971 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.079956055 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.080172062 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.080708027 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.153618097 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:06.153744936 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:06.153744936 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:06.153794050 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:06.153856039 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:06.401278019 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.401335001 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.401434898 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.401527882 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.401784897 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.401890993 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.402097940 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.402132034 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.402240992 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.402442932 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.402631998 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.402827978 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.402987957 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.403198957 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.403225899 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:06.403295040 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.403484106 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.403517008 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.403661013 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.403872967 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.403964996 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.404081106 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.650646925 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.651019096 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.651087999 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.651428938 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.651496887 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.651794910 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.651938915 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.652013063 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.653803110 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.706568003 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:06.732177019 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:06.979613066 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.979640961 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.979759932 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.979911089 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:06.981028080 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:07.034692049 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:07.916361094 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:08.166668892 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:08.222152948 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:08.227823019 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:08.476027966 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:08.490236998 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:08.737517118 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:08.737848043 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:08.737883091 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:08.738697052 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:08.784646034 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:08.869728088 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:09.120930910 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:09.126074076 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:09.375498056 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:09.381098032 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:09.629509926 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:09.675282955 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:10.640291929 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:10.894629955 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:10.897517920 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:11.147380114 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:11.149955988 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:11.398586035 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:11.400702000 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:11.648658037 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:11.655749083 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:11.904253960 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:11.906090975 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:12.154470921 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:12.157423019 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:12.406685114 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:12.407926083 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:12.656384945 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:12.706535101 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:12.833216906 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:13.081639051 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:13.082210064 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:13.330318928 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:13.331288099 CEST	49704	28380	192.168.2.5	5.42.65.96
Apr 26, 2024 16:29:13.582890034 CEST	28380	49704	5.42.65.96	192.168.2.5
Apr 26, 2024 16:29:13.617007017 CEST	49704	28380	192.168.2.5	5.42.65.96

Target ID:	0
Start time:	16:28:52
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x250000
File size:	507'904 bytes
MD5 hash:	EA8B223863892068E3CFAB601CAF53D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:28:53
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:28:53
Start date:	26/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x440000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:28:53
Start date:	26/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x480000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000004.00000002.2204664213.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000004.00000002.2206870926.00000000029C7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2206870926.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	51

Executed Functions

Function 0026650C Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57fba0a0e8fca70ba91267858fdd6062cbd777d378e32fe33648f31ae7b35ac6
Instruction ID: 4b8a0a8433f9b2cce0f4e20960bac85797d55ea9c35a4fddec325a202fb35bb5
Opcode Fuzzy Hash: 57fba0a0e8fca70ba91267858fdd6062cbd777d378e32fe33648f31ae7b35ac6
Instruction Fuzzy Hash: 8DF0E572A21230DBCB12DB4CC54AE5973ACEB05B51F510096F402E7540C2B0DE50CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 00265EAF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,0010445D,?,00265FBC,?,?,?,00000000), ref: 00265F70

Strings

api-ms-, xrefs: 00265F06
ext-ms-, xrefs: 00265F1A

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: fd942019d21e8f25ce32c289efcf211c124255be8ff4b35244afe4a557d19d51
Instruction ID: a6aa1618688ba9d999b03fe62dbe2e47ebda94ceff6b4dfedfe97b712ebc8e3d
Opcode Fuzzy Hash: fd942019d21e8f25ce32c289efcf211c124255be8ff4b35244afe4a557d19d51
Instruction Fuzzy Hash: 7221E731A22A22EBCB219F60FC58A5A3758EF53760F254111F919A7690E770EE90C6D0

Uniqueness

Uniqueness Score: -1.00%

Function 00273416 Relevance: 8.1, APIs: 3, Strings: 1, Instructions: 1058
sleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00251FDD: _strlen.LIBCMT ref: 00251FF5

VirtualProtect.KERNELBASE(002CD040,000004AC,00000040,?,006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@), ref: 00273468
FreeConsole.KERNELBASE ref: 0027346E
Sleep.KERNELBASE(0000012C,0027339A), ref: 0027348E

Strings

006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@, xrefs: 00273427

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: ConsoleFreeProtectSleepVirtual_strlen
String ID: 006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@
API String ID: 3830758701-32248209
Opcode ID: d7c06c8a34fa56406f6a713c2d9b8cce1f59a0a00bf56ef38d0d976aadf80e7b
Instruction ID: 0d2303c7c5460a745385490e9cfcd27b057a9a40e95dd1972bd55608ad6a8bf1
Opcode Fuzzy Hash: d7c06c8a34fa56406f6a713c2d9b8cce1f59a0a00bf56ef38d0d976aadf80e7b
Instruction Fuzzy Hash: 0C11A331A612049BCB18FB74DC5AFED77B0AF05311F508025F509B61D1EF749A69CB19

Uniqueness

Uniqueness Score: -1.00%

Function 002672D2 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00267359
__alloca_probe_16.LIBCMT ref: 0026741A
__freea.LIBCMT ref: 00267481

Part of subcall function 00264AE0: HeapAlloc.KERNEL32(00000000,?,?,?,00000003,002636BA), ref: 00264B12

__freea.LIBCMT ref: 00267496
__freea.LIBCMT ref: 002674A6

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: c0dfb833ba1738298b99a56290bf61d9b341bee48cae83ee3ebe9bea16e7418a
Instruction ID: 1f76d3643d243731411197d843470805608a833881f5d0f5b565a4dfbae4aa94
Opcode Fuzzy Hash: c0dfb833ba1738298b99a56290bf61d9b341bee48cae83ee3ebe9bea16e7418a
Instruction Fuzzy Hash: 3C51C572624207AFEB219F64EC85EBF7BA9EF44758B150168FC04D7250EB70CCB09A60

Uniqueness

Uniqueness Score: -1.00%

Function 0025DE3B Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,?,Function_0000DCDF,00000000,?,00000000), ref: 0025DE84
GetLastError.KERNEL32(?,00000000,05D1745D,?,?,?,?,?,?,?,002534EF,?,00000000,?,?,?), ref: 0025DE90
__dosmaperr.LIBCMT ref: 0025DE97

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: e6be9660b342fb0f0d6c0a732b12d48450c771916e5e8bcc391d27c819632d9e
Instruction ID: 40d13cf01dec2cf537eb7a5686cbc5de1d624b807ce95400438007afdfbe1889
Opcode Fuzzy Hash: e6be9660b342fb0f0d6c0a732b12d48450c771916e5e8bcc391d27c819632d9e
Instruction Fuzzy Hash: F801B17252121AEFDF29AFA0DC06AAE7BB5FF11352F000058FC0196250DB70DE68DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00254590 Relevance: 4.5, APIs: 3, Instructions: 33
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,002540CE,?,?,00000000,?,?,00000000,?,?,00252FAB), ref: 0025459C
GetExitCodeThread.KERNEL32(?,?,?,?,?,002540CE,?,?,00000000,?,?,00000000,?,?,00252FAB,?), ref: 002545B5
FindCloseChangeNotification.KERNELBASE(?,?,?,?,002540CE,?,?,00000000,?,?,00000000,?,?,00252FAB,?,00000001), ref: 002545C7

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: ChangeCloseCodeExitFindNotificationObjectSingleThreadWait
String ID:
API String ID: 3816883391-0
Opcode ID: c96c93bfa9e473d4ed29108f3d82edf6d88d892fb6441880183363e74666f663
Instruction ID: e22d8b1f7ea708cdd5ba56ac238081b47cb35de9dc1b701f708ead583933777f
Opcode Fuzzy Hash: c96c93bfa9e473d4ed29108f3d82edf6d88d892fb6441880183363e74666f663
Instruction Fuzzy Hash: C7F08232514119EBDB10AF64EC09B9D7B64EF11775F640310FD26D61E0E730DFA4AA84

Uniqueness

Uniqueness Score: -1.00%

Function 0025DD94 Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00263751: GetLastError.KERNEL32(00000000,?,0025E852,002648AB,?,?,0026364D,00000001,00000364,?,00000002,000000FF,?,0025DD04,0027D328,0000000C), ref: 00263755
Part of subcall function 00263751: SetLastError.KERNEL32(00000000), ref: 002637F7

CloseHandle.KERNEL32(?,?,?,0025DECB,?,?,0025DD3D,00000000), ref: 0025DDC5
FreeLibraryAndExitThread.KERNELBASE(?,?,?,?,0025DECB,?,?,0025DD3D,00000000), ref: 0025DDDB
ExitThread.KERNEL32 ref: 0025DDE4

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary
String ID:
API String ID: 1991824761-0
Opcode ID: d188dd0d3229a43d224841041a867e83b96b63ebd6e38da7faaaf4f20caa863c
Instruction ID: 499abb0a4a982cf8067767d5efc8b41724420dab17808af0e6f11b4cb4b5bcb3
Opcode Fuzzy Hash: d188dd0d3229a43d224841041a867e83b96b63ebd6e38da7faaaf4f20caa863c
Instruction Fuzzy Hash: 5DF089331126016BCB356F75CC0C65677B9AF01326F154654FC29C71B0DB30DCA9C655

Uniqueness

Uniqueness Score: -1.00%

Function 0026136F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,?,00261369,0025DFC6,0025DFC6,?,00000002,0010445D,0025DFC6,00000002), ref: 00261380
TerminateProcess.KERNEL32(00000000,?,00261369,0025DFC6,0025DFC6,?,00000002,0010445D,0025DFC6,00000002), ref: 00261387
ExitProcess.KERNEL32 ref: 00261399

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 54d3b660b0c4bdf197fd1625e4819a70eaaa2bab6d4f4536350e4b2adc032b1b
Instruction ID: b7b51a5ee5e66055ed47ca04d36fc7866b441b530a24aff1c590cae0d1744f39
Opcode Fuzzy Hash: 54d3b660b0c4bdf197fd1625e4819a70eaaa2bab6d4f4536350e4b2adc032b1b
Instruction Fuzzy Hash: 84D06C32010208ABCF053FA1FC0D9593F2ABA80342B088051BA0A4A131CB32A9F29A91

Uniqueness

Uniqueness Score: -1.00%

Function 00268A3D Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00268187: GetConsoleOutputCP.KERNEL32(0010445D,00000000,00000000,00000000), ref: 002681EA

WriteFile.KERNEL32(?,00000000,?,0027D798,00000000,0000000C,00000000,00000000,?,00000000,0027D798,00000010,0025FC7A,00000000,00000000,00000000), ref: 00268BA6
GetLastError.KERNEL32(?,00000000), ref: 00268BB0

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 7b0823b62b103811b9c1602bd6c86641a214e466b9681bd497f2cf6e8731a73b
Instruction ID: 3388feecb5813d1a025adc420cb779b3b2faf6a109edc8cdac2c7b6b12fa4f61
Opcode Fuzzy Hash: 7b0823b62b103811b9c1602bd6c86641a214e466b9681bd497f2cf6e8731a73b
Instruction Fuzzy Hash: 7961A6B1D20149AFDF15CFA8C884EEEBBB9EF09318F144245E804E7252DB71C9A5CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0026A6CB Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0026A1FB: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 0026A226

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,0026A512,?,00000000,?,00000000,?), ref: 0026A72C
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,0026A512,?,00000000,?,00000000,?), ref: 0026A76E

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: f8c93dfbb9e8783d167fc496f279cc047b5a79ee591389880548a54f90906c33
Instruction ID: 8d7e521e129ec322bd750b6a558397d02291ccd6ba1d7f3b3e43e31ced4f2b25
Opcode Fuzzy Hash: f8c93dfbb9e8783d167fc496f279cc047b5a79ee591389880548a54f90906c33
Instruction Fuzzy Hash: 7B512570A103469EDB21CF75C885AAEFBF5EF81300F14446ED086A7252E7749996CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00255A4E Relevance: 3.1, APIs: 2, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Fputc.LIBCPMT ref: 00255B27

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: Fputc
String ID:
API String ID: 3078413507-0
Opcode ID: dbbb5526558c4ac3f756023ee40c31dabc7d35c493743e3b3bae6cee53ca9999
Instruction ID: c20e87860d4314215841a65438118f96a202e1a55a31e73d62838c2d186aadd3
Opcode Fuzzy Hash: dbbb5526558c4ac3f756023ee40c31dabc7d35c493743e3b3bae6cee53ca9999
Instruction Fuzzy Hash: B2418236920A2BABCF15DF64C4D48EDB7B8FF08315B584126F802A7640E731ED69CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0026863F Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,00000000,?,00268B8C,00000000,00000000,00000000,?,0000000C,00000000), ref: 002686DB
GetLastError.KERNEL32(?,00268B8C,00000000,00000000,00000000,?,0000000C,00000000,00000000,?,00000000,0027D798,00000010,0025FC7A,00000000,00000000), ref: 00268701

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 108ce720821c91f81d4774ddf1ad890a9bf025172972f7329ddace0fe1a8f06c
Instruction ID: 216da1b649ef86ab33d5d25b14c06f2a3cb93a672012738a396ffb0f5e5d062e
Opcode Fuzzy Hash: 108ce720821c91f81d4774ddf1ad890a9bf025172972f7329ddace0fe1a8f06c
Instruction Fuzzy Hash: 0121B474A102199BCF19CF19DC80AD9B7B9EB58305F2441A9E906D7211DB30DD968F60

Uniqueness

Uniqueness Score: -1.00%

Function 00265B9D Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00265BE9
GetFileType.KERNELBASE(00000000), ref: 00265BFB

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: d563486cb309aecc1daf2a814f1907284938f65579cc45b496383d6a7d64eea0
Instruction ID: 2f9beeb1402cd43db4b66cddaf52e89cb735172b0780107f98f7bbc1175482ac
Opcode Fuzzy Hash: d563486cb309aecc1daf2a814f1907284938f65579cc45b496383d6a7d64eea0
Instruction Fuzzy Hash: 9C11D331234F668AC7304E3E9CC8622BA95AB56374F380B1BE1B7861F1C774D9E69644

Uniqueness

Uniqueness Score: -1.00%

Function 0025DCDF Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(0027D328,0000000C), ref: 0025DCF2
ExitThread.KERNEL32 ref: 0025DCF9

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 22b0f3f7749bc762bd50d65d9ce4c9839b6d55cd5787f45c7fdbd0cc9521f747
Instruction ID: 756301659d67ec0f59ca438e136cbe79125504833280c398b665d95d9b82eede
Opcode Fuzzy Hash: 22b0f3f7749bc762bd50d65d9ce4c9839b6d55cd5787f45c7fdbd0cc9521f747
Instruction Fuzzy Hash: 0EF0F671910205AFDB14BFB0D80EB6E7B75FF51701F140049F8099B252CB34A9A5CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00266389 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,002673C0,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 002663BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,002673C0,?,?,00000000,?,00000000), ref: 002663DB

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 60677cdbf17ff8216757779259a3e818684735584fd828014dc8a3e5c8a10f60
Instruction ID: c3486b0763345ccc6d917d3ee90d615e4f7655297e6d4f4634599ce684aa062b
Opcode Fuzzy Hash: 60677cdbf17ff8216757779259a3e818684735584fd828014dc8a3e5c8a10f60
Instruction Fuzzy Hash: B8F07A3241012ABBCF126F91EC09DDE7F26EF487A0F058011FA1965120CB32C9B2AB90

Uniqueness

Uniqueness Score: -1.00%

Function 002540AA Relevance: 3.0, APIs: 2, Instructions: 28
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 002540B5
std::_Throw_Cpp_error.LIBCPMT ref: 002540E3

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: Cpp_errorCurrentThreadThrow_std::_
String ID:
API String ID: 350343453-0
Opcode ID: 82d9f69051636ccbb5099e83b2cb07d2ebbc632bd15a202fa99ef73ad9e3d3c1
Instruction ID: cef0a19131176d528bf27e43fd6b9d79a16408ab0fd1ec163c03385b2c57c867
Opcode Fuzzy Hash: 82d9f69051636ccbb5099e83b2cb07d2ebbc632bd15a202fa99ef73ad9e3d3c1
Instruction Fuzzy Hash: 4DE09239530601DAD7343E15AC02B12F6E49B90B1BF20842EAE9686485E6B148FCDA69

Uniqueness

Uniqueness Score: -1.00%

Function 0026A2CF Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(E8458D00,?,0026A51E,0026A512,00000000), ref: 0026A301

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: dd18851374263c849752d6d361de9f7fbab9805d7ecb30eb539f93dcd3dbfac4
Instruction ID: f82e92b72a1bf4fdb5e28380c9e9ae39e6703ef5174dc3ec1b68ab8966d05f4e
Opcode Fuzzy Hash: dd18851374263c849752d6d361de9f7fbab9805d7ecb30eb539f93dcd3dbfac4
Instruction Fuzzy Hash: 60516A715282589ACB218F28CC84BEA7BBCEB46304F2401E9E49AE7142C7749DD6DF21

Uniqueness

Uniqueness Score: -1.00%

Function 00265F7A Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a481de3515bf28373cfcf87f9550fde37c0a9f0f36b786c5cb44ba4481b4fad
Instruction ID: a9733cd4ee314e2d07e1e4cbe75ed9658c677e710cb0d63ef4f473a9293d7475
Opcode Fuzzy Hash: 2a481de3515bf28373cfcf87f9550fde37c0a9f0f36b786c5cb44ba4481b4fad
Instruction Fuzzy Hash: 2901D837724A329F9B158E6DEC4496A3396FBC6360B244120F915DBA99DF30DCE18790

Uniqueness

Uniqueness Score: -1.00%

Function 00251D1E Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00251D73

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: ae8d3e276578ffff6771016ebf4a225cd94da564857fc5d2eb0fa16574749992
Instruction ID: 1662ed6b6201cf9284fcb4ef489036010a6fa2c1da6d058e5c5e7a0b01f0c08d
Opcode Fuzzy Hash: ae8d3e276578ffff6771016ebf4a225cd94da564857fc5d2eb0fa16574749992
Instruction Fuzzy Hash: 68F0247211530A7FC220AE10EC46E27BB6CDB523A6F10001EFA4417141EA32A87CCBB8

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0026DAD1 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0026DCB5

Strings

1#INF, xrefs: 0026DC07
1#QNAN, xrefs: 0026DBE4
1#IND, xrefs: 0026DBD6
1#SNAN, xrefs: 0026DBDD

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 8e4c116a7eb4ee3e1558b981e86b8f2ae6b16fc1d05b6e16707167aef8256b0d
Instruction ID: b6ee7c388474b5b8b6f086312f594ccb3959f56cfb046adec39ab3a501e85e12
Opcode Fuzzy Hash: 8e4c116a7eb4ee3e1558b981e86b8f2ae6b16fc1d05b6e16707167aef8256b0d
Instruction Fuzzy Hash: 25D22675E282298BDF65CE28CC407EAB7B9EB44304F1541EAD44EE7240EB74AED58F41

Uniqueness

Uniqueness Score: -1.00%

Function 0026CF31 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0026D24F,00000002,00000000,?,?,?,0026D24F,?,00000000), ref: 0026CFCA
GetLocaleInfoW.KERNEL32(?,20001004,0026D24F,00000002,00000000,?,?,?,0026D24F,?,00000000), ref: 0026CFF3
GetACP.KERNEL32(?,?,0026D24F,?,00000000), ref: 0026D008

Strings

OCP, xrefs: 0026CF85
ACP, xrefs: 0026CF4F

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 6e4b8d924c29abd5f7304e0c3a984cf7fb8ce01d6afe6c661fe4cf4bf631967a
Instruction ID: 1290f5cb0f619cd13ea0d72fa00163f35c1eafefcfb7b518887911832eabb665
Opcode Fuzzy Hash: 6e4b8d924c29abd5f7304e0c3a984cf7fb8ce01d6afe6c661fe4cf4bf631967a
Instruction Fuzzy Hash: 2A21D632B20107B6D734AF14D904BA772A7BB54B50B768026E98DD7504F772DDE0C790

Uniqueness

Uniqueness Score: -1.00%

Function 0026D106 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00263600: GetLastError.KERNEL32(?,?,0025DD04,0027D328,0000000C), ref: 00263604
Part of subcall function 00263600: SetLastError.KERNEL32(00000000), ref: 002636A6

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0026D212
IsValidCodePage.KERNEL32(00000000), ref: 0026D25B
IsValidLocale.KERNEL32(?,00000001), ref: 0026D26A
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0026D2B2
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0026D2D1

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: d5a2d862b5e366c5e591921964bc1db3c9aa1cc93723bc5167b3c1a1dee0722a
Instruction ID: 7c710bec21f6e30a3588e7476cf41352a183b5d2644511d8f69b472b7a6a04c1
Opcode Fuzzy Hash: d5a2d862b5e366c5e591921964bc1db3c9aa1cc93723bc5167b3c1a1dee0722a
Instruction Fuzzy Hash: 4A518371F2020AABDB10EFA4DC85ABA77B8FF49700F144169F915E7151EBB0D9A08B60

Uniqueness

Uniqueness Score: -1.00%

Function 00260160 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Strings

}&, xrefs: 002604A3, 00260481
}&, xrefs: 0026017B, 002602FE, 00260527, 002604C0, 0026034D

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID:
String ID: }&$}&
API String ID: 0-2963072621
Opcode ID: cc5fc3ef393b46102073ef610e3e9dbb82813f9c322e73eebb45c748b4ac2cad
Instruction ID: d6aaba01779d6a1fea9e33e297fe933f49470ab8b318c23ca937b03925975027
Opcode Fuzzy Hash: cc5fc3ef393b46102073ef610e3e9dbb82813f9c322e73eebb45c748b4ac2cad
Instruction Fuzzy Hash: 83F14E71E1021A9FDF14CFA8C8D06AEB7B1FF88324F158269E919A7380D730AD559F94

Uniqueness

Uniqueness Score: -1.00%

Function 0026C7A2 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00263600: GetLastError.KERNEL32(?,?,0025DD04,0027D328,0000000C), ref: 00263604
Part of subcall function 00263600: SetLastError.KERNEL32(00000000), ref: 002636A6

GetACP.KERNEL32(?,?,?,?,?,?,00261D22,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0026C863
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00261D22,?,?,?,00000055,?,-00000050,?,?), ref: 0026C88E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0026C9F1

Strings

utf8, xrefs: 0026C960

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 5d0f4f6dfa154e253278587831c8125b651128e8611238b22f4b1b92de26e7e7
Instruction ID: 7ac61055f05a572daa42ff4cc234798232fbff4dc8a1d685f4715a7dca77972a
Opcode Fuzzy Hash: 5d0f4f6dfa154e253278587831c8125b651128e8611238b22f4b1b92de26e7e7
Instruction Fuzzy Hash: 9A711771621206AADB25BF74CC46BB673ACEF09700F244429F585D7181FBB4E9E0CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00264C33 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00264CC0

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c8b3115fbadac6014dafda632bdcae0fab0cd1c18024c0d8385e16eb91cb886f
Instruction ID: b427a9259a8e80c7ace5775f904646126a089b59c25157f841f32006c8817fab
Opcode Fuzzy Hash: c8b3115fbadac6014dafda632bdcae0fab0cd1c18024c0d8385e16eb91cb886f
Instruction Fuzzy Hash: AEB17B32D242469FDB15EF68C881BEEBBE5FF55300F158166E894AB341C2359DA1CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00257093 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0025709F
IsDebuggerPresent.KERNEL32 ref: 0025716B
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00257184
UnhandledExceptionFilter.KERNEL32(?), ref: 0025718E

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: df521bf5aee74bbda2c29827d2d0e70c786dae944c8004b62f73a43ac998da60
Instruction ID: bde0b176d3348d1145fbb380f400279644e601c184b18548ba4db4d170d6b7d9
Opcode Fuzzy Hash: df521bf5aee74bbda2c29827d2d0e70c786dae944c8004b62f73a43ac998da60
Instruction Fuzzy Hash: 7F312C75D55219DBDF20EFA4E8497CDBBB8AF48300F10419AE90DAB250EB709A84CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0026CBB5 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00263600: GetLastError.KERNEL32(?,?,0025DD04,0027D328,0000000C), ref: 00263604
Part of subcall function 00263600: SetLastError.KERNEL32(00000000), ref: 002636A6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0026CC09
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0026CC53
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0026CD19

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 7a2f8336b3b17bef7734e980345c714b2adb8f280dd21db4a6eac20a3826d413
Instruction ID: 1306ed6327d1ff75cb796cc7395d5b8dc4cccd54793a863faf1b472f7e8566ad
Opcode Fuzzy Hash: 7a2f8336b3b17bef7734e980345c714b2adb8f280dd21db4a6eac20a3826d413
Instruction Fuzzy Hash: 196184719201179FDB28AF28CD86BBA7BA8FF05300F2041B6E955C6185EB74D9E1CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0025ADD3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0025AECB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0025AED5
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 0025AEE2

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: f2f095300724e70777cbb84e5e2d99e3235eaaa11b7824543bd397eb710422c7
Instruction ID: 2fb33c8aa45193f6194fdbbfa1cc6d63f972ae919c80e4c38e8cd6c451c972a4
Opcode Fuzzy Hash: f2f095300724e70777cbb84e5e2d99e3235eaaa11b7824543bd397eb710422c7
Instruction Fuzzy Hash: 4E31D4749112299BCB21DF64D88978DBBB8BF48311F5042EAE81CA7250EB709FD58F49

Uniqueness

Uniqueness Score: -1.00%

Function 00264213 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0026420E,?,?,00000008,?,?,00272345,00000000), ref: 00264440

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0b22adc9a9c17e9e80ccf69c5a8707553d83f9447c2191d3e82b4fcaca8e5126
Instruction ID: 7a74b6b2cf5a67f8ca9906708a97d4622a5fe7ddb9acd611e0a4d950c50af939
Opcode Fuzzy Hash: 0b22adc9a9c17e9e80ccf69c5a8707553d83f9447c2191d3e82b4fcaca8e5126
Instruction Fuzzy Hash: C9B15E31220609DFD718DF28C486B657BE0FF45364F258698E8D9CF2A1C735E9A2CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00256B7C Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00256B92

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 94a7d49f349cde4134f80f2485f077a20fce010b10d1f7954007cd2f99e7c699
Instruction ID: ad46d95f9e30e4ee5fb16548c79efcd6a3f8b9536f66fd1d6d61d13d24c0fca9
Opcode Fuzzy Hash: 94a7d49f349cde4134f80f2485f077a20fce010b10d1f7954007cd2f99e7c699
Instruction Fuzzy Hash: 0751B071A226068BDB68CF65E8C93AEB7F0FB44312F24842AC849EB350D3749D58CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00269C1F Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018c72106fa2d0d2ba6754f344609430137466f6c4620b6345ace9038fe727ca
Instruction ID: 3c0168ab07e2001f07c13e2c83502475eaf62ac5175204943e6b6a085abc7b07
Opcode Fuzzy Hash: 018c72106fa2d0d2ba6754f344609430137466f6c4620b6345ace9038fe727ca
Instruction Fuzzy Hash: 3741B2B5814219AEDF20DF69CC89AAABBBCEB49300F1442E9E41DD3201DA359ED48F50

Uniqueness

Uniqueness Score: -1.00%

Function 0025CF44 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 0025D0D2

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 996fd7d5141208f1b8db28b845563de59e8b988a7265e3ff6f6678d28e6d1fae
Instruction ID: a1e610584a582094d9860f08d251af8a467c6b110bd1772a326bf883c58b5a4f
Opcode Fuzzy Hash: 996fd7d5141208f1b8db28b845563de59e8b988a7265e3ff6f6678d28e6d1fae
Instruction Fuzzy Hash: 36C1E0305206068FCB34CF68C48067EBBB2AF45302F244A1ADC56DB692D770ED6ECB59

Uniqueness

Uniqueness Score: -1.00%

Function 0026CE08 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00263600: GetLastError.KERNEL32(?,?,0025DD04,0027D328,0000000C), ref: 00263604
Part of subcall function 00263600: SetLastError.KERNEL32(00000000), ref: 002636A6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0026CE5C

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 6cae0339eb3a6820099663f6bcc66baaef786e02fec6ef35f3c11f94eafdc2e4
Instruction ID: cbfca6d5666f6bbe0ed924ac297adb85896c50b48bc36203343b1a38f8ca03c4
Opcode Fuzzy Hash: 6cae0339eb3a6820099663f6bcc66baaef786e02fec6ef35f3c11f94eafdc2e4
Instruction Fuzzy Hash: 63219572625207ABDB28BF25DC46B7A77BCEF45310B20007AFD11D6141EB75EDA08B54

Uniqueness

Uniqueness Score: -1.00%

Function 0026CA8F Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00263600: GetLastError.KERNEL32(?,?,0025DD04,0027D328,0000000C), ref: 00263604
Part of subcall function 00263600: SetLastError.KERNEL32(00000000), ref: 002636A6

EnumSystemLocalesW.KERNEL32(0026CBB5,00000001,00000000,?,-00000050,?,0026D1E6,00000000,?,?,?,00000055,?), ref: 0026CB01

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e9760e3415e7b1714946d2f8b1776188d05d9e3cccea95d4851ac74caa6bd3f0
Instruction ID: 470945c3ceafe149e24154e0757cc1291bd20635426dbd3b38e45726e70f9d9d
Opcode Fuzzy Hash: e9760e3415e7b1714946d2f8b1776188d05d9e3cccea95d4851ac74caa6bd3f0
Instruction Fuzzy Hash: 02114C372103069FDB18EF78D89257AB791FF84318B24442DE9C687B40D7717992CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0026D037 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00263600: GetLastError.KERNEL32(?,?,0025DD04,0027D328,0000000C), ref: 00263604
Part of subcall function 00263600: SetLastError.KERNEL32(00000000), ref: 002636A6

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0026CDD1,00000000,00000000,?), ref: 0026D063

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 7d58e6d17ee8d4d67848b303bb6b131240823fd87463248a0892eb680c3ab5b8
Instruction ID: d1656877da8a135e40c037feadb1f6ad8d82c123ce1ddf768179368de8e06f59
Opcode Fuzzy Hash: 7d58e6d17ee8d4d67848b303bb6b131240823fd87463248a0892eb680c3ab5b8
Instruction Fuzzy Hash: 9EF0A932F2011BBBDB285E74CC06BBA7B58EB40754F154424ED05A7180EA74FED2C690

Uniqueness

Uniqueness Score: -1.00%

Function 0026CB2A Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00263600: GetLastError.KERNEL32(?,?,0025DD04,0027D328,0000000C), ref: 00263604
Part of subcall function 00263600: SetLastError.KERNEL32(00000000), ref: 002636A6

EnumSystemLocalesW.KERNEL32(0026CE08,00000001,?,?,-00000050,?,0026D1AA,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0026CB74

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 53bb000253c67600d489d52f50acae4afd879df00557a408b1b3f40beba542fe
Instruction ID: 78a1d7896e1b7134d60cfb8bb35fd816372288fb37173fc7045df552fa4a5433
Opcode Fuzzy Hash: 53bb000253c67600d489d52f50acae4afd879df00557a408b1b3f40beba542fe
Instruction Fuzzy Hash: DDF022362143056FCB24AF39D882A7ABB94EB8132CB24842DF9864B680C7719C91CA50

Uniqueness

Uniqueness Score: -1.00%

Function 00265CE6 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0025DF0D: EnterCriticalSection.KERNEL32(?,?,002632D8,?,0027D618,00000008,0026349C,?,?,?), ref: 0025DF1C

EnumSystemLocalesW.KERNEL32(00265CD9,00000001,0027D6D8,0000000C,00266148,00000000), ref: 00265D1E

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: cf76294a6c72f7ca339d3d6bdd711d0bbe3b7bf37b5216e0de5e44b30830b78a
Instruction ID: 64a8b2033525eae307467c0ab7650c1fdc3dcbbf71d88b617898ba67cc35d37c
Opcode Fuzzy Hash: cf76294a6c72f7ca339d3d6bdd711d0bbe3b7bf37b5216e0de5e44b30830b78a
Instruction Fuzzy Hash: 66F04976A54200DFD700EF98E846B9D77B0FB05721F10852AF815EB2A1DBB54954CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0026CA44 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00263600: GetLastError.KERNEL32(?,?,0025DD04,0027D328,0000000C), ref: 00263604
Part of subcall function 00263600: SetLastError.KERNEL32(00000000), ref: 002636A6

EnumSystemLocalesW.KERNEL32(0026C99D,00000001,?,?,?,0026D208,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0026CA7B

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 4a09dca08f0663b2e5b446066442469f4713a1cf4e1d48d2b781133c139a0a1b
Instruction ID: aa186a60b4bb01ad7b80c27aa744d0f4dc68061596e58c3ee105b0030ee492aa
Opcode Fuzzy Hash: 4a09dca08f0663b2e5b446066442469f4713a1cf4e1d48d2b781133c139a0a1b
Instruction Fuzzy Hash: 81F0E53630020A57CB08EF75D84A67ABF94EFC2710B1A8059EA4A8B650C7719D92C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0026624C Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00262888,?,20001004,00000000,00000002,?,?,00261E8A), ref: 00266280

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 6ecc844be3ac6764e6b4066af36477ec8b695093338508e877c4fec67942ac1d
Instruction ID: 729f343196babdbab710ca3a146eb6d8d55bae63c92086ab1d528b1fcb37fa25
Opcode Fuzzy Hash: 6ecc844be3ac6764e6b4066af36477ec8b695093338508e877c4fec67942ac1d
Instruction Fuzzy Hash: B0E04F35910129BBCF123F61EC0CEAE7F25EF44750F044011FD0965261CB7189B1AAD4

Uniqueness

Uniqueness Score: -1.00%

Function 002571EF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000071FB,0025675F), ref: 002571F4

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2288b6c392170990a64a5ede5dee5a61a42335225e5936fcb3584182fe28f2ad
Instruction ID: e8572b13685bc8a7e5204db1bfd3d6c1e687e7efbc78ee8c687a6edc4a6ae0d9
Opcode Fuzzy Hash: 2288b6c392170990a64a5ede5dee5a61a42335225e5936fcb3584182fe28f2ad
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0026D368 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0026D368

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 3ff8b9a0518009edd3a000567832c768d7559efa89bfb335461bc6f9d47cba8d
Instruction ID: e03fb8e4adcb2777babe5d681872cfa5c284a56fb0d5cf776163077dd37a5056
Opcode Fuzzy Hash: 3ff8b9a0518009edd3a000567832c768d7559efa89bfb335461bc6f9d47cba8d
Instruction Fuzzy Hash: E4A02230382202CF8380AF3ABF0C30E3AECAA082C0B8080F8A00CC2830EB3080C08F00

Uniqueness

Uniqueness Score: -1.00%

Function 00287555 Relevance: .9, Instructions: 946COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc75d264d6df0c974cfefd35eba923a3b78640df4b29e97193cdf58164f43ca1
Instruction ID: fb3ebf288ac9c4b02f2f80e7d725f9ab67d858e53510094abfdb99ac4191145f
Opcode Fuzzy Hash: cc75d264d6df0c974cfefd35eba923a3b78640df4b29e97193cdf58164f43ca1
Instruction Fuzzy Hash: C672336144F3D29FD7235B748C749E27FB4AE6721432E08DBD4C18B0A3E2191A6AD772

Uniqueness

Uniqueness Score: -1.00%

Function 00286DD0 Relevance: .6, Instructions: 555COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dabb241905c3eb9b0e1454d179015fc64f1cf1698284bc9214990e0cc0263b2c
Instruction ID: 749903b2cbd6a58004e9553f3ee1f4ab6d2944a631bea3960ab963af41fffcc4
Opcode Fuzzy Hash: dabb241905c3eb9b0e1454d179015fc64f1cf1698284bc9214990e0cc0263b2c
Instruction Fuzzy Hash: 2C22F26144F3C28FC7138B749CB56917FB0AE6722431E45DBD8C1CF4A3E2291A5ADB62

Uniqueness

Uniqueness Score: -1.00%

Function 0026C253 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 2606b65d88e2cf1bf92911d0187a0c7a8f71f517fe91556766bef729f3405af3
Instruction ID: 1d0d8d513e6254ab0ae37a2a17b99c33dca0ed8b9f8152f8806d4ef196b3ab9f
Opcode Fuzzy Hash: 2606b65d88e2cf1bf92911d0187a0c7a8f71f517fe91556766bef729f3405af3
Instruction Fuzzy Hash: 32B1E7756207468BDB34AF24CC92BB7B3A8EF44308F64456DE983C6640EAB5F9D58B10

Uniqueness

Uniqueness Score: -1.00%

Function 00266550 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23ebd0bd5e6436c6e2895a3075ff04c1db8902bf7fd9e8bc258d8b36fe32f176
Instruction ID: 0740f571c5bddcefba1886bc75db29b3d2e5725c4d89ac0c9f2f347984bcceab
Opcode Fuzzy Hash: 23ebd0bd5e6436c6e2895a3075ff04c1db8902bf7fd9e8bc258d8b36fe32f176
Instruction Fuzzy Hash: CEE08C32A21238EBCB24DB8CC90998AF7FCEB49B00F51009AB502D3510C270DE40CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 002613E3 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3da4f83a5918d30f6bdc2d3a9b5a9a71a98674656316bf03d7550efdecabfc24
Instruction ID: 4782fc9b8ba67a585e9b3ec6c0d3d695583964920f8fb8d17f07275d7d8e7d1b
Opcode Fuzzy Hash: 3da4f83a5918d30f6bdc2d3a9b5a9a71a98674656316bf03d7550efdecabfc24
Instruction Fuzzy Hash: 37C08CB402098046CE298E348277BA43354B391783F88088CC4430BB82CD1EACE7DA00

Uniqueness

Uniqueness Score: -1.00%

Function 00259CE8 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00259E07
___TypeMatch.LIBVCRUNTIME ref: 00259F15
_UnwindNestedFrames.LIBCMT ref: 0025A067
CallUnexpected.LIBVCRUNTIME ref: 0025A082

Strings

csm, xrefs: 00259E3E
pS', xrefs: 00259DFE
csm, xrefs: 00259D25
csm, xrefs: 00259D92

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm$pS'
API String ID: 2751267872-2970452684
Opcode ID: aceb8ceebf84d0950821cb7c46be3ab140f2d93cea65e81aa24656caec29b4fe
Instruction ID: 10e0765c0d423fd3a1f1534856a68f01f0398a21e4e92dc3e4151a225dc8154f
Opcode Fuzzy Hash: aceb8ceebf84d0950821cb7c46be3ab140f2d93cea65e81aa24656caec29b4fe
Instruction Fuzzy Hash: D7B17E7182020ADFCF25DF94C8829AEB7B5FF14312F14415AEC056B256D331DAA9CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00256531 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00256537
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00256545
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00256556
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00256567

Strings

GetCurrentPackageId, xrefs: 0025653F
GetSystemTimePreciseAsFileTime, xrefs: 0025654B
kernel32.dll, xrefs: 00256532
GetTempPath2W, xrefs: 0025655C

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: c11cf019f0f5b4c489a6055e2e9817d2d179f2ad19385132c4c1786010d21bb1
Instruction ID: 024905b3c233691ce8af162a5d11eb27f724c6728eb75795212d9539589545d9
Opcode Fuzzy Hash: c11cf019f0f5b4c489a6055e2e9817d2d179f2ad19385132c4c1786010d21bb1
Instruction Fuzzy Hash: FEE01236966B70AF8745BFB1BC4DC86BFE4EB0A7113014451FE1DE2261D7F404A88B90

Uniqueness

Uniqueness Score: -1.00%

Function 0027120B Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(015A0550,015A0550,?,7FFFFFFF,?,002714DB,015A0550,015A0550,?,015A0550,?,?,?,?,015A0550,?), ref: 002712B1
__alloca_probe_16.LIBCMT ref: 0027136C
__alloca_probe_16.LIBCMT ref: 002713FB
__freea.LIBCMT ref: 00271446
__freea.LIBCMT ref: 0027144C
__freea.LIBCMT ref: 00271482
__freea.LIBCMT ref: 00271488
__freea.LIBCMT ref: 00271498

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: b0329393e2a70f025c02da293b507dcf792d4f05f1d33e2f7a8ab32c77b56869
Instruction ID: e2fee8b7530e8aa1256219260acc773170c270da6a060f1c3995d819af214034
Opcode Fuzzy Hash: b0329393e2a70f025c02da293b507dcf792d4f05f1d33e2f7a8ab32c77b56869
Instruction Fuzzy Hash: B4711772920216ABDF209EAC8C51BBF77FAAF46710F258059ED1CA7281D774DC708B60

Uniqueness

Uniqueness Score: -1.00%

Function 00259780 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 002597B7
___except_validate_context_record.LIBVCRUNTIME ref: 002597BF
_ValidateLocalCookies.LIBCMT ref: 00259848
__IsNonwritableInCurrentImage.LIBCMT ref: 00259873
_ValidateLocalCookies.LIBCMT ref: 002598C8

Strings

csm, xrefs: 0025985D

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 9f8aa6d5b28cdb52d5b9cc2f2693d12d1b3761465df1aeed5f8c91e46384ff8b
Instruction ID: 9041659a49718b54a71b18d64fcb6afa351644a60fe51087ec26d40a9053b568
Opcode Fuzzy Hash: 9f8aa6d5b28cdb52d5b9cc2f2693d12d1b3761465df1aeed5f8c91e46384ff8b
Instruction Fuzzy Hash: A441E530E20219EBCF10DF68C889A9EBBA1BF06325F148195EC185B352D771DDA9CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0026FB4E Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59964b098898d0eede6d26b0917a78f383a04bf8844a6a38f1fa701d534c53d0
Instruction ID: ab8c824408da3c8f9f7d9b379b1de011434d0843ff27f3d9a5d2f80cadf94967
Opcode Fuzzy Hash: 59964b098898d0eede6d26b0917a78f383a04bf8844a6a38f1fa701d534c53d0
Instruction Fuzzy Hash: BDB11670E2424A9FDF95DF98E984BADBFB1BF49304F144165E8009B2A2C7719DA1CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00254F73 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00254F7A
std::_Lockit::_Lockit.LIBCPMT ref: 00254F84
int.LIBCPMT ref: 00254F9B

Part of subcall function 0025260D: std::_Lockit::_Lockit.LIBCPMT ref: 0025261E
Part of subcall function 0025260D: std::_Lockit::~_Lockit.LIBCPMT ref: 00252638

codecvt.LIBCPMT ref: 00254FBE
std::_Facet_Register.LIBCPMT ref: 00254FD5
std::_Lockit::~_Lockit.LIBCPMT ref: 00254FF5

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: a2538686f1a710195be5466a6ec3c62b8a57f32e2e58b7665f447d3da3c62e94
Instruction ID: 8d26cf1f5bdf40d91b50bcb5e5d4003c408ca27fd4194ecda591ced92203a308
Opcode Fuzzy Hash: a2538686f1a710195be5466a6ec3c62b8a57f32e2e58b7665f447d3da3c62e94
Instruction Fuzzy Hash: 0411E471920625ABCB14FF64D8497ADB7B4BF44326F500549F805A7291DFB0AE6CCB88

Uniqueness

Uniqueness Score: -1.00%

Function 0025997A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00259971,00259727,0025723F), ref: 00259988
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00259996
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 002599AF
SetLastError.KERNEL32(00000000,00259971,00259727,0025723F), ref: 00259A01

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 916d56260601f6ec6c28330179f264d05442dddc6483f4c7a3a726531f872036
Instruction ID: 8af62908e4842767381e27fa1e008d6315512eab212133c073317327b1ed5deb
Opcode Fuzzy Hash: 916d56260601f6ec6c28330179f264d05442dddc6483f4c7a3a726531f872036
Instruction Fuzzy Hash: 6101F53313D2129EA6552A747C8AA262646EB11376320033DFD28412E1FF710CA89589

Uniqueness

Uniqueness Score: -1.00%

Function 00261405 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,0010445D,?,?,00000000,00272E68,000000FF,?,00261395,00000002,?,00261369,0025DFC6), ref: 0026143A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0026144C
FreeLibrary.KERNEL32(00000000,?,?,00000000,00272E68,000000FF,?,00261395,00000002,?,00261369,0025DFC6), ref: 0026146E

Strings

CorExitProcess, xrefs: 00261444
mscoree.dll, xrefs: 00261433

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2b03960f9b44da38010b58cc97237ba5609836f5ffc1168f5ee652b4a7cc3540
Instruction ID: e1ade94ec3ed6858f4b7d589bf383b5f635e0e9a00be94eba98ae708f7a9e210
Opcode Fuzzy Hash: 2b03960f9b44da38010b58cc97237ba5609836f5ffc1168f5ee652b4a7cc3540
Instruction Fuzzy Hash: 6601D632914625EFDB119F50DC0DFAEBBB8FB04B14F044225F815E3290DB749994CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00254935 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0025493C
std::_Lockit::_Lockit.LIBCPMT ref: 00254947
std::_Lockit::~_Lockit.LIBCPMT ref: 002549B5

Part of subcall function 00254A98: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00254AB0

std::locale::_Setgloballocale.LIBCPMT ref: 00254962
_Yarn.LIBCPMT ref: 00254978

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 4561da83bb37481e35b6e80f7a6fc0cf94e5678dc6025cdcace643da251ab14c
Instruction ID: fe7be21b19b2409fdcc0379ff6256964f84571d205e7ee70d5289066fdd488dd
Opcode Fuzzy Hash: 4561da83bb37481e35b6e80f7a6fc0cf94e5678dc6025cdcace643da251ab14c
Instruction Fuzzy Hash: 60019A35A115219BC709FB20E89E97DBBA1BF84355B544008EC0A17391CB746AAACB89

Uniqueness

Uniqueness Score: -1.00%

Function 00251603 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 287COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 0025168A
_strcspn.LIBCMT ref: 002516AE

Strings

pD', xrefs: 00251669
lD', xrefs: 0025165F

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: _strcspn
String ID: lD'$pD'
API String ID: 3709121408-2095853010
Opcode ID: 128d7e596a5f6ab6bd6323216d039065c12001d631516cc62ff0de3566f40e45
Instruction ID: ac755790a6319839336e1a41d38a14e53915f2c5f999c9b46c5a7e9ec34961d4
Opcode Fuzzy Hash: 128d7e596a5f6ab6bd6323216d039065c12001d631516cc62ff0de3566f40e45
Instruction Fuzzy Hash: F6B187B1528341AFD720DF28C884A6BBBE9FF89341F44491DF99987211D730E968CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0025AAC2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000011,00000000,00000800,?,0025AA73,00000000,00000001,002807B4,?,?,?,0025AC16,00000004,InitializeCriticalSectionEx,00275E40,InitializeCriticalSectionEx), ref: 0025AACF
GetLastError.KERNEL32(?,0025AA73,00000000,00000001,002807B4,?,?,?,0025AC16,00000004,InitializeCriticalSectionEx,00275E40,InitializeCriticalSectionEx,00000000,?,0025A9CD), ref: 0025AAD9
LoadLibraryExW.KERNEL32(00000011,00000000,00000000,?,00000011,002598E3), ref: 0025AB01

Strings

api-ms-, xrefs: 0025AAE6

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 0a0b886f85dec46accadc9e2761de8525040585b426a5ebc56cb5a2a9c5c562a
Instruction ID: 2250b160b9c8410daf0912eb2c6307f8da3bca13fa4c56794ff610e51821ca16
Opcode Fuzzy Hash: 0a0b886f85dec46accadc9e2761de8525040585b426a5ebc56cb5a2a9c5c562a
Instruction Fuzzy Hash: A7E0BF30690205F7EF202F61FC0BF693B56BB11B59F144121FE0DA84E1E7B199A4D9CA

Uniqueness

Uniqueness Score: -1.00%

Function 00268187 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(0010445D,00000000,00000000,00000000), ref: 002681EA

Part of subcall function 002695C0: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00267477,?,00000000,-00000008), ref: 0026966C

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00268445
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0026848D
GetLastError.KERNEL32 ref: 00268530

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: a903157b63b7f101251ef832e5ee1b505fe80292015c00659d24595463e08cdc
Instruction ID: d985148108271db95771093527c4d8c50cf56c54a7022b2a798b48107f580c70
Opcode Fuzzy Hash: a903157b63b7f101251ef832e5ee1b505fe80292015c00659d24595463e08cdc
Instruction Fuzzy Hash: 17D17AB5D102499FCF15CFA8D8809ADBBB4FF08314F18422AE816E7351EB30A995CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00259A91 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00259B58
___AdjustPointer.LIBCMT ref: 00259B7B
___AdjustPointer.LIBCMT ref: 00259C17

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: e66d6506ba6d86f83150bb1fc935caf1601d668fd8a138980075cab515d16054
Instruction ID: d0b51376fe2ab5fac4b95268d7ba6ee6223326639e9aa9bc5eff1252ce5af3d7
Opcode Fuzzy Hash: e66d6506ba6d86f83150bb1fc935caf1601d668fd8a138980075cab515d16054
Instruction Fuzzy Hash: F051E372620203DFEB29CF14E881B7A77A5EF54316F144129EC0547691E771ECE9CB98

Uniqueness

Uniqueness Score: -1.00%

Function 002699DC Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 002695C0: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00267477,?,00000000,-00000008), ref: 0026966C

GetLastError.KERNEL32 ref: 00269A40
__dosmaperr.LIBCMT ref: 00269A47
GetLastError.KERNEL32(?,?,?,?), ref: 00269A81
__dosmaperr.LIBCMT ref: 00269A88

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 50f36749b65b838b7815e0529f4841add5ac48e236f29db852726a1e8434b2c4
Instruction ID: b22b91ca4e50c401d8ba2a7d0923c30fd1877e080ac4c52d19d7b92b4601f991
Opcode Fuzzy Hash: 50f36749b65b838b7815e0529f4841add5ac48e236f29db852726a1e8434b2c4
Instruction Fuzzy Hash: 2A219271634206AFDB20AFA6988096BB7EDFF143647148519F82997251EF30EDF08B91

Uniqueness

Uniqueness Score: -1.00%

Function 00260747 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 782fe4c1e6d074222a51dae642af8c8ecb3357716c483e4b27e64bc76b4b7795
Instruction ID: fb2ba258611279a090695a002d5b28a03737925c5eb5e0ed660f746f2b7f73b1
Opcode Fuzzy Hash: 782fe4c1e6d074222a51dae642af8c8ecb3357716c483e4b27e64bc76b4b7795
Instruction Fuzzy Hash: 0B21A171620206AFCB11EF719CC0D2BB7A9EF543647114624F82697151EB70EDF0ABE1

Uniqueness

Uniqueness Score: -1.00%

Function 0026A972 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0026A97A

Part of subcall function 002695C0: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00267477,?,00000000,-00000008), ref: 0026966C

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0026A9B2
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0026A9D2

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: fa48385f9ed00aa09c24aa1701262a8e0e2e8861acc0a5e3f369d7d21564fced
Instruction ID: fa7cb18543e142bb653164894ed31b00c29ab80067bde5b640b97b94dc3c211c
Opcode Fuzzy Hash: fa48385f9ed00aa09c24aa1701262a8e0e2e8861acc0a5e3f369d7d21564fced
Instruction Fuzzy Hash: 8011C4F2522556BEAB11BBB16D8EC6F69ACCE493987510425F406B2101FE60DDE0C9B2

Uniqueness

Uniqueness Score: -1.00%

Function 00251E1A Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00251E26
int.LIBCPMT ref: 00251E39

Part of subcall function 0025260D: std::_Lockit::_Lockit.LIBCPMT ref: 0025261E
Part of subcall function 0025260D: std::_Lockit::~_Lockit.LIBCPMT ref: 00252638

std::_Facet_Register.LIBCPMT ref: 00251E6C
std::_Lockit::~_Lockit.LIBCPMT ref: 00251E82

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 3982b8308bf4ec45b7b170568bcccdac94a157b4fc410c184ab95f943766c559
Instruction ID: 172c75d0c8c47d9a2466d5cbbbcc9eb281d9f4e3df1e0b9fd232fd5bae826e0e
Opcode Fuzzy Hash: 3982b8308bf4ec45b7b170568bcccdac94a157b4fc410c184ab95f943766c559
Instruction Fuzzy Hash: 3301A732920114BBCB14EF64D8069AEB768EF81761B200158FD15572D0EF70AEAACBC8

Uniqueness

Uniqueness Score: -1.00%

Function 00251E93 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00251E9F
int.LIBCPMT ref: 00251EB2

Part of subcall function 0025260D: std::_Lockit::_Lockit.LIBCPMT ref: 0025261E
Part of subcall function 0025260D: std::_Lockit::~_Lockit.LIBCPMT ref: 00252638

std::_Facet_Register.LIBCPMT ref: 00251EE5
std::_Lockit::~_Lockit.LIBCPMT ref: 00251EFB

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 6bcc5ce2420156bd64892c281a72cc7c3a94fa4f8fdbcf62d1729b2a76ff3e64
Instruction ID: d6fbb5efbfe20694942230b2f904246cfdc73cfec0caf406d4bd2b71504bd8bd
Opcode Fuzzy Hash: 6bcc5ce2420156bd64892c281a72cc7c3a94fa4f8fdbcf62d1729b2a76ff3e64
Instruction Fuzzy Hash: 8F012B32920114BBCB14EF64D906DADB768DF41362B200158FC15572D0EF709EA9CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00251F0C Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00251F18
int.LIBCPMT ref: 00251F2B

Part of subcall function 0025260D: std::_Lockit::_Lockit.LIBCPMT ref: 0025261E
Part of subcall function 0025260D: std::_Lockit::~_Lockit.LIBCPMT ref: 00252638

std::_Facet_Register.LIBCPMT ref: 00251F5E
std::_Lockit::~_Lockit.LIBCPMT ref: 00251F74

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 7d61b0dbd2391eddb191596763573be6950f09b04c05560b0802a31adb7766e1
Instruction ID: 57fea2951e17c06f453706bb694f577c36c39f4b26a7b0972c28fe0f0bd2ee69
Opcode Fuzzy Hash: 7d61b0dbd2391eddb191596763573be6950f09b04c05560b0802a31adb7766e1
Instruction Fuzzy Hash: 6D01A732924114BBCB14BF64D906AADB76CDF45365B200158FC15976D0EF70AE6D8BC8

Uniqueness

Uniqueness Score: -1.00%

Function 00271040 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,0026FF0B,00000000,00000001,00000000,00000000,?,00268584,00000000,00000000,00000000), ref: 00271057
GetLastError.KERNEL32(?,0026FF0B,00000000,00000001,00000000,00000000,?,00268584,00000000,00000000,00000000,00000000,00000000,?,00268B0B,00000000), ref: 00271063

Part of subcall function 00271029: CloseHandle.KERNEL32(FFFFFFFE,00271073,?,0026FF0B,00000000,00000001,00000000,00000000,?,00268584,00000000,00000000,00000000,00000000,00000000), ref: 00271039

___initconout.LIBCMT ref: 00271073

Part of subcall function 00270FEB: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0027101A,0026FEF8,00000000,?,00268584,00000000,00000000,00000000,00000000), ref: 00270FFE

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,0026FF0B,00000000,00000001,00000000,00000000,?,00268584,00000000,00000000,00000000,00000000), ref: 00271088

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 8d6d1eadf669387d86fc50026a34f82f4cfc9f06944e6a3075e544553f9477e5
Instruction ID: 789e27bb1fc19bf643db052f72363fb6108970fe7a5cef5ca5f8818b7147f37c
Opcode Fuzzy Hash: 8d6d1eadf669387d86fc50026a34f82f4cfc9f06944e6a3075e544553f9477e5
Instruction Fuzzy Hash: F8F01C36410155BBCF622FA9ED09A9E3F6AFF083A0B048020FE0DC5120D73288B0DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0025A08D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0025A0B2

Strings

RCC, xrefs: 0025A0CC
MOC, xrefs: 0025A0C4

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 6e2e91bfb63fb7ba55ee4818ba58256666119993e0ddddabacb4025bdd0131ba
Instruction ID: 3436b97e1f2b0a9893086e2c8b5af337efc248bdbe587d4b5cab3e3a4c604c3b
Opcode Fuzzy Hash: 6e2e91bfb63fb7ba55ee4818ba58256666119993e0ddddabacb4025bdd0131ba
Instruction Fuzzy Hash: D641787191020AAFCF15CF98CC82AEEBBB5BF48301F148159FE09B7251D33599A4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0025208F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00252096
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 002520CE

Part of subcall function 00254A33: _Yarn.LIBCPMT ref: 00254A52
Part of subcall function 00254A33: _Yarn.LIBCPMT ref: 00254A76

Strings

bad locale name, xrefs: 002520DC

Memory Dump Source

Source File: 00000000.00000002.2014181438.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.2014166330.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014201440.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.000000000027F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014216057.00000000002C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014281473.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014362522.00000000002CE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_file.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: c2af4cdee9ebaa289a4fcd04318bdcc7c41c6a14b755de739760395be3caa524
Instruction ID: f50d9eb7578315a2fbcb8b9d47f4ad388e179b33ab75e00605e50794c9b3d13d
Opcode Fuzzy Hash: c2af4cdee9ebaa289a4fcd04318bdcc7c41c6a14b755de739760395be3caa524
Instruction Fuzzy Hash: 7AF01D71556B409E8330AF6A9481443FBE4BE293213908E6FE4DEC3A51D730A458CF6D

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 3040, Parent PID: 2364COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	111
Total number of Limit Nodes:	7

Executed Functions

Function 061A3F50 Relevance: 3.0, Strings: 2, Instructions: 520
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

k *p^, xrefs: 061A4375
$]q, xrefs: 061A41E4

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: $]q$k *p^
API String ID: 0-2367203351
Opcode ID: 3cda7e2a6831abc587caadd367a20969835df01db9f719d97b439a6f90cf040e
Instruction ID: 447f54a8c5f86555a705c072c721f79d2b1e321a8816f87179518eac54903f49
Opcode Fuzzy Hash: 3cda7e2a6831abc587caadd367a20969835df01db9f719d97b439a6f90cf040e
Instruction Fuzzy Hash: 59124F38B002158FCB54DF78C994AAEBBF6BF88700B158569E406EB365DB70EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 061A67D8 Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 804ea3a7580cb43150c392531e2cc6a5c949f4a6814a7601d82afa6ccca5276d
Instruction ID: 0bfb338b963bdbbe45c8d44de09be4f6e864a83470ed4ed014515da46dadd882
Opcode Fuzzy Hash: 804ea3a7580cb43150c392531e2cc6a5c949f4a6814a7601d82afa6ccca5276d
Instruction Fuzzy Hash: 95F1AF35A003099FCB55DFA8D980B9EBBF6EF88300F148569E509DB2A5DB34ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 061AA3D8 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d4a84f9e5ea1c4f78f8288d3785d650a4609e2f9a8aae5fa93c7e7679fa7787
Instruction ID: a705bb36b3cd1694290392386deb3c6b85a0c1558b2997cc5061114f6e088939
Opcode Fuzzy Hash: 4d4a84f9e5ea1c4f78f8288d3785d650a4609e2f9a8aae5fa93c7e7679fa7787
Instruction Fuzzy Hash: C6D1E874D01318CFCB58EFB4E9486ADBBB2FF8A302F1085A9D54AAB254DB315985CF11

Uniqueness

Uniqueness Score: -1.00%

Function 06180D80 Relevance: 20.6, Strings: 16, Instructions: 624
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06180E02
$]q, xrefs: 06180E52
$]q, xrefs: 0618137B
$]q, xrefs: 06180E84
$]q, xrefs: 06181455
$]q, xrefs: 06180F86
$]q, xrefs: 06180F36
$]q, xrefs: 061813AC
$]q, xrefs: 061813A0
$]q, xrefs: 06181336
$]q, xrefs: 06180FAC
$]q, xrefs: 06180E78
$]q, xrefs: 061813EB
$]q, xrefs: 06180FB8
$]q, xrefs: 06181430
$]q, xrefs: 06181461

Memory Dump Source

Source File: 00000004.00000002.2211971092.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6180000_RegAsm.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2551331179
Opcode ID: 83b1c065756f4590c2e6c718a0ad694c434171ca6a1f28f4715066da9e1589b9
Instruction ID: 38be3a816b63583c28067ba2a5c4a5f013028e682732d1e0776fcb49f9e9b5fe
Opcode Fuzzy Hash: 83b1c065756f4590c2e6c718a0ad694c434171ca6a1f28f4715066da9e1589b9
Instruction Fuzzy Hash: 0322B434B042059FDB49AB69CD54A6EBBF6BF89700B158459E916CB3A2CF34DC02CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06181582 Relevance: 7.8, Strings: 6, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0618182E
$]q, xrefs: 06181A57
$]q, xrefs: 061818E3
$]q, xrefs: 06181A88
$]q, xrefs: 06181A7C
$]q, xrefs: 06181A12

Memory Dump Source

Source File: 00000004.00000002.2211971092.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6180000_RegAsm.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: ac65d7068b975dae07b77bfaa6594f8664ed27eb1f2d9b586ee8c54664265da2
Instruction ID: 0775e0af62b6a467884c29a4c6070c387104d029ddf73cf453ad03b33a6c9c29
Opcode Fuzzy Hash: ac65d7068b975dae07b77bfaa6594f8664ed27eb1f2d9b586ee8c54664265da2
Instruction Fuzzy Hash: B1C1E534700246AFDB58AB64C895A2E7BE6FF85700F11485DE9029B3A2DF75DC06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00BDD0A8 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00BDD136
GetCurrentThread.KERNEL32 ref: 00BDD173
GetCurrentProcess.KERNEL32 ref: 00BDD1B0
GetCurrentThreadId.KERNEL32 ref: 00BDD209

Memory Dump Source

Source File: 00000004.00000002.2205505020.0000000000BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1968b3d547cc37055267b48c07d5e57e0b39aa609fdf18c3a6c34b58ff652109
Instruction ID: 6f15958d2cbf83bfb770bbad20a71dce3457967445bc703d1be8e85e467ca713
Opcode Fuzzy Hash: 1968b3d547cc37055267b48c07d5e57e0b39aa609fdf18c3a6c34b58ff652109
Instruction Fuzzy Hash: 925168B0900349CFDB14DFAAD548BAEFBF1EF89304F24849AE449A7360D7749948CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00BDD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00BDD136
GetCurrentThread.KERNEL32 ref: 00BDD173
GetCurrentProcess.KERNEL32 ref: 00BDD1B0
GetCurrentThreadId.KERNEL32 ref: 00BDD209

Memory Dump Source

Source File: 00000004.00000002.2205505020.0000000000BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 10305b4bdbdee176e860fbd95bc36121854e67c3325796c5e79c17491062a3b4
Instruction ID: d6c15d966529d23c346095c304725cfc63f48b8d7fde84abf6e458c39f10d1d4
Opcode Fuzzy Hash: 10305b4bdbdee176e860fbd95bc36121854e67c3325796c5e79c17491062a3b4
Instruction Fuzzy Hash: F55155B0900309CFDB14DFAAD548BAEBBF1EF48300F248499E409A7360D7349988CB65

Uniqueness

Uniqueness Score: -1.00%

Function 061A48B8 Relevance: 1.8, Strings: 1, Instructions: 591
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

+ *p^, xrefs: 061A4DA7

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: + *p^
API String ID: 0-3484328030
Opcode ID: a1191e0fb0782f247944d5861113dd5746e81b3e0144068e42b9c9cbdae7a85f
Instruction ID: 4f1f510a6111bd1d7c780fc1c11ef6be3278bdb22610aa7940a6036b48c19277
Opcode Fuzzy Hash: a1191e0fb0782f247944d5861113dd5746e81b3e0144068e42b9c9cbdae7a85f
Instruction Fuzzy Hash: B3323A797006018FCB58DF39D588A6ABBF6FF89300B1584A9E506CB366DB74EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02801CE4 Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02801E02

Memory Dump Source

Source File: 00000004.00000002.2206813301.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2800000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 29010e85ae51ee4b111f202271dbb30a8d80ff89345c24cdcbe2daa8e7657f16
Instruction ID: 4317be364b1598558f6297b3b3385ca6991c9cacd26785f44e00b2c706bc6766
Opcode Fuzzy Hash: 29010e85ae51ee4b111f202271dbb30a8d80ff89345c24cdcbe2daa8e7657f16
Instruction Fuzzy Hash: F751D0B5D003499FDB54CFA9C984ADEBBB5BF48314F24852AE818AB250D774A885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02801CF0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02801E02

Memory Dump Source

Source File: 00000004.00000002.2206813301.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2800000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ac3182fed177fe6c03122625200d36f279bbf0e0a35387b5a46fd79e946be2f4
Instruction ID: 7cc04b8b255f3811ad703b64f2e3460c09e15f3a1f8f2a79e3f20117dd5c1122
Opcode Fuzzy Hash: ac3182fed177fe6c03122625200d36f279bbf0e0a35387b5a46fd79e946be2f4
Instruction Fuzzy Hash: 6E41C2B5D00349DFDB14CFA9C984ADEFBB5BF48314F24852AE818AB250D774A885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02800BFC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 02804381

Memory Dump Source

Source File: 00000004.00000002.2206813301.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2800000_RegAsm.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 34b16523f51970697924451e82024e6b8eb8b5d748f252d3d393ce854e7174e0
Instruction ID: de8cb7c78bc8089d7b37718a911be24c5072f0d1f78f3d040933cedd53caebeb
Opcode Fuzzy Hash: 34b16523f51970697924451e82024e6b8eb8b5d748f252d3d393ce854e7174e0
Instruction Fuzzy Hash: 54412CB8900305DFCB54CF99C888AAABBF5FF88314F15C559D519A7360D374A845CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BD4248 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00BD59F1

Memory Dump Source

Source File: 00000004.00000002.2205505020.0000000000BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 6df0055d38eb7cd3e1f74f0f9867409259e671b373f4f988ddb361246b86d5af
Instruction ID: f100c19b8edffbb71e2c6c54e062685e21a21b02532c68bbaeb00e1c9b53e64e
Opcode Fuzzy Hash: 6df0055d38eb7cd3e1f74f0f9867409259e671b373f4f988ddb361246b86d5af
Instruction Fuzzy Hash: 5241C2B0C00A29CBDB24DFA9C888B9DFBF5FF45304F20816AD409AB255DB756946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00BD593C Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00BD59F1

Memory Dump Source

Source File: 00000004.00000002.2205505020.0000000000BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8180def4851e3309d4e216afa14b96bc35fde02d8ba5dcc1b816e4dac2bfa7e2
Instruction ID: 18f268ace8df72e97edbec554c009f626d2c5335c0ca26d39c73aedc7392af3b
Opcode Fuzzy Hash: 8180def4851e3309d4e216afa14b96bc35fde02d8ba5dcc1b816e4dac2bfa7e2
Instruction Fuzzy Hash: 1441E2B0C00629CEDB24CFA9C888B9DFBF5FF44304F20816AD418AB254DB756946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00BDD2F9 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00BDD387

Memory Dump Source

Source File: 00000004.00000002.2205505020.0000000000BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 62e43f41dad13898ea91adefe90c8a425782da5a80566ad0073df3871569cc58
Instruction ID: 165d33c3d67d318b8e1a46a705cf0929bfd9a467e115d47161aef173ac85969c
Opcode Fuzzy Hash: 62e43f41dad13898ea91adefe90c8a425782da5a80566ad0073df3871569cc58
Instruction Fuzzy Hash: AA21E9B59002499FDB10CFA9D584AEEFFF4EB48324F14845AE958A3310D374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00BDD300 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00BDD387

Memory Dump Source

Source File: 00000004.00000002.2205505020.0000000000BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f2616a23992493e8cd37ceca4b66f4d6df1654cec802da39c77d7a3e9e90b442
Instruction ID: 5c60d0f313e7a3f9253d3727e27ac9b2d7043a592744cab811063cd0e052b302
Opcode Fuzzy Hash: f2616a23992493e8cd37ceca4b66f4d6df1654cec802da39c77d7a3e9e90b442
Instruction Fuzzy Hash: 4D21C4B59002499FDB10CFAAD984ADEFFF4EB48320F14845AE958A3310D378A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00BDA870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00BDB101,00000800,00000000,00000000), ref: 00BDB312

Memory Dump Source

Source File: 00000004.00000002.2205505020.0000000000BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c7bec862e208274c8cf376d2bbc52ae486f9cf93f5d1a91417f25bf42ca84852
Instruction ID: 4b7ec12b6acb10fb18052d06ee166197fc6cf379b769111b3ec700ebae51e44a
Opcode Fuzzy Hash: c7bec862e208274c8cf376d2bbc52ae486f9cf93f5d1a91417f25bf42ca84852
Instruction Fuzzy Hash: 531103B68002499FCB10CF9AC444AAEFBF4EB48320F11846AD919A7300D378A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 068CA398 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000), ref: 068CA406

Memory Dump Source

Source File: 00000004.00000002.2213773694.00000000068C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68c0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 47028709d82415fe9e3d41019f279a736d70acf94abef3d592399fd956ffbd43
Instruction ID: d28ab292a76f383a285e56ae513dfbf4c8f9a18c915f1e7275463d96c7ac562c
Opcode Fuzzy Hash: 47028709d82415fe9e3d41019f279a736d70acf94abef3d592399fd956ffbd43
Instruction Fuzzy Hash: C41126B5D003598FCB24CFAAD948ADEFBF4AF49324F14842AD519B7210C778A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BDB2A4 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00BDB101,00000800,00000000,00000000), ref: 00BDB312

Memory Dump Source

Source File: 00000004.00000002.2205505020.0000000000BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a55ffca9cdef104a620bb7e25401a955eaa336cc8cc3deba4b31e85a731bfee7
Instruction ID: 6cdb657cc368eaa2c0ab58f7f8e9fe7625fbe1910b89e7458f8ca088dded76ac
Opcode Fuzzy Hash: a55ffca9cdef104a620bb7e25401a955eaa336cc8cc3deba4b31e85a731bfee7
Instruction Fuzzy Hash: CD1112B68002499FCB10CFAAC444AEEFBF4EB48320F14846AD819A7300C378A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 068CA3A0 Relevance: 1.6, APIs: 1, Instructions: 50libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000), ref: 068CA406

Memory Dump Source

Source File: 00000004.00000002.2213773694.00000000068C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68c0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6fa17656e766588435954fbfb1e58809c6289c613728433389a9b6d673215fc7
Instruction ID: 23b7d464ecdecb56e9e49718c01c81c4c61930b7a2d913e827f248112b21f0dd
Opcode Fuzzy Hash: 6fa17656e766588435954fbfb1e58809c6289c613728433389a9b6d673215fc7
Instruction Fuzzy Hash: 491104B5C007498FCB24DFAAC948A9EFBF4AF88320F14841AD519B7210C778A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BDB01D Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00BDB086

Memory Dump Source

Source File: 00000004.00000002.2205505020.0000000000BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7f015e2ba8f1816683395bdd3c17f3e3646cf1fba047ccef707ea4306cbf33c5
Instruction ID: 6e991f650f241a74926f0437a0289beff159ec6c2a79eac475bc0ed40abffa43
Opcode Fuzzy Hash: 7f015e2ba8f1816683395bdd3c17f3e3646cf1fba047ccef707ea4306cbf33c5
Instruction Fuzzy Hash: 9F11F0B6C00349CFCB10DFAAC444A9EFBF4EF89324F15845AD468A7210D379A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BDB020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00BDB086

Memory Dump Source

Source File: 00000004.00000002.2205505020.0000000000BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9aa9a74da93d648005d10c7909e49badffe8c2e19b55f97661189d8b55f2ef16
Instruction ID: 5b1c7411360554fedc4c28fa188589bd8ac372e9b5b74fdc2359068b167a2995
Opcode Fuzzy Hash: 9aa9a74da93d648005d10c7909e49badffe8c2e19b55f97661189d8b55f2ef16
Instruction Fuzzy Hash: A811F0B6C003498BCB10DF9AC444A9EFBF4EB48320F15845AD428A7210D379A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 061A59D8 Relevance: 1.5, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

d, xrefs: 061A5C29

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 099de681a9aa48e24aa662cdf0fcf7d33b8850072cc2d68f2bcb75ed572d7036
Instruction ID: 0c2f6504a6ddb888d4b82ad091a15793cce92c8c281f36c2b864358f9027be1c
Opcode Fuzzy Hash: 099de681a9aa48e24aa662cdf0fcf7d33b8850072cc2d68f2bcb75ed572d7036
Instruction Fuzzy Hash: 0BC14939604702CFC715CF28C59096ABBF7FF89310B1ACA99D45A8B669D730F946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 061A48A8 Relevance: 1.5, Strings: 1, Instructions: 277COMMON

Download Yara Rule

Strings

+ *p^, xrefs: 061A4DA7

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: + *p^
API String ID: 0-3484328030
Opcode ID: f9a9146d848ab115835717ee8ac33883c47c424ecf4c8adac2365214c6544684
Instruction ID: 2d53cb93e1858c39cfcb2e70a6f9a2e35354985e26baf0d52e756336c5068c80
Opcode Fuzzy Hash: f9a9146d848ab115835717ee8ac33883c47c424ecf4c8adac2365214c6544684
Instruction Fuzzy Hash: 34B12638B006048FCB54DF39D588A6ABBF6BF89305B1584A9E546DB376DB70EC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06181BA0 Relevance: 1.4, Instructions: 1446COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211971092.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6180000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27c19f40925cb014345083473dc42c93f56dc3d55d83e2345f247bf25669febf
Instruction ID: 36397d174834e5a3bd347e3b404100be987a35fbe8fafa78f864c0c35ccfb2fb
Opcode Fuzzy Hash: 27c19f40925cb014345083473dc42c93f56dc3d55d83e2345f247bf25669febf
Instruction Fuzzy Hash: 16C25270A402189FDB55DF64CD51EADBBB6FF88700F108099E606AB3A1DB71AE41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 061A3DE0 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

4']q, xrefs: 061A3F25

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 642166ec74c2ef6308531cf0784ecec9463b0a0dc4d08f7952dac535542f57fb
Instruction ID: 92671ceaca7d42ca02b9ac1e5a1fefc9e82a97c3552f7374069c9f8a019c3975
Opcode Fuzzy Hash: 642166ec74c2ef6308531cf0784ecec9463b0a0dc4d08f7952dac535542f57fb
Instruction Fuzzy Hash: 1E31E43A7042108FC729AB78A49066E7BEADFC6311B15486AE409CF344DE34EC07C791

Uniqueness

Uniqueness Score: -1.00%

Function 061A84D8 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

4']q, xrefs: 061A85B1

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: d9a6efad8a81e357e1b0f663a7698178785f44d672367b88b2f16c7de9c4f1ec
Instruction ID: 280f41f06e07481ba3be341f22b8ee2e71f644f995da889f220794c521334794
Opcode Fuzzy Hash: d9a6efad8a81e357e1b0f663a7698178785f44d672367b88b2f16c7de9c4f1ec
Instruction Fuzzy Hash: 413181357002049FCB08EB78A5A95AE7BE7AFC8201B50483DE50ACF394EE35AC0687D1

Uniqueness

Uniqueness Score: -1.00%

Function 061A84C8 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

4']q, xrefs: 061A85B1

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 3aee0d77d6dda745a1da98e8fd507dec89ab4fdd828367397ef8246a999b06b4
Instruction ID: a4d17661a7c1b7d08f810125fb47203721402ce2882021e2ba1345f7c125cf77
Opcode Fuzzy Hash: 3aee0d77d6dda745a1da98e8fd507dec89ab4fdd828367397ef8246a999b06b4
Instruction Fuzzy Hash: 6721A0307002049FCB09AB78A5A956E3BE7AFC9201B50487DE50ACF395EE35EC0687D2

Uniqueness

Uniqueness Score: -1.00%

Function 061AB358 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

4']q, xrefs: 061AB399

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 09116e3689a5de870a8e2b523050f3975423b5facd9f8e764d4f957cd5807027
Instruction ID: 74a7e1241253370315a144cba6993a25333cbd526d0486ffb04b62720b5c77b8
Opcode Fuzzy Hash: 09116e3689a5de870a8e2b523050f3975423b5facd9f8e764d4f957cd5807027
Instruction Fuzzy Hash: 6F018C34909249AFCB08EFB8E58449CBFF5BF45300F2445A9D886DB261DB345A85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 061A3EC8 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4']q, xrefs: 061A3F25

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: cef0d3ba163f0177fbee6f981654319a3e3de97a85511e9d8804fb073a7a4952
Instruction ID: 2c57b6644b8ddfecabe8a12ec68287916c152cf4c1b75b5d9f7058cabfc77cd3
Opcode Fuzzy Hash: cef0d3ba163f0177fbee6f981654319a3e3de97a85511e9d8804fb073a7a4952
Instruction Fuzzy Hash: 85F06D313401014F861CEB29E99196E7BEADFCA211B144929E04A8F258EF64FD0A83A1

Uniqueness

Uniqueness Score: -1.00%

Function 061AB368 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4']q, xrefs: 061AB399

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: ed66abdb5aa160d64eb93bbc8837e19754f28eb648d4ec77b1e0d3007b3b795d
Instruction ID: d42bc9fd1234f73119d8de26352b80cca02d1dbd60672e4e2f3de58f61b63089
Opcode Fuzzy Hash: ed66abdb5aa160d64eb93bbc8837e19754f28eb648d4ec77b1e0d3007b3b795d
Instruction Fuzzy Hash: 4CF08C74A05208EFCB08EFB8E58485CBBBAFF44301F1041A8D8069B314DB345E04CB81

Uniqueness

Uniqueness Score: -1.00%

Function 061800D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211971092.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6180000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81cfef46cd121f95197e376e7153a49d765032bf1c44bdab032a5d0054c10f27
Instruction ID: 65f9f7a59ab4a2aac1e598e5caf48430b9ca99c9e715d9a6147de439e92c8f3c
Opcode Fuzzy Hash: 81cfef46cd121f95197e376e7153a49d765032bf1c44bdab032a5d0054c10f27
Instruction Fuzzy Hash: 654279307406198FCB69AF78D550A6EBBB2FF86305B01095CE5039B395CF79ED098B86

Uniqueness

Uniqueness Score: -1.00%

Function 06183838 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211971092.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6180000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fd92cab0adafc122f4c27fb86222be39799e4ce7dc4a53cc1f34301a20dbd17
Instruction ID: d791a0347e9fe6526e3fcb92fd7d36ca53d85e8a68d93fd040de57d70d25f477
Opcode Fuzzy Hash: 9fd92cab0adafc122f4c27fb86222be39799e4ce7dc4a53cc1f34301a20dbd17
Instruction Fuzzy Hash: 48421634B402148FCB44DFA9C994EA9BBF6EF89704F1580A9E506DB3A6DB71ED40CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06180598 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211971092.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6180000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 241a8083380b58e8fd3fc368734224601a0454ec6d52eac3d338076e2b5d1135
Instruction ID: b94b7ca1bac20bfdde176bc8717266ab0e36af9dd932477163c20944513b2896
Opcode Fuzzy Hash: 241a8083380b58e8fd3fc368734224601a0454ec6d52eac3d338076e2b5d1135
Instruction Fuzzy Hash: C4029C307403188FDB58AB64D954A2E7BB2FF8A705F014958E5029F3A1CF7AED09CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06180610 Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211971092.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6180000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 886658da462413ad32681e9ec758f094e22ee1f8183533a1ae90b124e546452b
Instruction ID: cd0cb23c277dd640a784a8171cf8bb03bb6b374536f61fe73b2df83a33ad4d45
Opcode Fuzzy Hash: 886658da462413ad32681e9ec758f094e22ee1f8183533a1ae90b124e546452b
Instruction Fuzzy Hash: 4202BF307403188FDB54AB64D954A2E7BB2FF89705F014958E9029F3A1CFBAED09CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06180688 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211971092.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6180000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07f7ce7d1bb572a19c9a00d3dad0f62739ce495ba68b44176c51300c0e8dfa9
Instruction ID: 3dd828a9f32bd6a3d6088c012bf433abf8975d58851fb5f8339034fda572f603
Opcode Fuzzy Hash: d07f7ce7d1bb572a19c9a00d3dad0f62739ce495ba68b44176c51300c0e8dfa9
Instruction Fuzzy Hash: 27E1B134B403088FDB54AB64C954A2A7BB6FF89705F114859E9029F3A1CFBADD09CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06180700 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211971092.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6180000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22707c6e87e5501a1444504705620fcdf879eff7d6e0e7ccfb0e5f7504618b78
Instruction ID: cd5aa570541a5c3150142ac18ad6a343637996a2d1620015d5c9618658027ad2
Opcode Fuzzy Hash: 22707c6e87e5501a1444504705620fcdf879eff7d6e0e7ccfb0e5f7504618b78
Instruction Fuzzy Hash: 12D1BF30B403088FEB44AB64C954B3A7BB6FF89705F118459E9029B3A1CBBADD45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 061800B7 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211971092.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6180000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b706eaec653632ee354fd9abf323f8d89a22f2a956029f492217de955690ea0c
Instruction ID: adde3091c893bdca841258c4c3ee9343e201417fe4691e984d9d13251a6817bd
Opcode Fuzzy Hash: b706eaec653632ee354fd9abf323f8d89a22f2a956029f492217de955690ea0c
Instruction Fuzzy Hash: 68C17034B013089FEB44AB64C954B697BB6FF8D701F118459E9029B3A1CBB9DC45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 061A7D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 280545a3f78fae533cbc390213d69900d3c62001881f6cbae50b74b8ea1eefd5
Instruction ID: c07676993e82969a5b7f98850b98ef6a92e66de56284a993c15c43a306f50c44
Opcode Fuzzy Hash: 280545a3f78fae533cbc390213d69900d3c62001881f6cbae50b74b8ea1eefd5
Instruction Fuzzy Hash: 9C513879E00358DFDB55CFAAC8847DEBBF5AF88310F148429D419AB294DB749A42CF80

Uniqueness

Uniqueness Score: -1.00%

Function 061834D8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211971092.0000000006180000.00000040.00000800.00020000.00000000.sdmp, Offset: 06180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6180000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d76c9a97eb407ae6024745070c5a685ba8224206b9ed62adcba6e3447d79fb51
Instruction ID: 89bc3b2919f0961e45e941776f4512e7360be1031326378fc6d2128df95e267a
Opcode Fuzzy Hash: d76c9a97eb407ae6024745070c5a685ba8224206b9ed62adcba6e3447d79fb51
Instruction Fuzzy Hash: 25515935B106059FCB44DFA9C884D9EBBF2FF89710B158069E915AB361DB31EC05CB60

Uniqueness

Uniqueness Score: -1.00%

Function 061A7D4C Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22589ad5efb7a9e6fdf5b476fbbd9016020dbeef3b3ff783208828f4db3cdb6e
Instruction ID: 489052781b00c913a9e613a26ca1faa07e40edd7e3f37f1722318d6ad7a9ea23
Opcode Fuzzy Hash: 22589ad5efb7a9e6fdf5b476fbbd9016020dbeef3b3ff783208828f4db3cdb6e
Instruction Fuzzy Hash: 445149B8D00318DFDB55CFAAC885BDEBBF5AF48310F148429E419AB284DB749942CF91

Uniqueness

Uniqueness Score: -1.00%

Function 061A59C8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2696d56e3e689fc16fde1eb9d5173bfbff81a0800eb051dfbdbb7a9559deace5
Instruction ID: 50fe0a72e41c002a168f3f310e8bd46315d2d786f3729eb5cf5979a3f9af533c
Opcode Fuzzy Hash: 2696d56e3e689fc16fde1eb9d5173bfbff81a0800eb051dfbdbb7a9559deace5
Instruction Fuzzy Hash: 46416539A04606CFCB11CF59C8809AABBF3FF89310B19C999E5599B265D730F911CB90

Uniqueness

Uniqueness Score: -1.00%

Function 061A5579 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4756cda2bbc39fb84cfe1019e9c463ff9c049fdae66093e7eda1cb08c156fd0
Instruction ID: 222ff7b751e90a13bf8fb76aca5072a0ed1d9e87d7265d16f28ff1eafe270441
Opcode Fuzzy Hash: b4756cda2bbc39fb84cfe1019e9c463ff9c049fdae66093e7eda1cb08c156fd0
Instruction Fuzzy Hash: 0F314C79B012109FCB55DF38D88496EBBB6FF89310B548469E905CB365DB31ED05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 061A5588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c284ac238d827db1c7520985134d989ebda24405ed05d36c1b08bfb10e1f0a0
Instruction ID: 5b09527e6c49d6910d22c9628c39b7bb2fab3ca97bdbe5e77052684c6d1e037f
Opcode Fuzzy Hash: 0c284ac238d827db1c7520985134d989ebda24405ed05d36c1b08bfb10e1f0a0
Instruction Fuzzy Hash: FA316B79B012109FCB55DF38D88896EBBB6FF89310B548469E906CB365DB31ED05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 061A87A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06df918b674c74b7c7ed74da30d56b5a8b3f614af13e2dea1730093162ca5c2
Instruction ID: a98d5b64d67b5265191f889c69388ff4963a04a53aaad06859183899f3edd03b
Opcode Fuzzy Hash: d06df918b674c74b7c7ed74da30d56b5a8b3f614af13e2dea1730093162ca5c2
Instruction Fuzzy Hash: 664101B5D01248DFDB54DFAAD944ADEFBB6AF88310F10842AE419B7250DB34A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 061A8796 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ede887b221be3e846d6b8ea02a0e995e20c9a946c81827662485db1f92e850b
Instruction ID: b3c9811096102d3e99b9a01a05e681f698dba37715fd4f043a9b4d4465d2f40c
Opcode Fuzzy Hash: 3ede887b221be3e846d6b8ea02a0e995e20c9a946c81827662485db1f92e850b
Instruction Fuzzy Hash: 0C31F2B1D012489FDB54DFAAD984ADEBFF6AF88300F14842AE419B7250DB349945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 061A8A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d2479afbe1fcf8642a1a5ea84f4ac3ce63a3c341e8980e8f20ecd76be90fd45
Instruction ID: 575488bc3b0f08e0e5175e0b110640152c702fc986b7e820ee95ff24af21103f
Opcode Fuzzy Hash: 2d2479afbe1fcf8642a1a5ea84f4ac3ce63a3c341e8980e8f20ecd76be90fd45
Instruction Fuzzy Hash: CE3111B5D01358DFDB94CFA9D884ADEBBF9EF48310F24852AE409B7240CB34A845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A3D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2205021438.0000000000A3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df348b4f90c8106fd7d6b8a9f39afe04cbf69600a5ef606ccff8d1138d78e1a
Instruction ID: 89f963fcbe52791edcd85777afa3b701ef0ebd7a1fbd0250680a91abeca8af70
Opcode Fuzzy Hash: 0df348b4f90c8106fd7d6b8a9f39afe04cbf69600a5ef606ccff8d1138d78e1a
Instruction Fuzzy Hash: 0D213472600240EFCB05DF24E9C0F26BF65FB98318F24C569F9090B256C33AD856DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A3D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2205021438.0000000000A3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11d52ce5f57345b165e662bbf3be8279e2bbc6adbd1f443f344b01b260f69549
Instruction ID: 7bdcd50eba3897de126f0d64b60813c5ca075804a0473e88665feb45987cdac0
Opcode Fuzzy Hash: 11d52ce5f57345b165e662bbf3be8279e2bbc6adbd1f443f344b01b260f69549
Instruction Fuzzy Hash: 05213771504204DFDB05DF14E9C0F26BF65FB98324F24C569E9090F256C33AE856DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A9D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2205122852.0000000000A9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a9d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd0a470da0ce40b7c2f0690e5a62ac9dc2ec0a1015104c87fd756f01150f8cd3
Instruction ID: 02e305bf47e2544ecd0d5d2fb1d9bbea8051b78ad6fb092fb65e2cde991bed31
Opcode Fuzzy Hash: bd0a470da0ce40b7c2f0690e5a62ac9dc2ec0a1015104c87fd756f01150f8cd3
Instruction Fuzzy Hash: 3F21F271604244DFDF14DF24D984B26BFA5FB84314F24C969D94A4B256C33AD887CA61

Uniqueness

Uniqueness Score: -1.00%

Function 061A8A8C Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c785c9c1c4f8d05c0e4755c696d9015309d17aa808538ae4f47bb571305d200
Instruction ID: 07a8ffe3ce05fdeaa379c6dcebacb684ebf8791754952f4c23f62ba53a1d1144
Opcode Fuzzy Hash: 5c785c9c1c4f8d05c0e4755c696d9015309d17aa808538ae4f47bb571305d200
Instruction Fuzzy Hash: 1E2126B5D01348DFDB54CFA9C995B9EBBF9AF08300F14852AE409B7240DB74A845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A9D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2205122852.0000000000A9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a9d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3262f20342e519fbd0657decd77494d2fc4c0b11cd1eddd91aedbb7254f8260a
Instruction ID: b803c9bb90a5ca2175317a8d9d0d1c26b9c32e5437c93f3c8d1a93c516e362cd
Opcode Fuzzy Hash: 3262f20342e519fbd0657decd77494d2fc4c0b11cd1eddd91aedbb7254f8260a
Instruction Fuzzy Hash: 1221C3755093808FDB02CF24D994715BFB1FB46314F28C5EAD8498B697C33AD84ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 061A8C58 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703a568f01395ca2a919ea9558a0e1045c1d43e9f3f328d801763e2bf38df4b8
Instruction ID: 5650581c02f06abf675669bc09b8822cce79be6a450e87f155d1e64de418c2bf
Opcode Fuzzy Hash: 703a568f01395ca2a919ea9558a0e1045c1d43e9f3f328d801763e2bf38df4b8
Instruction Fuzzy Hash: 1921D074E062189FCB48CFA9E848ADCBBB1BB89310F10912AE805B3360EB741906CF54

Uniqueness

Uniqueness Score: -1.00%

Function 061ABC5F Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64369b386235d87947f95760983bc88700ae7ed9934202d6972fcf9033dd741b
Instruction ID: 4a6d23df75f86d5186fc71e6d9f59804cc882f7579521438c6e30399c6a649f7
Opcode Fuzzy Hash: 64369b386235d87947f95760983bc88700ae7ed9934202d6972fcf9033dd741b
Instruction Fuzzy Hash: A911C2352142154FC78DAB34A55496E7BAFEEC2341F14082DE187CB625DF34A94AC7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00A3D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2205021438.0000000000A3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d586b370810bf15e8d939e07fb0dccd80900219e7a08ccebccaf9c83e80135
Instruction ID: bbcc90a2eed3146970e1864b8134cf1350f0896277ed799083092cfae2452ed3
Opcode Fuzzy Hash: 07d586b370810bf15e8d939e07fb0dccd80900219e7a08ccebccaf9c83e80135
Instruction Fuzzy Hash: 7711E676504280CFCB16CF14D9C4B16BF71FB94318F24C6A9E9494B616C336D85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A3D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2205021438.0000000000A3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d586b370810bf15e8d939e07fb0dccd80900219e7a08ccebccaf9c83e80135
Instruction ID: 38eb5aaa051c44c8cee1793dd05dc7e292905439a5714174a6100fb918a1502d
Opcode Fuzzy Hash: 07d586b370810bf15e8d939e07fb0dccd80900219e7a08ccebccaf9c83e80135
Instruction Fuzzy Hash: 9E112972404240CFCF02CF10D5C4B16BF71FB94314F24C6A9E9490B616C33AD456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 061A8350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed94254b1b57034d9db75c937203d850fc88756413229e41ba2d4e9a7ff53166
Instruction ID: f50065e1cb65aced67b96a1709de89ff7f92c315bc928880de335fcff08c5c95
Opcode Fuzzy Hash: ed94254b1b57034d9db75c937203d850fc88756413229e41ba2d4e9a7ff53166
Instruction Fuzzy Hash: 4D017171B102199BDF10DAA9AC45AAFBBAEEB84351F148036E514D3240DB30A91587A1

Uniqueness

Uniqueness Score: -1.00%

Function 061AC499 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11fb2f72d6610d0cd7c7dc015693f7db32e36d14389380cabcef866f387e4d31
Instruction ID: 326da4ffefe588d3fd757823c5cb78a0dbfe4bc41cfdf8a8d8036e055bc3b696
Opcode Fuzzy Hash: 11fb2f72d6610d0cd7c7dc015693f7db32e36d14389380cabcef866f387e4d31
Instruction Fuzzy Hash: 1A1182312043008FD329AF75E54455E7BE7EFC5352F108A29D4878B695CF78990ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 061ABC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fff37125cff1c5807e7a4e28af676b301883690a2e2637b460bc5b841b0ba2b
Instruction ID: d42dac793345110814729613ce5c0de2b64528c723dbd89ec33f0737e98835a9
Opcode Fuzzy Hash: 6fff37125cff1c5807e7a4e28af676b301883690a2e2637b460bc5b841b0ba2b
Instruction Fuzzy Hash: E801B1362101114BCA8CA738E69492E7AAFEFC1391F444828E1078F614DF34BD4A87D1

Uniqueness

Uniqueness Score: -1.00%

Function 00A3DA25 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2205021438.0000000000A3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b6e93d653b9b5e0a8c340f7a662e58af376fbffc2952fdc766013bc6020342d
Instruction ID: bccd9f02a6c7eaa0492fad0c5381d550d98a480f40d4b72cb39b6e13ce0905dd
Opcode Fuzzy Hash: 9b6e93d653b9b5e0a8c340f7a662e58af376fbffc2952fdc766013bc6020342d
Instruction Fuzzy Hash: 5E012B71808744DAD7108B29DE84B67BFECEF413A5F18C82AFD085B246C2789C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 061AE8B0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 868503a5129769cde9b6a968849935586e1105efdaf6819469162f122823b3c7
Instruction ID: 2f42c189674db441b680ab77fc1b7182fe9680fada14e51f8335393dd7273175
Opcode Fuzzy Hash: 868503a5129769cde9b6a968849935586e1105efdaf6819469162f122823b3c7
Instruction Fuzzy Hash: B801A2346083489FCB069F78D81486A7FBAEF86300B1488EAE945CB262DB36DD15D781

Uniqueness

Uniqueness Score: -1.00%

Function 061AC4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4db217fa85d09ac326a6c9b81b4606e594a1a4bb03a0143e9d84853c34ebb943
Instruction ID: 60b1623228d411c528ddd2e4c9e26ea8512c0cf4eff8eee45c393041fbd3bd55
Opcode Fuzzy Hash: 4db217fa85d09ac326a6c9b81b4606e594a1a4bb03a0143e9d84853c34ebb943
Instruction Fuzzy Hash: 7E019E312042048FD328AF65E54865E77EBEFC5352F108A29E14B87788CF78E90ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 061A5508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa62ed8b621f7188b14271d287146a70d6b04a5c865353cd7bff4bedf3fcbfd4
Instruction ID: f27ce056414e967396d39d19db311cf663388100601f2298c06bbff8b05eac2b
Opcode Fuzzy Hash: fa62ed8b621f7188b14271d287146a70d6b04a5c865353cd7bff4bedf3fcbfd4
Instruction Fuzzy Hash: C701A438A19702CFDBAD9A39E504527B7FBFF84215B18883DE40686615EB75E484CB90

Uniqueness

Uniqueness Score: -1.00%

Function 061A6E90 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5cbfa5ef2156a4fed512b5331a709d901f66821ddd33520c550142751b30ec7
Instruction ID: 237a9f6f94f0a236eab226fc82f7c3effc1cb35be259af9a490fea8908c9f993
Opcode Fuzzy Hash: f5cbfa5ef2156a4fed512b5331a709d901f66821ddd33520c550142751b30ec7
Instruction Fuzzy Hash: 07F096772041D83FCB558E9A9C51EFB3FEDDB8D261F084156FE99D2141C428C96197B0

Uniqueness

Uniqueness Score: -1.00%

Function 061A8F42 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1541d546e1c700cb137e0d35563262ee64b8cffa0e407d4112e9cd63be1faedb
Instruction ID: 49a4ed02017c275438bdd05ec9e8f496bf20dd0e013d9cf456acb08051a386d6
Opcode Fuzzy Hash: 1541d546e1c700cb137e0d35563262ee64b8cffa0e407d4112e9cd63be1faedb
Instruction Fuzzy Hash: F401C4B8D0521AEFDB44DFA4D944AAEBBF1BB48301F2089AAE815A3340D7745A41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 061A8F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4099e9745668e2bc44369949e4fad242f4857565e6b3c1979a73101e52a2c614
Instruction ID: f906905731427f7348183d65db7c62e0f6c071dc55620c458f4db44ffe69a3b6
Opcode Fuzzy Hash: 4099e9745668e2bc44369949e4fad242f4857565e6b3c1979a73101e52a2c614
Instruction Fuzzy Hash: 3F01D2B8D0521AEFCB84DFA9D9446AEFBF1BB48301F2084AAD815A3350E7740A41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 061AADE9 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e829376402d7ed9b7badadcd07b572027ce8646fcb69abbd6194f2665e76a2fa
Instruction ID: d62ea8997533f008926ebe21119c1597e31317e4bf9e38074ee2010078a6994e
Opcode Fuzzy Hash: e829376402d7ed9b7badadcd07b572027ce8646fcb69abbd6194f2665e76a2fa
Instruction Fuzzy Hash: 3AF0E23120A3406FC3152B7ABC49A9A7FEADFCB751F04046EF18AC7253CA251808C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00A3DA24 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2205021438.0000000000A3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e6fb486b44f66f51b52ab30446f3f67ad12588f94d9931815dc552901e32077
Instruction ID: 02cded3cd44f0cf1e94658b9da9c582486720aa180e2c2fb41d6e5350852f43b
Opcode Fuzzy Hash: 6e6fb486b44f66f51b52ab30446f3f67ad12588f94d9931815dc552901e32077
Instruction Fuzzy Hash: 2CF0C271408344DEE7108F1ADD84B62FF98EF51774F18C85AED085A286C278AC44CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 061AC170 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9f2c862ccede5ad9829ed51d353cd1a03aa8403ccbc7a2c0c9abe62867d801
Instruction ID: 46bba8c973d1fdc5eb530ab4021d823a9c5ed7f1dc5bf4167e9f87a6fd76a1e3
Opcode Fuzzy Hash: ae9f2c862ccede5ad9829ed51d353cd1a03aa8403ccbc7a2c0c9abe62867d801
Instruction Fuzzy Hash: 1A018F31405B058FC315AF32E408052BBF6FF49340B10891ED4C6C2611DB34A54ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 061A6EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caf3b36b917d5418be2a89def7c0e998ed43f4e3e306a98acdc0082222804ad6
Instruction ID: 8328f93ffe3c6ee8ce367e59e8b53c90dadd1ed44491971b2612412e8715ae40
Opcode Fuzzy Hash: caf3b36b917d5418be2a89def7c0e998ed43f4e3e306a98acdc0082222804ad6
Instruction Fuzzy Hash: C2F012672081E83F8B554EAA5C50CFB7FEDDA8E162B084156FE98D2141C429C921ABB0

Uniqueness

Uniqueness Score: -1.00%

Function 061AFF50 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b6ecb9c1fb19c430a88aefb0d561d50fe9b0fe4625ba760054a0e0a6f0225f6
Instruction ID: 006225dd6a3b8d0de0b8ebf44217e78b4c1b14828633958842234036d5b1552c
Opcode Fuzzy Hash: 9b6ecb9c1fb19c430a88aefb0d561d50fe9b0fe4625ba760054a0e0a6f0225f6
Instruction Fuzzy Hash: F5F0BE323082045FD3008F6A9C509A7FFEEEF89B20B1580ABE544C7362CA71AC0087A4

Uniqueness

Uniqueness Score: -1.00%

Function 061AACB8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d700279506c7f0dd0caa74959cfddd5d8402cb7040187388245207420c3cd952
Instruction ID: 3979fa29d75635dad8296bd094ba855c4916b55dfad65d2d0dbed5021e99a68c
Opcode Fuzzy Hash: d700279506c7f0dd0caa74959cfddd5d8402cb7040187388245207420c3cd952
Instruction Fuzzy Hash: 23F0527260A3A41FC31A17387C1C0BD3FA9DDC6A4230800DFE1C2CB292CB188A06C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 061A67C8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d1aeeaa5e9cf1a707c798a2ccb5739e8168f7c9996437bcfdfd051287ec925e
Instruction ID: 466bf91833bd9643fa8d012e6764c1557458ccaeef3247c0d3372bb1f56e7d7a
Opcode Fuzzy Hash: 8d1aeeaa5e9cf1a707c798a2ccb5739e8168f7c9996437bcfdfd051287ec925e
Instruction Fuzzy Hash: EDF09035B54300AFD7208A68E845F567FEDEB86751F158166F214CF1E2D7B1E805D780

Uniqueness

Uniqueness Score: -1.00%

Function 061AC110 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20ec6d89617c46edd5c0b2a287b42537f7dfd52d532e4ac89ff044025c8eb5f7
Instruction ID: f92bc37a3a99567098a326a3c3c8a45d1cb27a3ac084bef3470ff5d8c0e7f14f
Opcode Fuzzy Hash: 20ec6d89617c46edd5c0b2a287b42537f7dfd52d532e4ac89ff044025c8eb5f7
Instruction Fuzzy Hash: 1FF0F6301093E08FC312DB38E914A9B7FFADF82304F04046EE1C2CB652CA65A909CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 061A8FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba411e2f1a9f50ca3263970a182e4e8397132be999a981f98816a29b9adfaec
Instruction ID: 1e7547d5a1a3a0a492b626440cf9c4aeb55e6259116d67df57104510aadfa34a
Opcode Fuzzy Hash: dba411e2f1a9f50ca3263970a182e4e8397132be999a981f98816a29b9adfaec
Instruction Fuzzy Hash: EFF049B9C0925A9FDB80DBA4C8555AEBFB0EB5A201F0045DAE846E7251E7395A41CB40

Uniqueness

Uniqueness Score: -1.00%

Function 061A8341 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2e907dad7010bd90dfd8a09285c32cd6f2aa5335f282a77c8ce4a1bfb3af901
Instruction ID: b823326113b3ffbd89a445fe3449e2ea33a134e764541f5481f29ddccf4d9690
Opcode Fuzzy Hash: c2e907dad7010bd90dfd8a09285c32cd6f2aa5335f282a77c8ce4a1bfb3af901
Instruction Fuzzy Hash: BAF0A032F202195B8F51DAA9AC859AFBFFDEB88261B084026EA14C3100EB30D815C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 061A54F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50c6fb6fdbf79310db473e55c885b18b16014b44b04b1d1f452b5a7c2a8b4b28
Instruction ID: 9e30f818ab652c07951e537aa0c85f9d9f5da2f14ec97fa7e5652cc854e94a3b
Opcode Fuzzy Hash: 50c6fb6fdbf79310db473e55c885b18b16014b44b04b1d1f452b5a7c2a8b4b28
Instruction Fuzzy Hash: C1F0B4399087418FDBA9CE21D54076B7BB3BF80325F49986DE04246925D775E585CB40

Uniqueness

Uniqueness Score: -1.00%

Function 061AFF60 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70af43f5931e90ff3ba1bd9059e0750a4a78010a79874b2fa37993401bd9fef
Instruction ID: f0619e847fdcad735da199125f020b17d38c66394e7b2ba27faebdd06e540cb2
Opcode Fuzzy Hash: e70af43f5931e90ff3ba1bd9059e0750a4a78010a79874b2fa37993401bd9fef
Instruction Fuzzy Hash: 1FE065717041145FD3049E9E9C40D5BFBEDEFD9A20B11406AF504D7351CA70AC0186A4

Uniqueness

Uniqueness Score: -1.00%

Function 061AAC60 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f81ee5cb9a27e091015f9fbbf47be115a3b76914295f09d6a91b0d0a657f880
Instruction ID: 1dc2ad814b98025a914e0a37350e39cbf327959a484886dc1b2d97092699389c
Opcode Fuzzy Hash: 4f81ee5cb9a27e091015f9fbbf47be115a3b76914295f09d6a91b0d0a657f880
Instruction Fuzzy Hash: 42F082226493E51FC61757387C284AD3F6ADEC7611705009BE5C58B293CD580A45C7D5

Uniqueness

Uniqueness Score: -1.00%

Function 061AADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd1b7cccf5dd187df03a533586557f21087cd3a77b550dd41508f84c1ddaa221
Instruction ID: 76bce57a0ac230c1857682be85537917e3e124f6038bdd8d83f48ea73e2c5039
Opcode Fuzzy Hash: dd1b7cccf5dd187df03a533586557f21087cd3a77b550dd41508f84c1ddaa221
Instruction Fuzzy Hash: 53E092312052046FC7186A5AB989A9E7BDEEBCA391F00402DF20EC7242CE65580587A5

Uniqueness

Uniqueness Score: -1.00%

Function 061AC180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec809267e112d195bf4433a7aa3bdf66e595e3165adefc8849c8042402202614
Instruction ID: 798e799231d282b601be0517ab142ab937cd3471632d5c97bcf21fa5f88bc45a
Opcode Fuzzy Hash: ec809267e112d195bf4433a7aa3bdf66e595e3165adefc8849c8042402202614
Instruction Fuzzy Hash: B0F09074501B158FD715EF26E408512FBFAFB88341F00C62EE84B82A10DB70A90ACFC4

Uniqueness

Uniqueness Score: -1.00%

Function 061AB500 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93925968c7f695ab71f2c06e2fae65ea163b570f9dc39bb1437503e96c647abf
Instruction ID: 39adb37bd6a0ea7d1f8a543d0599d1685e3438b5e3fb9ccd8ad1e68cb3cc7174
Opcode Fuzzy Hash: 93925968c7f695ab71f2c06e2fae65ea163b570f9dc39bb1437503e96c647abf
Instruction Fuzzy Hash: 66F0AE75D1120CAFCB41DFF4D9488CEBBB9EB88340F1082AAE945E7244EA706B55DF91

Uniqueness

Uniqueness Score: -1.00%

Function 061AC120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449cd3bf913eb249c12fcf6805d42b9fb98f22e8a7adc831692e86292e3631e5
Instruction ID: e41995b0e6d278607a0c884bfd0e43f41c5030f5367f379603dcd8e5bb6a57c4
Opcode Fuzzy Hash: 449cd3bf913eb249c12fcf6805d42b9fb98f22e8a7adc831692e86292e3631e5
Instruction Fuzzy Hash: EAE0ED302047648FC724AB2DF908BAF7BEEDF82344F04042DE2878B711CBA5A8058BD1

Uniqueness

Uniqueness Score: -1.00%

Function 061ACC38 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a40e215d2336c982a318e3045be77b7043e970ede3340d82766ce15ad3f8ff
Instruction ID: f518ea6d4135a0468b5adf759b420fd2101ca6d458bcbfb9070c86166437f51f
Opcode Fuzzy Hash: 67a40e215d2336c982a318e3045be77b7043e970ede3340d82766ce15ad3f8ff
Instruction Fuzzy Hash: B7E0D83210AB508FD725AF34F8406997BB4EF62320F014069D086CB629D734088ACBE1

Uniqueness

Uniqueness Score: -1.00%

Function 061A5698 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6987fc1284511ae7b7864bd1003e2e76b98c82cd6c292dbc8528bdc6ced57cdf
Instruction ID: 9e9bf3a8fe55597cd6b512e357085612116ee380b09205938e62b9853e10d602
Opcode Fuzzy Hash: 6987fc1284511ae7b7864bd1003e2e76b98c82cd6c292dbc8528bdc6ced57cdf
Instruction Fuzzy Hash: D8E0D8B210C3509FD305DB34E801896BBE8EF91310F058CAEE4C0C7242E732D842C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 061AE280 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ac14374319a96be3142bfba2133d513007c1bb68584c39e39eeb30a83b7a42
Instruction ID: f146e5ee18d74a66bc7b6439e23fad9941619f25b7824684d438fbc388d0b477
Opcode Fuzzy Hash: 79ac14374319a96be3142bfba2133d513007c1bb68584c39e39eeb30a83b7a42
Instruction Fuzzy Hash: E0E0D832509B508FEB56B730FE415443BB5EB67700F030056E8025F5B5D7241E4ACBD2

Uniqueness

Uniqueness Score: -1.00%

Function 061ACE88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 585d4017f9cc693b0984ba274c10c7e39030bd249fd7ed23d59c75f6a7e11867
Instruction ID: 906f8ea0ea4b736f17d1ea8c23261078a6ef390b9a141fe093f93c2a8e8884e8
Opcode Fuzzy Hash: 585d4017f9cc693b0984ba274c10c7e39030bd249fd7ed23d59c75f6a7e11867
Instruction Fuzzy Hash: 05E0923010D791EFE762AB20F5419553BB5DF16310B024459D8828B615D6344849C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 061AE1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f10e4460dd640a9134adee0c6b7f0982850667893054c99419e281512c22ae8
Instruction ID: 14d20d95c93d946764ad33c00a0b852de65e15e6512b7a85ce76b8837ee279c5
Opcode Fuzzy Hash: 8f10e4460dd640a9134adee0c6b7f0982850667893054c99419e281512c22ae8
Instruction Fuzzy Hash: 60E0D871A49244EFCB11CF68E9419DD7BB5DF82301F1041DAE405DB251D5700F15C791

Uniqueness

Uniqueness Score: -1.00%

Function 061AAC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08486f9886448b0224dce355d3c503130301b5567e9d93407c1dae7fddf4724
Instruction ID: 2dcbb1ad8f289898974778c8644def53c701478c54da321dacbb5e4aae3d5426
Opcode Fuzzy Hash: b08486f9886448b0224dce355d3c503130301b5567e9d93407c1dae7fddf4724
Instruction Fuzzy Hash: 9AD05E3271122D5F8A09376DBC5C8BE7BAFEAC5A62700002AF60BC7240CE695D468BD5

Uniqueness

Uniqueness Score: -1.00%

Function 061AE8F8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34998d480ce0ec44c09842e116a15f86a038c4932f2c33d9b0d29874a2a65c6d
Instruction ID: 36072e3430ab442079d6b3b54002c29ff893bb5c763f67d7b3e6cc5c3e613a44
Opcode Fuzzy Hash: 34998d480ce0ec44c09842e116a15f86a038c4932f2c33d9b0d29874a2a65c6d
Instruction Fuzzy Hash: 6DE082392583859FCB129F74C8018557FF8BF5AA1031880CAF6C0CF2B2D232A861EB60

Uniqueness

Uniqueness Score: -1.00%

Function 061AB510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937fa788ab6dafcf67c9c8d4a6ed05836d9d4ae58d4b04c9c05a6a26951d3caf
Instruction ID: 2f5e5cdcb5e399eb8f2f7efa320bfa4443f1bba7ba7eefb6270005043dd77b7d
Opcode Fuzzy Hash: 937fa788ab6dafcf67c9c8d4a6ed05836d9d4ae58d4b04c9c05a6a26951d3caf
Instruction Fuzzy Hash: 7DE09275D0020CEFCB40DFE5E9448DEBBB9EB48300F1082AAD909A3200EB306B55DF80

Uniqueness

Uniqueness Score: -1.00%

Function 061AE210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7241c1db530e60c89391c4e4e728e5ea83b2e0176c5eb9a14b72bbc5c741236d
Instruction ID: 5476b57be25ced99a32222aac061080c1939f86d487e5e289e59b44fc1b4d9d2
Opcode Fuzzy Hash: 7241c1db530e60c89391c4e4e728e5ea83b2e0176c5eb9a14b72bbc5c741236d
Instruction Fuzzy Hash: 98D01772A04208FF8B44EFA8EA4195DB7B9EF45305F1081A9A409E7210EA316F009B90

Uniqueness

Uniqueness Score: -1.00%

Function 061AF8EB Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f47c46d96ec36395da32c47a8aebb287e8edae0c59e4f8551d0e0fbffd0bd83
Instruction ID: 48dbb3c1baa2eefdc3565e995bc624deba087f12d320264be63769c44f42f506
Opcode Fuzzy Hash: 1f47c46d96ec36395da32c47a8aebb287e8edae0c59e4f8551d0e0fbffd0bd83
Instruction Fuzzy Hash: 30C012327050200B0688A66C745006D66DB82CCAF3B95412AE60EC3348CD608C8243C4

Uniqueness

Uniqueness Score: -1.00%

Function 061A3721 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb9bb351994725f691c10a10dadf5249f556b098a786fe99c7916e72d712f949
Instruction ID: 442eb75c8a6bb25cc7ede02c7a056e36d73d5f3ce2c2d42c9b2510413654c754
Opcode Fuzzy Hash: cb9bb351994725f691c10a10dadf5249f556b098a786fe99c7916e72d712f949
Instruction Fuzzy Hash: 75C0223AA000000BE3008380B80AFB03FA0A388B00F080000E3828B002C2A000A0CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 061ADFD1 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 661dfd7c4039a1e6a3e8aeea2c7ecec542cde5b8c3511f9644fd9bfc19950966
Instruction ID: 6bcdfb5e155bd663fa013f664c8b98b42b944daae4c8041ff9024c03f23949ea
Opcode Fuzzy Hash: 661dfd7c4039a1e6a3e8aeea2c7ecec542cde5b8c3511f9644fd9bfc19950966
Instruction Fuzzy Hash: CDC09B3555E3D08FEB425B34C80D8453F666F83750B5644DAD281CE077D6654415CBD1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 068C4768 Relevance: 2.9, Strings: 2, Instructions: 364COMMON

Download Yara Rule

Strings

., xrefs: 068C49E8
1, xrefs: 068C4A6D

Memory Dump Source

Source File: 00000004.00000002.2213773694.00000000068C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68c0000_RegAsm.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: 09ccf0d5846f14df35ef39a6d4829b0c8f19b89da180f5aaf7c318c7c874cc13
Instruction ID: f6ba0cf0c3ce7048319af25936784bbee0610d46b9e7f951e6c61db1a7e44f50
Opcode Fuzzy Hash: 09ccf0d5846f14df35ef39a6d4829b0c8f19b89da180f5aaf7c318c7c874cc13
Instruction Fuzzy Hash: 47F11270E01229CFDB68DF65C894B9DBBB2FF89305F1085A9D50AA7250DB319E85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 068C1148 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213773694.00000000068C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd53d15a29ab9874f8f6ad94e401828837757db199ec7d1b9ab9f52852f4e053
Instruction ID: 787e6857d309a926dd00a30c895799e45b757dcc5204f2c4d9c872ba8569d4e9
Opcode Fuzzy Hash: bd53d15a29ab9874f8f6ad94e401828837757db199ec7d1b9ab9f52852f4e053
Instruction Fuzzy Hash: 45228C74D012298FDBA5DF64C994BDDB7B2BF89300F1085EAD549AB251EB309E85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 068C0DE0 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213773694.00000000068C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 278d60bc1b475ad5cd2879dfda138908558e51cf582a976415a84b091c2f1158
Instruction ID: 7860d9cf29c78d4b68f22d2ac85cf6db09944a410a4ab018aec1615d78e1c386
Opcode Fuzzy Hash: 278d60bc1b475ad5cd2879dfda138908558e51cf582a976415a84b091c2f1158
Instruction Fuzzy Hash: 0C910774E00219CFDB64DFA4C984B9DBBB2BF49304F1081A9D549AB351EB34AE89CF51

Uniqueness

Uniqueness Score: -1.00%

Function 061AE2C7 Relevance: 46.6, Strings: 37, Instructions: 391COMMON

Download Yara Rule

Strings

D?j, xrefs: 061AE543
D?j, xrefs: 061AE593
D?j, xrefs: 061AE5BB
D?j, xrefs: 061AE51B
D?j, xrefs: 061AE40C
D?j, xrefs: 061AE2E4
D?j, xrefs: 061AE608
D?j, xrefs: 061AE6F8
D?j, xrefs: 061AE748
D?j, xrefs: 061AE7C3
D?j, xrefs: 061AE456
D?j, xrefs: 061AE6A8
D?j, xrefs: 061AE844
D?j, xrefs: 061AE3C2
D?j, xrefs: 061AE378
D?j, xrefs: 061AE353
D?j, xrefs: 061AE770
D?j, xrefs: 061AE630
D?j, xrefs: 061AE47B
D?j, xrefs: 061AE7EE
D?j, xrefs: 061AE309
D?j, xrefs: 061AE86F
D?j, xrefs: 061AE6D0
D?j, xrefs: 061AE658
D?j, xrefs: 061AE56B
D?j, xrefs: 061AE798
D?j, xrefs: 061AE819
D?j, xrefs: 061AE32E
D?j, xrefs: 061AE4A3
D?j, xrefs: 061AE4CB
D?j, xrefs: 061AE4F3
D?j, xrefs: 061AE39D
D?j, xrefs: 061AE5E3
D?j, xrefs: 061AE680
D?j, xrefs: 061AE431
D?j, xrefs: 061AE3E7
D?j, xrefs: 061AE720

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j
API String ID: 0-1246243312
Opcode ID: a4293777791a812bfb0f89e6adbfefb46e0c74b7960fdfcfd6cdc44159261df9
Instruction ID: 45e19ddfa4ae60ede47a396fb1e3f9ba715d313c0c7241d013f790f12d3ab399
Opcode Fuzzy Hash: a4293777791a812bfb0f89e6adbfefb46e0c74b7960fdfcfd6cdc44159261df9
Instruction Fuzzy Hash: FCD1A1313147016BDA09B6A0AD92EADA657FF87300B50483CE1244F7BEDF756D1A83D6

Uniqueness

Uniqueness Score: -1.00%

Function 061AE2D8 Relevance: 46.6, Strings: 37, Instructions: 383COMMON

Download Yara Rule

Strings

D?j, xrefs: 061AE543
D?j, xrefs: 061AE593
D?j, xrefs: 061AE5BB
D?j, xrefs: 061AE51B
D?j, xrefs: 061AE40C
D?j, xrefs: 061AE2E4
D?j, xrefs: 061AE608
D?j, xrefs: 061AE6F8
D?j, xrefs: 061AE748
D?j, xrefs: 061AE7C3
D?j, xrefs: 061AE456
D?j, xrefs: 061AE6A8
D?j, xrefs: 061AE844
D?j, xrefs: 061AE3C2
D?j, xrefs: 061AE378
D?j, xrefs: 061AE353
D?j, xrefs: 061AE770
D?j, xrefs: 061AE630
D?j, xrefs: 061AE47B
D?j, xrefs: 061AE7EE
D?j, xrefs: 061AE309
D?j, xrefs: 061AE86F
D?j, xrefs: 061AE6D0
D?j, xrefs: 061AE658
D?j, xrefs: 061AE56B
D?j, xrefs: 061AE798
D?j, xrefs: 061AE819
D?j, xrefs: 061AE32E
D?j, xrefs: 061AE4A3
D?j, xrefs: 061AE4CB
D?j, xrefs: 061AE4F3
D?j, xrefs: 061AE39D
D?j, xrefs: 061AE5E3
D?j, xrefs: 061AE680
D?j, xrefs: 061AE431
D?j, xrefs: 061AE3E7
D?j, xrefs: 061AE720

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j
API String ID: 0-1246243312
Opcode ID: 036d78358bbb8f816db3951dad1d289671497c3ebd478095a41b24f048e555e3
Instruction ID: 27a983f1c508f5e8f5caaa799712370f50922b136c0808512c87cfb59f31ac8c
Opcode Fuzzy Hash: 036d78358bbb8f816db3951dad1d289671497c3ebd478095a41b24f048e555e3
Instruction Fuzzy Hash: 5FD1A0313147016BDA09B6A0AD92EADA657FF87300B50483CE1244F7BEDF756D1A83D6

Uniqueness

Uniqueness Score: -1.00%

Function 061ACC7F Relevance: 16.4, Strings: 13, Instructions: 150COMMON

Download Yara Rule

Strings

D?j, xrefs: 061ACD9F
D?j, xrefs: 061ACDE9
D?j, xrefs: 061ACC9C
D?j, xrefs: 061ACD7A
D?j, xrefs: 061ACD0B
D?j, xrefs: 061ACD55
D?j, xrefs: 061ACCC1
D?j, xrefs: 061ACE58
D?j, xrefs: 061ACE0E
D?j, xrefs: 061ACE33
D?j, xrefs: 061ACDC4
D?j, xrefs: 061ACD30
D?j, xrefs: 061ACCE6

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j
API String ID: 0-2324958918
Opcode ID: 0531b4dc9c77ab1dc2e48c1d9eac7b7f95778ef51781a921549fd5c8b8bb5555
Instruction ID: 995df97458b7e5c9c057cbf117fa75cb1ddf4c8f205e20889b617075267f2e6a
Opcode Fuzzy Hash: 0531b4dc9c77ab1dc2e48c1d9eac7b7f95778ef51781a921549fd5c8b8bb5555
Instruction Fuzzy Hash: E041B9323047006BEB09B7A49D82E6DA657FF87300B50483DF2188F6AADF756D0987D6

Uniqueness

Uniqueness Score: -1.00%

Function 061ACC90 Relevance: 16.4, Strings: 13, Instructions: 143COMMON

Download Yara Rule

Strings

D?j, xrefs: 061ACD9F
D?j, xrefs: 061ACDE9
D?j, xrefs: 061ACC9C
D?j, xrefs: 061ACD7A
D?j, xrefs: 061ACD0B
D?j, xrefs: 061ACD55
D?j, xrefs: 061ACCC1
D?j, xrefs: 061ACE58
D?j, xrefs: 061ACE0E
D?j, xrefs: 061ACE33
D?j, xrefs: 061ACDC4
D?j, xrefs: 061ACD30
D?j, xrefs: 061ACCE6

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j
API String ID: 0-2324958918
Opcode ID: d8d60b36c53a726a6e9e6b08b89ad0f2959449741a7c95c8e69e94cbd76d5396
Instruction ID: d27df097ea1ef22d032e3e3afae95f1d155da2d2eb84ab65b16e703c0aa99c90
Opcode Fuzzy Hash: d8d60b36c53a726a6e9e6b08b89ad0f2959449741a7c95c8e69e94cbd76d5396
Instruction Fuzzy Hash: 2041B8323047002BEA09B6A4AD82E6DA557FB87300F50483CF2188F6AACF756D0943D6

Uniqueness

Uniqueness Score: -1.00%

Function 061ACED1 Relevance: 10.1, Strings: 8, Instructions: 103COMMON

Download Yara Rule

Strings

D?j, xrefs: 061ACF11
D?j, xrefs: 061ACFEF
D?j, xrefs: 061ACF5B
D?j, xrefs: 061ACFA5
D?j, xrefs: 061ACEEC
D?j, xrefs: 061ACF36
D?j, xrefs: 061ACFCA
D?j, xrefs: 061ACF80

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j
API String ID: 0-1694311651
Opcode ID: bdc481c6a10558bdf510feea0700601bd02acce894c0f53b876e63b9c002a9b4
Instruction ID: e5c972fe7b3a655dc31734531424d40afe5967f10fd8a8b6b899dd4bc7edf64f
Opcode Fuzzy Hash: bdc481c6a10558bdf510feea0700601bd02acce894c0f53b876e63b9c002a9b4
Instruction Fuzzy Hash: 4531BB313043016BDB09B6A49D82E6DBA57FB87300F50483DF1148F6AADF756D0587D6

Uniqueness

Uniqueness Score: -1.00%

Function 061ACEE0 Relevance: 10.1, Strings: 8, Instructions: 93COMMON

Download Yara Rule

Strings

D?j, xrefs: 061ACF11
D?j, xrefs: 061ACFEF
D?j, xrefs: 061ACF5B
D?j, xrefs: 061ACFA5
D?j, xrefs: 061ACEEC
D?j, xrefs: 061ACF36
D?j, xrefs: 061ACFCA
D?j, xrefs: 061ACF80

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: D?j$D?j$D?j$D?j$D?j$D?j$D?j$D?j
API String ID: 0-1694311651
Opcode ID: 8249f1d122ac50d8ca2ef83cbc2f9f5716f18d0b1af2644325258162bf372d0c
Instruction ID: 663fec29e296da2d522410785573ffcebcb3d5990b848b035e5ca912cb29e408
Opcode Fuzzy Hash: 8249f1d122ac50d8ca2ef83cbc2f9f5716f18d0b1af2644325258162bf372d0c
Instruction Fuzzy Hash: D221CC323143112BEB09B6A49D82E6DA55BFB87300F50483CF1188F7AACF756D0983D6

Uniqueness

Uniqueness Score: -1.00%

Function 061AC968 Relevance: 8.8, Strings: 7, Instructions: 88COMMON

Download Yara Rule

Strings

D?j, xrefs: 061ACA51
D?j, xrefs: 061ACA28
D?j, xrefs: 061AC984
D?j, xrefs: 061AC9D6
D?j, xrefs: 061ACA7A
D?j, xrefs: 061AC9FF
D?j, xrefs: 061AC9AD

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: D?j$D?j$D?j$D?j$D?j$D?j$D?j
API String ID: 0-2878456806
Opcode ID: 51acb08e0359fe1dad3a93afa86f7aaad5bc84ed6585214117efcfe577429be4
Instruction ID: 202f5514583c0307de96d48030665a3f1aaf77b11ef64f8d113ae22725002311
Opcode Fuzzy Hash: 51acb08e0359fe1dad3a93afa86f7aaad5bc84ed6585214117efcfe577429be4
Instruction Fuzzy Hash: 36318F313086826FDB092BA4AD96D6D7B67FB863017104538F105CF6A9CEB45E4AC782

Uniqueness

Uniqueness Score: -1.00%

Function 061AC978 Relevance: 8.8, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

D?j, xrefs: 061ACA51
D?j, xrefs: 061ACA28
D?j, xrefs: 061AC984
D?j, xrefs: 061AC9D6
D?j, xrefs: 061ACA7A
D?j, xrefs: 061AC9FF
D?j, xrefs: 061AC9AD

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: D?j$D?j$D?j$D?j$D?j$D?j$D?j
API String ID: 0-2878456806
Opcode ID: 3e0dfe1b21ac95418f02ae4f71fd533f849874019e4862fa161f5644361c7674
Instruction ID: 8c60fb4e79438d555dfb0fd1e5514e28868f1aab1ccb8c502341b7445bdc72c5
Opcode Fuzzy Hash: 3e0dfe1b21ac95418f02ae4f71fd533f849874019e4862fa161f5644361c7674
Instruction Fuzzy Hash: CE2171323046426FDF092BA4ED86C6D775BFB86301B104438F105CF6A9CEB55E4A8B82

Uniqueness

Uniqueness Score: -1.00%

Function 061AED10 Relevance: 7.9, Strings: 6, Instructions: 378COMMON

Download Yara Rule

Strings

(_]q, xrefs: 061AF0F9
(_]q, xrefs: 061AEF79
(_]q, xrefs: 061AEDF9
(_]q, xrefs: 061AEEFA
(_]q, xrefs: 061AED7A
(_]q, xrefs: 061AF07A

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: (_]q$(_]q$(_]q$(_]q$(_]q$(_]q
API String ID: 0-414434136
Opcode ID: aa7cab788d0e76b935730f82a5cc973cc56aff8d297d4ce22f4f1264f36fd5aa
Instruction ID: 3231f63b668cbcf228d5fb449187a315e2cd850c297c7d7e0e4a94fa2ce40e9b
Opcode Fuzzy Hash: aa7cab788d0e76b935730f82a5cc973cc56aff8d297d4ce22f4f1264f36fd5aa
Instruction Fuzzy Hash: 8BD19E39A083449FCB459F78C4545AE7FB2EF86340F1484AAE946DB382DB359E06CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 061AD538 Relevance: 7.6, Strings: 6, Instructions: 81COMMON

Download Yara Rule

Strings

D?j, xrefs: 061AD59E
D?j, xrefs: 061AD5E8
D?j, xrefs: 061AD579
D?j, xrefs: 061AD60D
D?j, xrefs: 061AD554
D?j, xrefs: 061AD5C3

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: D?j$D?j$D?j$D?j$D?j$D?j
API String ID: 0-3746439330
Opcode ID: f8e7d59bd7dc613a71a5c4fa854b09aef7bbfd94993e5677f88187fa26acd8c5
Instruction ID: e17c5ab06a438c18ae89843a271d63dbe1a23bf36fc48ee7eea3ee5eddf82f6c
Opcode Fuzzy Hash: f8e7d59bd7dc613a71a5c4fa854b09aef7bbfd94993e5677f88187fa26acd8c5
Instruction Fuzzy Hash: 0721D8323043002BE70ABBA59992E5DBA97FB87700F50493DF1148F6AACF756D1983D2

Uniqueness

Uniqueness Score: -1.00%

Function 061AD548 Relevance: 7.6, Strings: 6, Instructions: 73COMMON

Download Yara Rule

Strings

D?j, xrefs: 061AD59E
D?j, xrefs: 061AD5E8
D?j, xrefs: 061AD579
D?j, xrefs: 061AD60D
D?j, xrefs: 061AD554
D?j, xrefs: 061AD5C3

Memory Dump Source

Source File: 00000004.00000002.2211994796.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_61a0000_RegAsm.jbxd

Similarity

API ID:
String ID: D?j$D?j$D?j$D?j$D?j$D?j
API String ID: 0-3746439330
Opcode ID: 08498255dca7fddab74ed2a06101e6ffc12502ce0ad5c8b89164be6f1da6a40d
Instruction ID: c413d59e94439164c3e5dc5db680dcc96cece1d496985a5e64e7eba0873a08cb
Opcode Fuzzy Hash: 08498255dca7fddab74ed2a06101e6ffc12502ce0ad5c8b89164be6f1da6a40d
Instruction Fuzzy Hash: B011DB323043102BEA0976A5AD92E6DA65BFB87700F50493CF1148F6AACF766D1983D3

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Users\user\AppData\Local\Temp\TmpF89F.tmp

C:\Users\user\AppData\Local\Temp\TmpF8AF.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
file.exe

Function 00265EAF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00273416 Relevance: 8.1, APIs: 3, Strings: 1, Instructions: 1058
sleepmemoryCOMMON

Function 002672D2 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Function 0025DE3B Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 00254590 Relevance: 4.5, APIs: 3, Instructions: 33
threadCOMMON

Function 0025DD94 Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Function 0026136F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00268A3D Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Function 0026A6CB Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00255A4E Relevance: 3.1, APIs: 2, Instructions: 116
COMMON

Function 0026863F Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 00265B9D Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 0025DCDF Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 00266389 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Function 002540AA Relevance: 3.0, APIs: 2, Instructions: 28
threadCOMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre