Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1435591
MD5:	b09b19c780bfaa784ccf35dc454f9326
SHA1:	0efc9a13e26c279bcf9d07bdb62f928f19860c7a
SHA256:	4bf00732a644554a0bef0eb0fa080a182a63b52eda03dd8d4df8704feebf20d2
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Snort IDS alert for network traffic

Yara detected RedLine Stealer

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7492 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B09B19C780BFAA784CCF35DC454F9326)

conhost.exe (PID: 7500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7556 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 7564 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "5.42.65.96:28380", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.1742509849.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: file.exe PID: 7492	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7564	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7564	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.89f018.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.89f018.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.870000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Snort Signatures

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 5.42.65.96

Timestamp:	05/02/24-22:55:51.421922
SID:	2046045
Source Port:	49730
Destination Port:	28380
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 5.42.65.96 - Destination IP: 192.168.2.4

Timestamp:	05/02/24-22:55:56.823634
SID:	2046056
Source Port:	28380
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.65.96

Timestamp:	05/02/24-22:56:02.792026
SID:	2043231
Source Port:	49730
Destination Port:	28380
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 5.42.65.96 - Destination IP: 192.168.2.4

Timestamp:	05/02/24-22:55:51.596736
SID:	2043234
Source Port:	28380
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "5.42.65.96:28380", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00888F67 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00888F67

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.4:49730 -> 5.42.65.96:28380
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49730 -> 5.42.65.96:28380
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 5.42.65.96:28380 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 5.42.65.96:28380 -> 192.168.2.4:49730

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 5.42.65.96:28380

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 5.42.65.96:28380

Source: Joe Sandbox View

IP Address: 5.42.65.96 5.42.65.96

Source: Joe Sandbox View

ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU

Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96

Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000032FE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000032FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000032FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000032FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003565000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.000000000359C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000453A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000451E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003505000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000034CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, file.exe, 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1742509849.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003565000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.000000000359C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000453A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000451E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003505000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000034CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003565000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.000000000359C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000453A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000451E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003505000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000034CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003565000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.000000000359C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000453A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000451E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003505000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000034CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003565000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.000000000359C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000453A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000451E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003505000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000034CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegAsm.exe, 00000003.00000002.1744442834.000000000359C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000453A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003505000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003565000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000451E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000034CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003565000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.000000000359C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000453A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000451E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003505000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000034CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003565000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.000000000359C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000453A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000451E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003505000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000034CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RegAsm.exe, 00000003.00000002.1744442834.0000000003565000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.000000000359C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000453A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000451E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003505000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000034CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpCD1A.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpCD2B.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088CD80	0_2_0088CD80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087EEF0	0_2_0087EEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00883663	0_2_00883663
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087BE7D	0_2_0087BE7D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00883F4F	0_2_00883F4F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_013DDC74	3_2_013DDC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06A067D8	3_2_06A067D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06A0A3E8	3_2_06A0A3E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06A03F50	3_2_06A03F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06A0A3D8	3_2_06A0A3D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06A06FE8	3_2_06A06FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06A06FF8	3_2_06A06FF8

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00876C10 appears 49 times

Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStoutest.exe8 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .Left ZLIB complexity 0.9980181055646481

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/5@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7500:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\TmpCD1A.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.3.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: file.exe

Static PE information: section name: .Left

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00875F0D push ecx; ret	0_2_00875F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_069E3BDC push E806BA4Ah; retf	3_2_069E3BE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_069E1015 push FFFFFF8Bh; ret	3_2_069E101A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06A0DFD1 push es; ret	3_2_06A0DFE6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06A0ECF2 push eax; ret	3_2_06A0ED01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06A03B4F push dword ptr [esp+ecx*2-75h]; ret	3_2_06A03B53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06A049AB push FFFFFF8Bh; retf	3_2_06A049AD

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 1380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 3050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 5050000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Window / User API: threadDelayed 1272

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 9.4 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7712	Thread sleep time: -2767011611056431s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7584	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00888F67 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00888F67

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: RegAsm.exe, 00000003.00000002.1790120525.0000000005AF1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008769EF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_008769EF

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088A031 mov eax, dword ptr fs:[00000030h]		0_2_0088A031
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008801B7 mov ecx, dword ptr fs:[00000030h]		0_2_008801B7

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0088C630 GetProcessHeap,

0_2_0088C630

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008769EF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_008769EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00876B4B SetUnhandledExceptionFilter,	0_2_00876B4B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008766E5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_008766E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087A723 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0087A723

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: EEB008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008764CC cpuid

0_2_008764CC

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_0088C0D0
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00885032
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0088C1F9
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_0088C2FF
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0088C3CE
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_0088BDF2
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_0088BD0C
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00885558
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_0088BD57
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0088BE7D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008768E2 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_008768E2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.89f018.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.89f018.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.870000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1742509849.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7564, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7564, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.89f018.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.89f018.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.870000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1742509849.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7564, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	241 Security Software Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Install Root Certificate	DCSync	134 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	HEUR/AGEN.1317595
file.exe	100%	Joe Sandbox ML

URLs

Source	Detection	Scanner	Label
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17ResponseD	0%	Avira URL Cloud	safe

Domains and IPs

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	RegAsm.exe, 00000003.00000002.1744442834.000000000359C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000453A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003505000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	RegAsm.exe, 00000003.00000002.1744442834.0000000003565000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.000000000359C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000453A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000451E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003505000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000034CD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id14ResponseD	RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	RegAsm.exe, 00000003.00000002.1744442834.00000000032FE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13ResponseD	RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	file.exe, file.exe, 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1742509849.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1ResponseD	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegAsm.exe, 00000003.00000002.1744442834.0000000003565000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.000000000359C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000453A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000451E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003505000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000034CD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id20	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	RegAsm.exe, 00000003.00000002.1744442834.0000000003565000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.000000000359C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000453A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1786872785.000000000451E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003505000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.00000000034CD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1Response	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21ResponseD	RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	RegAsm.exe, 00000003.00000002.1744442834.00000000032FE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15ResponseD	RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id11ResponseD	RegAsm.exe, 00000003.00000002.1744442834.00000000032FE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	RegAsm.exe, 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17ResponseD	RegAsm.exe, 00000003.00000002.1744442834.0000000003134000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	RegAsm.exe, 00000003.00000002.1744442834.0000000003051000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.42.65.96	unknown	Russian Federation		39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1435591
Start date and time:	2024-05-02 22:55:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 96 Number of non-executed functions: 54
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
22:56:00	API Interceptor	8x Sleep call for process: RegAsm.exe modified

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:27 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.4559105390117493
Encrypted:	false
SSDEEP:	48:8SSdqTWSxRYrnvPdAKRkdAGdAKRFdAKR/U:8S/e
MD5:	B47525FBA312522F31864AFEE24F287E
SHA1:	6AD22A5DD1CDD2DDEA11781A95C6232893DA97C7
SHA-256:	D1C78896C87F51C874A35986B29F1C8B4B65F2079D4FDB18DD102D7B707FA55A
SHA-512:	9B900C80EAAAD6890FF95AFCAEEBCDFB87FA5DBF08688EFAF51FAF2D11FFC518A4F00A86198D45AABD1C90ACDC18FB5417CB7D17DD27B51789DA2685EBAF7EB4
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,....rx........q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW5`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWN`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWN`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWN`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDWH`..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\TmpCD1A.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpCD2B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

LoadLibraryExW, CreateFileW, VirtualProtect, FreeConsole, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, HeapSize, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, WriteConsoleW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, GetFileType, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetProcessHeap, ReadConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/02/24-22:55:51.421922	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49730	28380	192.168.2.4	5.42.65.96
05/02/24-22:55:56.823634	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	28380	49730	5.42.65.96	192.168.2.4
05/02/24-22:56:02.792026	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49730	28380	192.168.2.4	5.42.65.96
05/02/24-22:55:51.596736	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	28380	49730	5.42.65.96	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 2, 2024 22:55:51.017730951 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:51.193145990 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:51.193259954 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:51.215416908 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:51.388891935 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:51.421921968 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:51.596735954 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:51.643204927 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:56.647295952 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:56.823633909 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:56.823676109 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:56.823720932 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:56.823735952 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:56.823801041 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:56.823832035 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:56.823839903 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:56.877466917 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:56.953830004 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:57.127950907 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:57.166790009 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:57.341685057 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:57.393079996 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:57.408817053 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:57.582168102 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:57.582269907 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:57.582612991 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:57.582652092 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:57.582817078 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:57.583018064 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:57.623779058 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:57.755727053 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:57.755868912 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:57.756592989 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:57.799316883 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:57.849701881 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.022964001 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.023035049 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.023047924 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.023112059 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.023241997 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.023307085 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.023439884 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.023598909 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.023610115 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.023619890 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.023667097 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.196268082 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.196357965 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.196521044 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.196557045 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.196583033 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.196604013 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.196619034 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.196697950 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.196829081 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.196857929 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.196942091 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.197067976 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.197076082 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.197114944 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.197244883 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.197308064 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.197447062 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.197494030 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.197566032 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.197608948 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.197737932 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.197947025 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.198071003 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.198323965 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.369921923 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.369940996 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.370053053 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.370193958 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.370450020 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.370584965 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.370690107 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.370842934 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.371001959 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.371139050 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.371216059 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.371366978 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.371546984 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.371556997 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.371639013 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.371903896 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.372148991 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.372391939 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.372669935 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.372730970 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.546720982 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.547205925 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.547835112 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.547983885 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.548276901 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.548420906 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.548574924 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.548854113 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.548999071 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.549325943 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.549487114 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.549796104 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.549958944 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.549969912 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.550106049 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.550263882 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.550422907 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.550591946 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.550888062 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.551024914 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.551034927 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.551045895 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.551054955 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.551064014 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.551346064 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.551408052 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.551486015 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.551640987 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.551923990 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.552194118 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.552494049 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.553088903 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.553540945 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.553883076 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.554009914 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.554228067 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.554641962 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.554925919 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.554977894 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.555217028 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.555398941 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.555749893 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.725425959 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.725442886 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.725452900 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.725531101 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.725533009 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.725544930 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.725590944 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.725629091 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.725651026 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.725661039 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.725707054 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.725801945 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.725893974 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.725928068 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.725984097 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.726099968 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.726161003 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.726208925 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.726370096 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.726421118 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.726468086 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.726511002 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.726563931 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.726628065 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.726669073 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.726726055 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.726871014 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.726886034 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.727260113 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.727274895 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.727296114 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.727356911 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.727384090 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.727428913 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.727662086 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.727715969 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.727757931 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.727817059 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.727833033 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.727900982 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.727948904 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.727992058 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.728096962 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.728131056 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.728295088 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.728347063 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.728400946 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.728521109 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.728585958 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.728629112 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.728693962 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.728878975 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.728897095 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.898814917 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.898833036 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.898938894 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.898979902 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.898989916 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.899147034 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:58.899429083 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.899553061 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.899553061 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:58.899616003 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:59.072952032 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.072968960 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.073129892 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.073285103 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.073347092 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.073384047 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.073609114 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.073719978 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.073935032 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.074179888 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.074300051 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.074506998 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.074601889 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.074731112 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.074790955 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:59.074883938 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:59.074893951 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.075166941 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.075241089 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.075501919 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.075618029 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.075788975 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.075953960 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.076122999 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.076267004 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.076438904 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:59.076498985 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:59.248224020 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.248411894 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.248461962 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.248472929 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.248560905 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.248770952 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.249284983 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.249449015 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.249711037 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.250046968 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.250057936 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.250106096 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.250168085 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.250211000 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.250391960 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.250443935 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:59.250564098 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.250719070 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.250904083 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.251049995 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.251243114 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.251466990 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.251513958 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.251693964 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.251987934 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.252053022 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.423950911 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.423969030 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.424348116 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.424442053 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.425806046 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.428405046 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:59.602973938 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.612109900 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:59.787134886 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.794013023 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:55:59.968051910 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:55:59.969198942 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:56:00.143498898 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:56:00.150090933 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:56:00.323596001 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:56:00.324331045 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:56:00.329181910 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:56:00.503541946 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:56:00.549340010 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:56:00.580075026 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:56:00.755806923 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:56:00.797420979 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:56:00.971322060 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:56:00.977446079 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:56:01.152591944 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:56:01.163758993 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:56:01.337809086 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:56:01.339976072 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:56:01.513891935 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:56:01.564973116 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:56:01.654443979 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:56:01.828315020 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:56:01.831315041 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:56:02.005290985 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:56:02.049335957 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:56:02.441504955 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:56:02.615081072 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:56:02.616664886 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:56:02.617150068 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:56:02.791130066 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:56:02.792026043 CEST	49730	28380	192.168.2.4	5.42.65.96
May 2, 2024 22:56:02.968489885 CEST	28380	49730	5.42.65.96	192.168.2.4
May 2, 2024 22:56:03.008491993 CEST	49730	28380	192.168.2.4	5.42.65.96

Target ID:	0
Start time:	22:55:48
Start date:	02/05/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x870000
File size:	502'272 bytes
MD5 hash:	B09B19C780BFAA784CCF35DC454F9326
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:55:48
Start date:	02/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:55:48
Start date:	02/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x90000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:55:48
Start date:	02/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xce0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.1744442834.00000000030F7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.1742509849.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	50

Executed Functions

Function 0088A031 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9395896353acccf952a291b6f0163853f95de6a84289665eef3950dd9f5b70ca
Instruction ID: 73c3b951916dc8d015affbd374d053575319ccf6c5a695364e5ac85d6ff6dc21
Opcode Fuzzy Hash: 9395896353acccf952a291b6f0163853f95de6a84289665eef3950dd9f5b70ca
Instruction Fuzzy Hash: F8E08C32911628EBCB18EB8CC94498AF7ECFB45B40B11449BB501E3240C270DE00C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 008801B7 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6c70af4465b51eee87a21b9394eca4da2bf3182d56390a37949a0b0cf79ca84
Instruction ID: 1c73cf16610ceab0d9f00667bd88a40025dbf9c4a56bfa40735c30b3866c7064
Opcode Fuzzy Hash: a6c70af4465b51eee87a21b9394eca4da2bf3182d56390a37949a0b0cf79ca84
Instruction Fuzzy Hash: 61C08C3C0019088BCE2DA91487753AA3364F3A17D2F80048CDC028B693D55E9C8ADB02

Uniqueness

Uniqueness Score: -1.00%

Function 008851FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,8F8D4C53,?,00885308,?,?,00000000,00000000), ref: 008852BC

Strings

ext-ms-, xrefs: 00885266
api-ms-, xrefs: 00885252

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 24d888c8dbafc35b3b0172efef016c02f0bc439b5e8f19ed395234c902dab451
Instruction ID: 789cdb2ff7d90c74a9b487119322dfd5cee670a587b9420b7ec96e6eee3e72a2
Opcode Fuzzy Hash: 24d888c8dbafc35b3b0172efef016c02f0bc439b5e8f19ed395234c902dab451
Instruction Fuzzy Hash: 7021B471A01A15ABDB21BB65AC45A5A3B68FF41774F280221E916E7291EF30ED00C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00880143 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0088013D,00000000,0087A722,?,?,8F8D4C53,0087A722,?), ref: 00880154
TerminateProcess.KERNEL32(00000000,?,0088013D,00000000,0087A722,?,?,8F8D4C53,0087A722,?), ref: 0088015B
ExitProcess.KERNEL32 ref: 0088016D

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 8164e52909e64f1a1d916213b1163b00794032b9f173d6c3c83375be2d5486e5
Instruction ID: 546f508822ddf0d2faec459dc545167047be93b5b5d44f0fb0c92dbcc33bc3a3
Opcode Fuzzy Hash: 8164e52909e64f1a1d916213b1163b00794032b9f173d6c3c83375be2d5486e5
Instruction Fuzzy Hash: 8ED09E35000508BFCF413F65DC0D94D3F2AFF407517084011B90995431DB759A599F51

Uniqueness

Uniqueness Score: -1.00%

Function 00871379 Relevance: 3.3, APIs: 2, Instructions: 287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcspn.LIBCMT ref: 00871400
_strcspn.LIBCMT ref: 00871424

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: _strcspn
String ID:
API String ID: 3709121408-0
Opcode ID: cf218804e5d80d41d9d0d59ca86979c6c9779419ae4ec1d557f9a3805fbe2600
Instruction ID: 196175d9f4830d3c90254b58e2942f5c4031843b0e279736b21f0f90c94c481e
Opcode Fuzzy Hash: cf218804e5d80d41d9d0d59ca86979c6c9779419ae4ec1d557f9a3805fbe2600
Instruction Fuzzy Hash: C4B18771508344AFDB24DF28C884A6BBBE9FF88300F54891EF999C7665D730E944CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00887965 Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008870AF: GetConsoleOutputCP.KERNEL32(8F8D4C53,00000000,00000000,00000000), ref: 00887112

WriteFile.KERNEL32(?,00000000,?,0089C4A0,00000000,0000000C,00000000,00000000,?,00000000,0089C4A0,00000010,0087EA3D,00000000,00000000,00000000), ref: 00887ACE
GetLastError.KERNEL32(?,00000000), ref: 00887AD8

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 5c81233acd360429f416d4392dd46e157012be862c077d9c8e2926375fd06a91
Instruction ID: 8588444d01c0018d1036ad74b865b53c43fea3349e5a806f429afa0d265e13bb
Opcode Fuzzy Hash: 5c81233acd360429f416d4392dd46e157012be862c077d9c8e2926375fd06a91
Instruction Fuzzy Hash: 74619E71D08159AEDF15EFA8C884EEEBFB9FF09318F244085E814E7252D335DA018B61

Uniqueness

Uniqueness Score: -1.00%

Function 008753C9 Relevance: 3.1, APIs: 2, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Fputc.LIBCPMT ref: 008754A2

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Fputc
String ID:
API String ID: 3078413507-0
Opcode ID: 77f559f2ca54f8efed91a67dc1a2cb426649763dd1ffe481756a33c688efc58e
Instruction ID: a83e84bbe967a2963a7cad11b4fdb9fa17c481b81653e850818b9676e95d1175
Opcode Fuzzy Hash: 77f559f2ca54f8efed91a67dc1a2cb426649763dd1ffe481756a33c688efc58e
Instruction Fuzzy Hash: 4941B5B2900A1EAFCF14DF68C4808EEB7B9FF08355B148026E409E7654EB71ED80CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00887567 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,00000000,?,00887AB4,00000000,00000000,00000000,?,0000000C,00000000), ref: 00887603
GetLastError.KERNEL32(?,00887AB4,00000000,00000000,00000000,?,0000000C,00000000,00000000,?,00000000,0089C4A0,00000010,0087EA3D,00000000,00000000), ref: 00887629

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: c01c1a59a4c6375b0637fe3146c16b3a0618d7491f57f6acecccbd4980d74705
Instruction ID: fadbc1258eb3dbc7ef0e3613eba8697a6179436622e2afce056648f624ac4a47
Opcode Fuzzy Hash: c01c1a59a4c6375b0637fe3146c16b3a0618d7491f57f6acecccbd4980d74705
Instruction Fuzzy Hash: 71219F31A00619DFCB19DF29DC809EDB7B9FB98301F2440AAE906D7251E630DE42CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00884EE6 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00884F32
GetFileType.KERNELBASE(00000000), ref: 00884F44

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 7f4c9d182e9112a57f9f2c1d846b378086c9b18d2aa83f7b910db23e92efe240
Instruction ID: 061278ff811b1eac96aa0133b4d1a411f0447db1e9dc942a56999c4fc4459458
Opcode Fuzzy Hash: 7f4c9d182e9112a57f9f2c1d846b378086c9b18d2aa83f7b910db23e92efe240
Instruction Fuzzy Hash: B01196735047534AC7306E3D9C88A267A94FB96334B39271ED2B6C61F1CA30D986D751

Uniqueness

Uniqueness Score: -1.00%

Function 00873D0A Relevance: 3.0, APIs: 2, Instructions: 31
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(008EB018,000004AC,00000040,00000000), ref: 00873D26
FreeConsole.KERNELBASE ref: 00873D2C

Part of subcall function 00873062: OpenIcon.USER32(00000000), ref: 0087307C

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: ConsoleFreeIconOpenProtectVirtual
String ID:
API String ID: 3161549936-0
Opcode ID: 227f7b816b6045c556a0834f77931de714192848445df3c66e20d1f2ca0cfa76
Instruction ID: da6ce7cbf7131d52be0f9f7b56fc46251fb37264cfea0bdef4f219db155776f5
Opcode Fuzzy Hash: 227f7b816b6045c556a0834f77931de714192848445df3c66e20d1f2ca0cfa76
Instruction Fuzzy Hash: 5CE02263A01910B7D310F3A69C0AE8F3A6CEBC3721F048075F204E6041CB288F0993FA

Uniqueness

Uniqueness Score: -1.00%

Function 008852C6 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4de07456cf9051390bcf3d3c9dd1e80e560f38cdc53dc62de0df293cbf7340c1
Instruction ID: 52cc7716c731db10588eac59b8833acb3b60081007b6a9f2dc61cbb44cf42226
Opcode Fuzzy Hash: 4de07456cf9051390bcf3d3c9dd1e80e560f38cdc53dc62de0df293cbf7340c1
Instruction Fuzzy Hash: 3B01D837704A156FDF25FE6DEC44A5A3796FBC53647184121F904DB299EA30D8018791

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0088CD80 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0088CF64

Strings

1#INF, xrefs: 0088CEB6
1#QNAN, xrefs: 0088CE93
1#SNAN, xrefs: 0088CE8C
1#IND, xrefs: 0088CE85

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: a5b852517cf7f271291659343b5ccba9b187846fc323495e8787abe2913ce76c
Instruction ID: da0929739d98acf7fa558c1e856220cd7dbcf00b405aff9f1994cf914ba23d20
Opcode Fuzzy Hash: a5b852517cf7f271291659343b5ccba9b187846fc323495e8787abe2913ce76c
Instruction Fuzzy Hash: CED22871E082298FDB65EE28DD407EAB7B5FB44315F1445EAD40DE7280EB78AE818F41

Uniqueness

Uniqueness Score: -1.00%

Function 0088C1F9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0088C517,00000002,00000000,?,?,?,0088C517,?,00000000), ref: 0088C292
GetLocaleInfoW.KERNEL32(?,20001004,0088C517,00000002,00000000,?,?,?,0088C517,?,00000000), ref: 0088C2BB
GetACP.KERNEL32(?,?,0088C517,?,00000000), ref: 0088C2D0

Strings

OCP, xrefs: 0088C24D
ACP, xrefs: 0088C217

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 01324eec825d9d46f9430862babe3207fba80e97e8a7879d5f25d9cb413c924a
Instruction ID: cd583f701affad61905c92dafa08dcb564cd513f627359322289c0556b006361
Opcode Fuzzy Hash: 01324eec825d9d46f9430862babe3207fba80e97e8a7879d5f25d9cb413c924a
Instruction Fuzzy Hash: BD21B332B40104ABDB30BFD4C905A9772A6FF54B64B5A8464F90AD719CEB32DE40C370

Uniqueness

Uniqueness Score: -1.00%

Function 0088C3CE Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00882A50: GetLastError.KERNEL32(?,00000008,008887AF,00000000,0087A8A0), ref: 00882A54
Part of subcall function 00882A50: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 00882AF6

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0088C4DA
IsValidCodePage.KERNEL32(00000000), ref: 0088C523
IsValidLocale.KERNEL32(?,00000001), ref: 0088C532
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0088C57A
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0088C599

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 8a31fb52e9254c818ac64db8bce5192999413a80845763079fe1db19cd31b915
Instruction ID: ab4511fd87ff831c06a5e4176e9b2c8b0ab164d0c9e44ea257f6839447d33700
Opcode Fuzzy Hash: 8a31fb52e9254c818ac64db8bce5192999413a80845763079fe1db19cd31b915
Instruction Fuzzy Hash: 32516C71A00209ABDB20FFA8CC51ABA77B8FF48700F19446AE910E7155EB709A848B75

Uniqueness

Uniqueness Score: -1.00%

Function 00883F4F Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00883FDC

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 3b77efa88b360e3b2f44fc598f2baa6fe67a69f1edf31522626998ca8dd4c5a1
Instruction ID: e297da0ec19987b202eadb47d0b91364c015234d1382b1130e9446b7f7783403
Opcode Fuzzy Hash: 3b77efa88b360e3b2f44fc598f2baa6fe67a69f1edf31522626998ca8dd4c5a1
Instruction Fuzzy Hash: 44B16533A082479FDF11AF68C8817EEBBA5FF65304F24916AE905EB241D3359D41C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00888F67 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 00889057
FindNextFileW.KERNEL32(00000000,?), ref: 0088914B
FindClose.KERNEL32(00000000), ref: 0088918A
FindClose.KERNEL32(00000000), ref: 008891BD

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: bbc10f8360f0489256deedc20119053aa1ee146cae76875fd886f9bd02714d78
Instruction ID: 9d3c0b28a8ff355c3cd66276d7d0282ef65c9fddfc4b951722b07472db5157ee
Opcode Fuzzy Hash: bbc10f8360f0489256deedc20119053aa1ee146cae76875fd886f9bd02714d78
Instruction Fuzzy Hash: 1571B0759091699FDB20FF288C8DABABBB9FF05300F5841D9E049E7211EE358E818F15

Uniqueness

Uniqueness Score: -1.00%

Function 008769EF Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 008769FB
IsDebuggerPresent.KERNEL32 ref: 00876AC7
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00876AE0
UnhandledExceptionFilter.KERNEL32(?), ref: 00876AEA

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 15802ff166929af0b7752659763d524fc38a85dce39e7361e65880b55289a1e2
Instruction ID: 16cc706b5f7596120393ecc286adf1e1b41315758d35eda67e3e140b010f7bf1
Opcode Fuzzy Hash: 15802ff166929af0b7752659763d524fc38a85dce39e7361e65880b55289a1e2
Instruction Fuzzy Hash: 0831E575D052189ADF21EFA4D949BCDBBB8FF08300F1081AAE50DAB254EB719B85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0088BE7D Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00882A50: GetLastError.KERNEL32(?,00000008,008887AF,00000000,0087A8A0), ref: 00882A54
Part of subcall function 00882A50: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 00882AF6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0088BED1
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0088BF1B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0088BFE1

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: fb4fb2a4e2fc5f4c937e6b4215fec2265cc722e2947e9275f0f0d2fb65c0e94b
Instruction ID: f57b26a5676a7babdfea5e2d5a77722e806cd9cd8124f631b6c3fb6695ee0c3b
Opcode Fuzzy Hash: fb4fb2a4e2fc5f4c937e6b4215fec2265cc722e2947e9275f0f0d2fb65c0e94b
Instruction Fuzzy Hash: 0161BF71510607DFDB28AF28CE82BBAB7A8FF04340F14416AED15C6189EB74D991DF61

Uniqueness

Uniqueness Score: -1.00%

Function 0087A723 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0087A81B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0087A825
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0087A832

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 97466acecb5b3443ddc236ffcd80ecbae18f787e8cd678c124912867c295cd3f
Instruction ID: e5a80d97efd2e765f79ad9f2792c67e6d724351637b6a605e94bedec26d861c4
Opcode Fuzzy Hash: 97466acecb5b3443ddc236ffcd80ecbae18f787e8cd678c124912867c295cd3f
Instruction Fuzzy Hash: 0031C27590122C9BCB21DF68D989B8DBBB8FF48710F5081EAE41CA7251EB749F818F45

Uniqueness

Uniqueness Score: -1.00%

Function 0087EEF0 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b918ce5ba07d05ff1d573fb676ebfcada0811aa90aede51354a3873ecbe237d1
Instruction ID: 1f4d99a1475b29214bc66b209f4dac09fe8b408c80270b396d5796cbc28dce0a
Opcode Fuzzy Hash: b918ce5ba07d05ff1d573fb676ebfcada0811aa90aede51354a3873ecbe237d1
Instruction Fuzzy Hash: 26F12F75E002199FDF14CFA9C8806ADB7B1FF89324F258269E919E7396D7309D41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00883663 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0088365E,?,?,00000008,?,?,00891615,00000000), ref: 00883890

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e744213cc903d9f4044d86aea55aec265bbbbb32e018d93ffa16d51c3c2ecce9
Instruction ID: d95bb2c769cdb5503e6798a28c2e1d8c9eb69a2f7a58f32b77648b64cd5dd27c
Opcode Fuzzy Hash: e744213cc903d9f4044d86aea55aec265bbbbb32e018d93ffa16d51c3c2ecce9
Instruction Fuzzy Hash: 2DB14B75210609DFDB19DF2CC486B657BE0FF45764F258668E89ACF2A1C335EA82CB40

Uniqueness

Uniqueness Score: -1.00%

Function 008764CC Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 008764E2

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 5282b758b9f85af4ad3e10c50223dc58bea0490892890e2db28f6a1b49584b69
Instruction ID: 219dcbce7683f8ced880ca9fe9c8b4e5eb06c5342dc883d889d01177be47efda
Opcode Fuzzy Hash: 5282b758b9f85af4ad3e10c50223dc58bea0490892890e2db28f6a1b49584b69
Instruction Fuzzy Hash: A7516DB1A01B15CFEB14CFA4D9817AABBF5FB58310F18852AD409EB254E375E950CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0087BE7D Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 0087C00B

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 98495ada3929799c871665d4ef4f155b92d44effc4ecd1d3fbae98988406a257
Instruction ID: 179f93510b090326b0a91ac89fd02bb0ea93a6213ee7253ba204417967e7ca1d
Opcode Fuzzy Hash: 98495ada3929799c871665d4ef4f155b92d44effc4ecd1d3fbae98988406a257
Instruction Fuzzy Hash: D7C1AD74600A4A8FCB24CE28C8947BAB7A2FF05314F54C62DD55AD739AC731ED85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0088C0D0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00882A50: GetLastError.KERNEL32(?,00000008,008887AF,00000000,0087A8A0), ref: 00882A54
Part of subcall function 00882A50: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 00882AF6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0088C124

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 466db7b21e91f629c8a11fcefafcc31ae7695678c1d5143b4d1744c72e8e51fa
Instruction ID: e4981beb0c41ecaa1dd2a6f35c3c743c3b96ab221678188d4d495086ad5c05fd
Opcode Fuzzy Hash: 466db7b21e91f629c8a11fcefafcc31ae7695678c1d5143b4d1744c72e8e51fa
Instruction Fuzzy Hash: 6B21CF36614206ABDB28BA29CD86ABB77E8FF44314F14407AFD06D6146EB34ED018B61

Uniqueness

Uniqueness Score: -1.00%

Function 0088BD57 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00882A50: GetLastError.KERNEL32(?,00000008,008887AF,00000000,0087A8A0), ref: 00882A54
Part of subcall function 00882A50: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 00882AF6

EnumSystemLocalesW.KERNEL32(0088BE7D,00000001,00000000,?,-00000050,?,0088C4AE,00000000,?,?,?,00000055,?), ref: 0088BDC9

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d5408f27d19690b94b961c40aa277c1319b8072e8dd6ce24c19f9a15cb7b68c0
Instruction ID: 10e66bc05f61fba8f324298ce6795a86d131b096fdc5285bb40b7e0fe19358b8
Opcode Fuzzy Hash: d5408f27d19690b94b961c40aa277c1319b8072e8dd6ce24c19f9a15cb7b68c0
Instruction Fuzzy Hash: 1611E53A2007059FDB28AF39C8A16BAB792FFC4358B18442DE98787A40D771A942C740

Uniqueness

Uniqueness Score: -1.00%

Function 0088C2FF Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00882A50: GetLastError.KERNEL32(?,00000008,008887AF,00000000,0087A8A0), ref: 00882A54
Part of subcall function 00882A50: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 00882AF6

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0088C099,00000000,00000000,?), ref: 0088C32B

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: f7642eee9a6db0345435043eee7a2357a387651d3d4569c03bc5bd3bc90db0dc
Instruction ID: 0fb17065b95b2c6a7555171b2ec9785b4488a15e43bfbc124055c52fc661aac5
Opcode Fuzzy Hash: f7642eee9a6db0345435043eee7a2357a387651d3d4569c03bc5bd3bc90db0dc
Instruction Fuzzy Hash: 12F0A932A00215ABDB287B648845ABBB7A8FB40B54F158425ED16E3244DA74FE42D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0088BDF2 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00882A50: GetLastError.KERNEL32(?,00000008,008887AF,00000000,0087A8A0), ref: 00882A54
Part of subcall function 00882A50: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 00882AF6

EnumSystemLocalesW.KERNEL32(0088C0D0,00000001,?,?,-00000050,?,0088C472,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0088BE3C

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 39729b1768fc86d56c3a5bf8b8dedfd6d642767f18783c41474392e1e8ac87c7
Instruction ID: 920fef0ed3abca3e1f627c2cc299c2c82593f12ce17f90a82603868e1edf1624
Opcode Fuzzy Hash: 39729b1768fc86d56c3a5bf8b8dedfd6d642767f18783c41474392e1e8ac87c7
Instruction Fuzzy Hash: B3F0C2362007085FDB247F399881AAB7B91FF80768F15842DFA468B680C7B19C028750

Uniqueness

Uniqueness Score: -1.00%

Function 00885032 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0087CD14: EnterCriticalSection.KERNEL32(?,?,00882728,?,0089C360,00000008,008828EC,?,?,?), ref: 0087CD23

EnumSystemLocalesW.KERNEL32(Function_00015025,00000001,0089C420,0000000C,00885454,?), ref: 0088506A

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 2d2c22d07edd369addef1f5a3dac456b1ae1d26972eb6251c5edb2c07d9827b7
Instruction ID: ab5ac98100c1f72b4d7084c759f9ebdc2423c817e6378c8b184b4677cb806634
Opcode Fuzzy Hash: 2d2c22d07edd369addef1f5a3dac456b1ae1d26972eb6251c5edb2c07d9827b7
Instruction Fuzzy Hash: 27F04972A10604DFDB00EF98E842B9C7BF0FB44725F14812BF414DB2A1DB798900CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0088BD0C Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00882A50: GetLastError.KERNEL32(?,00000008,008887AF,00000000,0087A8A0), ref: 00882A54
Part of subcall function 00882A50: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 00882AF6

EnumSystemLocalesW.KERNEL32(0088BC65,00000001,?,?,?,0088C4D0,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0088BD43

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 6c06e8c2d5344deaaa9cb8f2cede8a3ff57831f159631ac73ac957673d24c295
Instruction ID: 2c0c6c141c5d896a542490355377def74627e06192cd95fcf2271a6e9d678ee1
Opcode Fuzzy Hash: 6c06e8c2d5344deaaa9cb8f2cede8a3ff57831f159631ac73ac957673d24c295
Instruction Fuzzy Hash: 14F0E536300209A7CB14BF79D845B6A7F95FFC1760B0A4059EA1ACB250C775A942C790

Uniqueness

Uniqueness Score: -1.00%

Function 00885558 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0088165C,?,20001004,00000000,00000002,?,?,00880C5E), ref: 0088558C

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: f3a2e6ab7ab1fc12c0eda7f1d060773fce9eadc16e213680c054bcf93e3f8989
Instruction ID: 0d96b31e4eaaf4e11cb20afb46e4444450d15902527b32c29112320586d93703
Opcode Fuzzy Hash: f3a2e6ab7ab1fc12c0eda7f1d060773fce9eadc16e213680c054bcf93e3f8989
Instruction Fuzzy Hash: EFE04F31500A28BBCF123F61EC08AAE7F16FF44750F048011FD15A6120CB718E21AB95

Uniqueness

Uniqueness Score: -1.00%

Function 00876B4B Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00006B57,008760AA), ref: 00876B50

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b3fbe6848968770520b792b0cb8b1168848f85ff79f29894e2e8373c1d502cff
Instruction ID: 38d9d9541f253fe2daa7e1b01b4e20b08f2e2fb47c37ddc0052b2fbe7b6d1a95
Opcode Fuzzy Hash: b3fbe6848968770520b792b0cb8b1168848f85ff79f29894e2e8373c1d502cff
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0088C630 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0088C630

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: d25fcda261d7228d20a22084380e2a4952bba86bd42f1fd39a80e31eb78de744
Instruction ID: 8eebdd9018b781ec471663490e3749a3f59dc3710b7bfcd76573bf8ce81d5e0c
Opcode Fuzzy Hash: d25fcda261d7228d20a22084380e2a4952bba86bd42f1fd39a80e31eb78de744
Instruction Fuzzy Hash: 05A001746022058B9740AF3AAA096093AE9BA4A691709806AA945D5274EA3895509A06

Uniqueness

Uniqueness Score: -1.00%

Function 00879638 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00879757
___TypeMatch.LIBVCRUNTIME ref: 00879865
_UnwindNestedFrames.LIBCMT ref: 008799B7
CallUnexpected.LIBVCRUNTIME ref: 008799D2

Strings

csm, xrefs: 00879675
csm, xrefs: 0087978E
csm, xrefs: 008796E2

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 2cf1c5aa2a7dd17a4d6abf704c6c6482bfb639ce75b4fa78e25ec61ef0e5bc82
Instruction ID: 7f8daea6919b0724f82145c69c96e2b31f33555a0ec53dfe841ea9af2c7f588f
Opcode Fuzzy Hash: 2cf1c5aa2a7dd17a4d6abf704c6c6482bfb639ce75b4fa78e25ec61ef0e5bc82
Instruction Fuzzy Hash: BBB1A371800209EFCF19DF98C8819AEBBB5FF05310F148169E999EB21AD730DA51CB92

Uniqueness

Uniqueness Score: -1.00%

Function 008904DA Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00890580
__alloca_probe_16.LIBCMT ref: 0089063B
__alloca_probe_16.LIBCMT ref: 008906CA
__freea.LIBCMT ref: 00890715
__freea.LIBCMT ref: 0089071B
__freea.LIBCMT ref: 00890751
__freea.LIBCMT ref: 00890757
__freea.LIBCMT ref: 00890767

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 543df10a1236f09ad96dc5d1bce9e2386bfa408602669617b3df7a03eb2e5082
Instruction ID: 7e0ed1d8107e2636ead0c582585781b6dd375fbfe3668400f4efdc26e77b5f9e
Opcode Fuzzy Hash: 543df10a1236f09ad96dc5d1bce9e2386bfa408602669617b3df7a03eb2e5082
Instruction Fuzzy Hash: 5B71D372900209AFDF21BE988C41BAE7BB9FF45724F2D0015E905F7282DA75DC408F62

Uniqueness

Uniqueness Score: -1.00%

Function 0088EDFD Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c3565c5f2b03be0f679944db45a15bcf4e911c42197d484a31bf70d0f9ceb5
Instruction ID: eadc774647d61c697c844c8249cfeca3bf865a780fe19a7e43f7abc458bef64e
Opcode Fuzzy Hash: a3c3565c5f2b03be0f679944db45a15bcf4e911c42197d484a31bf70d0f9ceb5
Instruction Fuzzy Hash: D8B1B074A04649EFDB11EF98C880BAD7BB1FF49304F188169EA15EB293CB719D41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00874844 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0087484B
std::_Lockit::_Lockit.LIBCPMT ref: 00874855
int.LIBCPMT ref: 0087486C

Part of subcall function 008721B2: std::_Lockit::_Lockit.LIBCPMT ref: 008721C3
Part of subcall function 008721B2: std::_Lockit::~_Lockit.LIBCPMT ref: 008721DD

codecvt.LIBCPMT ref: 0087488F
std::_Facet_Register.LIBCPMT ref: 008748A6
std::_Lockit::~_Lockit.LIBCPMT ref: 008748C6

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: ddc91b4372cf3304a17b0a487fa103acbbed2a29ae2018a204b167fc63d580a4
Instruction ID: 94e16bf4c4806a3f6c75959d6f2b6a0c874cac35485453dbccb57b6bbff6b887
Opcode Fuzzy Hash: ddc91b4372cf3304a17b0a487fa103acbbed2a29ae2018a204b167fc63d580a4
Instruction Fuzzy Hash: 3E11E7319106199BCB14FBA8C8057ADB7B4FF44720F18950EF509E7295DFB0DE018792

Uniqueness

Uniqueness Score: -1.00%

Function 008792CA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,008792C1,008779F7,00876B9B), ref: 008792D8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 008792E6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 008792FF
SetLastError.KERNEL32(00000000,008792C1,008779F7,00876B9B), ref: 00879351

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a68a386ba9e067dbba73aeb5249c3ba7174b52b7f04ba867d94d5c37e372b495
Instruction ID: 27400e6bd44145459c676cc9aee8422857ac46332c37fae3374444014a1c0511
Opcode Fuzzy Hash: a68a386ba9e067dbba73aeb5249c3ba7174b52b7f04ba867d94d5c37e372b495
Instruction Fuzzy Hash: 22014C3210CB11AEAB1837B97C8566F2745FB82334734832AF92CC51E8EF52CC11954A

Uniqueness

Uniqueness Score: -1.00%

Function 008801D9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,8F8D4C53,?,?,00000000,008920E7,000000FF,?,00880169,?,?,0088013D,00000000), ref: 0088020E
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00880220
FreeLibrary.KERNEL32(00000000,?,00000000,008920E7,000000FF,?,00880169,?,?,0088013D,00000000), ref: 00880242

Strings

CorExitProcess, xrefs: 00880218
mscoree.dll, xrefs: 00880207

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 464516abceb57b5c571cb69b1a612f4c0ccc5a883276e3616a0ac35029bb3e94
Instruction ID: 3f4a2551d8c04fbaf49814cdfc7a0f6397c9fc2c0e9f82667a2f6ae972155ae6
Opcode Fuzzy Hash: 464516abceb57b5c571cb69b1a612f4c0ccc5a883276e3616a0ac35029bb3e94
Instruction Fuzzy Hash: E5016735A54A15EFDB11AF50DC09FAEBBB8FB44B15F040526F825E22A0D7759904CF90

Uniqueness

Uniqueness Score: -1.00%

Function 008861FA Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00886281
__alloca_probe_16.LIBCMT ref: 00886342
__freea.LIBCMT ref: 008863A9

Part of subcall function 00883D40: HeapAlloc.KERNEL32(00000000,0074FB58,00000000,?,00875EDB,0074FB58,?,008726AE,00000044,00000000,0074FB58), ref: 00883D72

__freea.LIBCMT ref: 008863BE
__freea.LIBCMT ref: 008863CE

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 6047e6ec2b278b05e3c097395c10730eac1fc2e5aedac0a92a4769510cb0bc14
Instruction ID: 2e341a13cc4468ed1558d612e52d2ba8fe5617dd0ebeb3650dd56f6a3ba49845
Opcode Fuzzy Hash: 6047e6ec2b278b05e3c097395c10730eac1fc2e5aedac0a92a4769510cb0bc14
Instruction Fuzzy Hash: B951B37260020AAFEF21AFA4CC85DBB77A9FF44754B154168FD08D6241FB71CD209761

Uniqueness

Uniqueness Score: -1.00%

Function 0087414C Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00874153
std::_Lockit::_Lockit.LIBCPMT ref: 0087415E
std::_Lockit::~_Lockit.LIBCPMT ref: 008741CC

Part of subcall function 008742AF: std::locale::_Locimp::_Locimp.LIBCPMT ref: 008742C7

std::locale::_Setgloballocale.LIBCPMT ref: 00874179
_Yarn.LIBCPMT ref: 0087418F

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: f4b4688596ee026259fe64b5fc059b1e79c9bd851c892d655060a3a9155cfc88
Instruction ID: 9c2aa93d180126c984950a52fb6ca641f33669ec14673f9e6802f37d3674edd7
Opcode Fuzzy Hash: f4b4688596ee026259fe64b5fc059b1e79c9bd851c892d655060a3a9155cfc88
Instruction Fuzzy Hash: FC01BC35A009219BDB05FB64D84553C7BA1FF80700B18800AE90997399CFB4EE46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0087A412 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,0087A3C3,00000000,00000000,?,?,?,?,0087A4ED,00000002,FlsGetValue,00894CC8,FlsGetValue), ref: 0087A41F
GetLastError.KERNEL32(?,0087A3C3,00000000,00000000,?,?,?,?,0087A4ED,00000002,FlsGetValue,00894CC8,FlsGetValue,00000000,?,0087937D), ref: 0087A429
LoadLibraryExW.KERNEL32(?,00000000,00000000,00894CC8,FlsGetValue,00000000,?,0087937D), ref: 0087A451

Strings

api-ms-, xrefs: 0087A436

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 454c2cbec27d72d907b6e47af7ac95e4905f8b495611f29985bba52e72fca268
Instruction ID: b639906c740239bfea7fb6df3a9b5217777e355c841a5014b990a1f36ddb2540
Opcode Fuzzy Hash: 454c2cbec27d72d907b6e47af7ac95e4905f8b495611f29985bba52e72fca268
Instruction Fuzzy Hash: 2BE04F30284208BBEF206B60EC0AB1C3F54FB50B54F188021FA0DE80E1E7A3D9619689

Uniqueness

Uniqueness Score: -1.00%

Function 008870AF Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(8F8D4C53,00000000,00000000,00000000), ref: 00887112

Part of subcall function 00888857: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,0088639F,?,00000000,-00000008), ref: 00888903

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0088736D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 008873B5
GetLastError.KERNEL32 ref: 00887458

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: a2d9a7680099ac06e8c06571ee6d5d12bb7b0bdace91d4b99a3aed42087373a6
Instruction ID: 86ad1e16ec8a32b561ed3e71b0325a70f83931cc84b21b3f1befdaab34d5baff
Opcode Fuzzy Hash: a2d9a7680099ac06e8c06571ee6d5d12bb7b0bdace91d4b99a3aed42087373a6
Instruction Fuzzy Hash: 3CD17BB5E042489FCF15EFA8D8809ADBBB4FF49304F28452AE866E7352D730E945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 008793E1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 008794A8
___AdjustPointer.LIBCMT ref: 008794CB
___AdjustPointer.LIBCMT ref: 00879567

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: d684bf4e0af3fb19773b3d546b589712e73769ed05aa1e458fbf4a3748ad8bc8
Instruction ID: 3ae4c14b6410b5857e21bf491aac83aefd7f443ee60cea63e13fd74685608bd1
Opcode Fuzzy Hash: d684bf4e0af3fb19773b3d546b589712e73769ed05aa1e458fbf4a3748ad8bc8
Instruction Fuzzy Hash: 33510172600616DFEB2A9F18D841BBA77A5FF44314F18C029E89DC72A9E731EC81C791

Uniqueness

Uniqueness Score: -1.00%

Function 00888C73 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00888857: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,0088639F,?,00000000,-00000008), ref: 00888903

GetLastError.KERNEL32 ref: 00888CD7
__dosmaperr.LIBCMT ref: 00888CDE
GetLastError.KERNEL32(?,?,?,?), ref: 00888D18
__dosmaperr.LIBCMT ref: 00888D1F

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 78a869e83460130fc43906bd566851409528329e46d2bb3c9fe326466fccd8c4
Instruction ID: 4c9acb3822ca766d0ea0d9b12aa684c76a97f5dff3fdb19488db0f411670e62c
Opcode Fuzzy Hash: 78a869e83460130fc43906bd566851409528329e46d2bb3c9fe326466fccd8c4
Instruction Fuzzy Hash: E821A731600605EFDB20BF79CC8196BB7A9FF243687508929F919D7255EF31ED0087A1

Uniqueness

Uniqueness Score: -1.00%

Function 0087F51B Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a60a3e8b7012ae55a252660cd76a90ecd48474a1f00befd4bceec09e1f13f3c
Instruction ID: 310659b90a6f7f5e2bfa9c573d00e47d67964b78656695f6822af819d1e5910a
Opcode Fuzzy Hash: 0a60a3e8b7012ae55a252660cd76a90ecd48474a1f00befd4bceec09e1f13f3c
Instruction Fuzzy Hash: F4219D31204209AFDB20AF7ADC8086A77A9FF24368710C539FA1ED7256DB31ED1087A1

Uniqueness

Uniqueness Score: -1.00%

Function 00889C09 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00889C11

Part of subcall function 00888857: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,0088639F,?,00000000,-00000008), ref: 00888903

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00889C49
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00889C69

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 729f9aa9b6d78de0b063072e6ff7a00cd25e210157ac0279d07c136e9b62ea70
Instruction ID: a856c8d341583031005ae84f5b8bff15d768b0d8eeb481eebe17d9ff267bd122
Opcode Fuzzy Hash: 729f9aa9b6d78de0b063072e6ff7a00cd25e210157ac0279d07c136e9b62ea70
Instruction Fuzzy Hash: 9C11C0F1501619BE671177BAAD8ACBF79ADFE897A83180425F442D1111FA26CE0183B2

Uniqueness

Uniqueness Score: -1.00%

Function 008719D7 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008719E3
int.LIBCPMT ref: 008719F6

Part of subcall function 008721B2: std::_Lockit::_Lockit.LIBCPMT ref: 008721C3
Part of subcall function 008721B2: std::_Lockit::~_Lockit.LIBCPMT ref: 008721DD

std::_Facet_Register.LIBCPMT ref: 00871A29
std::_Lockit::~_Lockit.LIBCPMT ref: 00871A3F

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: f5daec2376960d79178e626cd192d2cbd9c8cec5102b4261c931045659902aa6
Instruction ID: 90ae7ed55705ed14a47f685612138e62885a544cda6559a7cc2dd3cec8e40b68
Opcode Fuzzy Hash: f5daec2376960d79178e626cd192d2cbd9c8cec5102b4261c931045659902aa6
Instruction Fuzzy Hash: 3801A736500124ABCB14FB6CDC4699DBB78FF40760B258149F50EE7299EF30DE419796

Uniqueness

Uniqueness Score: -1.00%

Function 00871AC9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00871AD5
int.LIBCPMT ref: 00871AE8

Part of subcall function 008721B2: std::_Lockit::_Lockit.LIBCPMT ref: 008721C3
Part of subcall function 008721B2: std::_Lockit::~_Lockit.LIBCPMT ref: 008721DD

std::_Facet_Register.LIBCPMT ref: 00871B1B
std::_Lockit::~_Lockit.LIBCPMT ref: 00871B31

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 2be984ce541fe2c59e942845bb0f7fb9f32b45da956015e52c57c80e1d3bc54e
Instruction ID: b963ccdb0da0fb63df0646a9f1013e20c7e053532430829948d004b4ca4a720a
Opcode Fuzzy Hash: 2be984ce541fe2c59e942845bb0f7fb9f32b45da956015e52c57c80e1d3bc54e
Instruction Fuzzy Hash: 55018476500114ABCF14BBACD90689D7B79FF44760B148149F50AEB295FF30DE418796

Uniqueness

Uniqueness Score: -1.00%

Function 00871A50 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00871A5C
int.LIBCPMT ref: 00871A6F

Part of subcall function 008721B2: std::_Lockit::_Lockit.LIBCPMT ref: 008721C3
Part of subcall function 008721B2: std::_Lockit::~_Lockit.LIBCPMT ref: 008721DD

std::_Facet_Register.LIBCPMT ref: 00871AA2
std::_Lockit::~_Lockit.LIBCPMT ref: 00871AB8

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: a03971dd6fe8c1ea83de80a9e55219b78c0ca1ca6c94bdb80efe5b9b227a07d9
Instruction ID: 93ff95701c3c69c28e6dd60404f97d832da16c376954a5512b867838cd2319db
Opcode Fuzzy Hash: a03971dd6fe8c1ea83de80a9e55219b78c0ca1ca6c94bdb80efe5b9b227a07d9
Instruction Fuzzy Hash: C401A732900524ABCF15BB6CD80A89DB778FF40364B148149F50ADB299EF30DF4197D6

Uniqueness

Uniqueness Score: -1.00%

Function 0089030F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,0088F1BA,00000000,00000001,00000000,00000000,?,008874AC,00000000,00000000,00000000), ref: 00890326
GetLastError.KERNEL32(?,0088F1BA,00000000,00000001,00000000,00000000,?,008874AC,00000000,00000000,00000000,00000000,00000000,?,00887A33,00000000), ref: 00890332

Part of subcall function 008902F8: CloseHandle.KERNEL32(FFFFFFFE,00890342,?,0088F1BA,00000000,00000001,00000000,00000000,?,008874AC,00000000,00000000,00000000,00000000,00000000), ref: 00890308

___initconout.LIBCMT ref: 00890342

Part of subcall function 008902BA: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,008902E9,0088F1A7,00000000,?,008874AC,00000000,00000000,00000000,00000000), ref: 008902CD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,0088F1BA,00000000,00000001,00000000,00000000,?,008874AC,00000000,00000000,00000000,00000000), ref: 00890357

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: a3e6ca4abc895d64447fe9b138d6ead619b8d57b94dcf6ed1f04f384bb39f956
Instruction ID: a2398984514a67577ced919ef26fad5c90766fc1711f700c88fde2ff263a6ade
Opcode Fuzzy Hash: a3e6ca4abc895d64447fe9b138d6ead619b8d57b94dcf6ed1f04f384bb39f956
Instruction Fuzzy Hash: B5F0A236500658BFCF523FD5EC089993F66FF493A1B0C4411FA19D5131C6318920EF95

Uniqueness

Uniqueness Score: -1.00%

Function 008790D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0087910F
__IsNonwritableInCurrentImage.LIBCMT ref: 008791C3

Strings

csm, xrefs: 008791AD

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 5f7f027b38e7206c44c9920561aba45f4afcafd57c83882243e1e43f142fdb53
Instruction ID: 6b3f7bec8a86f394abc441d865e76c1e9669906d518f099f1937de14b74679ab
Opcode Fuzzy Hash: 5f7f027b38e7206c44c9920561aba45f4afcafd57c83882243e1e43f142fdb53
Instruction Fuzzy Hash: 1641B334A0020A9BCF10DF68C844A9EBBB5FF45324F58C055E858EB39AD735DA11CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 008799DD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00879A02

Strings

RCC, xrefs: 00879A1C
MOC, xrefs: 00879A14

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 22f527526e17026e69600b827fb9b0e2133f29c5ec27dd965e512282e586d321
Instruction ID: 3756e58916fad85d918314827aa488cbae39143241c27acc267b3caeafedba12
Opcode Fuzzy Hash: 22f527526e17026e69600b827fb9b0e2133f29c5ec27dd965e512282e586d321
Instruction Fuzzy Hash: C5415571900219EFCF16DF98C881AEEBBB6FF48304F188099F958A7229D335DA50DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00871C4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00871C53
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00871C8B

Part of subcall function 0087424A: _Yarn.LIBCPMT ref: 00874269
Part of subcall function 0087424A: _Yarn.LIBCPMT ref: 0087428D

Strings

bad locale name, xrefs: 00871C99

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 343c738a985e4074494f159f5c2af28094d7ec49cc876ffa7e795731532a17d0
Instruction ID: 0d608c22e93952d28ced7e98b8a0703186da56d8ec6279f7bdb6a0de3be5cc59
Opcode Fuzzy Hash: 343c738a985e4074494f159f5c2af28094d7ec49cc876ffa7e795731532a17d0
Instruction Fuzzy Hash: 02F01771505B409E83319FAE8481443FBE4FE29210394DA2FE1DEC3A11D730E504CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00880317 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 00880317
GetCommandLineW.KERNEL32 ref: 00880322

Strings

8%t, xrefs: 0088031D

Memory Dump Source

Source File: 00000000.00000002.1609437098.0000000000871000.00000020.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1609424103.0000000000870000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609462798.0000000000893000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.000000000089D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008D3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609476771.00000000008E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609929123.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1609978045.00000000008EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: CommandLine
String ID: 8%t
API String ID: 3253501508-1789004024
Opcode ID: 9f515b8e68ddf3bea2f92784364714331351650099c08dd9a8d445d31fc4143a
Instruction ID: eb414487f7a4d761d4fbb0cf6b8c6af92d3ab9895c9e35708e118cf2f33406c1
Opcode Fuzzy Hash: 9f515b8e68ddf3bea2f92784364714331351650099c08dd9a8d445d31fc4143a
Instruction Fuzzy Hash: 01B04878801600EB8B80EF20A80C0043FB1B288202388885B981682320D77942088F11

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 7564, Parent PID: 7492COMMON

Execution Graph

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	87
Total number of Limit Nodes:	8

Executed Functions

Function 06A03F50 Relevance: 1.8, Strings: 1, Instructions: 523
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 06A041E4

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID: $dq
API String ID: 0-847773763
Opcode ID: 679f78b2a9e1703b0737dc825066aa89bbcb99e95a536fb2820a75e40ac181ae
Instruction ID: 3b9fd986a83607bdd4ef89213d7cf3d512432e9a05fa725e887a6fb16e6829bf
Opcode Fuzzy Hash: 679f78b2a9e1703b0737dc825066aa89bbcb99e95a536fb2820a75e40ac181ae
Instruction Fuzzy Hash: 07125D74B002159FDB54DF68D594AAEBBF6FF88300B148569E906EB3A5DB30DC01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A067D8 Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a217c35b99fe01123a3b2ec49893117369c12be48e39c7d316a97c39070d0c8f
Instruction ID: e5fae76edd89e0f9a93a37770108fd41efd2780a6189aa5422ae47eef792f09f
Opcode Fuzzy Hash: a217c35b99fe01123a3b2ec49893117369c12be48e39c7d316a97c39070d0c8f
Instruction Fuzzy Hash: 25F1B171A002159FDF55EF68E880B9EBBF2EF84304F158569E405EB2A1DB30ED56CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A0A3D8 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ce44adecd9a8bdf9f2d3d3e53e285406c70476f40fb90042e754728e07a34b
Instruction ID: f4fa5e0c462c969a353c3d79aaa7729a6d45d6b64159a79140c2f090b1494f6b
Opcode Fuzzy Hash: 26ce44adecd9a8bdf9f2d3d3e53e285406c70476f40fb90042e754728e07a34b
Instruction Fuzzy Hash: 79D1D474900318CFCB58EFB4D854AADBBB2FF8A301F1085A9D51AAB254DB355D86CF11

Uniqueness

Uniqueness Score: -1.00%

Function 06A0A3E8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bdbc9f5bfa2e9e919939ebe85195dbc7f9b2ddd5c9f8de55f20572b31eb65d0
Instruction ID: a5397c7a027cadc44ceeeea9da63fc2f588c5f11ee7e84fa739c7bcbc8a05678
Opcode Fuzzy Hash: 9bdbc9f5bfa2e9e919939ebe85195dbc7f9b2ddd5c9f8de55f20572b31eb65d0
Instruction Fuzzy Hash: DBD1D474900318CFCB18EFB4D844AADBBB2FF8A301F1085A9D51AAB254DB359D86CF11

Uniqueness

Uniqueness Score: -1.00%

Function 069E1298 Relevance: 10.2, Strings: 8, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 069E137B
$dq, xrefs: 069E1336
$dq, xrefs: 069E1455
$dq, xrefs: 069E1430
$dq, xrefs: 069E13A0
$dq, xrefs: 069E13EB
$dq, xrefs: 069E13AC
$dq, xrefs: 069E1461

Memory Dump Source

Source File: 00000003.00000002.1791026005.00000000069E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69e0000_RegAsm.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-634254105
Opcode ID: c94944350e6a3d0d8e4cedcba1d3c00759d4aa625c575c3a5c636d14db1268dc
Instruction ID: 41270988f931e68b6ba6515d031f98c2c99945090d63cc77597f64c32ebe61cd
Opcode Fuzzy Hash: c94944350e6a3d0d8e4cedcba1d3c00759d4aa625c575c3a5c636d14db1268dc
Instruction Fuzzy Hash: 6161C1747002009FDB969BA9DC44A3B77EBFF88705B218469EA068B7A3DF71DC418791

Uniqueness

Uniqueness Score: -1.00%

Function 069E1582 Relevance: 7.8, Strings: 6, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 069E1A12
$dq, xrefs: 069E1A88
$dq, xrefs: 069E18E3
$dq, xrefs: 069E1A7C
$dq, xrefs: 069E182E
$dq, xrefs: 069E1A57

Memory Dump Source

Source File: 00000003.00000002.1791026005.00000000069E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69e0000_RegAsm.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-2331353128
Opcode ID: 0a653888911aee88b87c291aff80088bf9d0bcee7d5db50b9aa9fb199f9406df
Instruction ID: 1949d2f28f9ef34b5ef4e15d88e379101e2eca11e66ac0ce6045f5763c453e73
Opcode Fuzzy Hash: 0a653888911aee88b87c291aff80088bf9d0bcee7d5db50b9aa9fb199f9406df
Instruction Fuzzy Hash: D9C1D230B002059FDB959BA8C854A3EBBEAFF89701F24446DE5028B7A2DF75DC05C791

Uniqueness

Uniqueness Score: -1.00%

Function 013DCFF9 Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1743246090.00000000013D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1614848564892cd6c2bacd4933993e71a3fa422c6bf3cf600e7f95e25c4c89ad
Instruction ID: 1ed59698befe724c7f27e3302ce915ec0ab8daaa38d2c9415e9a23235bb1261e
Opcode Fuzzy Hash: 1614848564892cd6c2bacd4933993e71a3fa422c6bf3cf600e7f95e25c4c89ad
Instruction Fuzzy Hash: 3B51C0B19003498FDB54DFA9E8497DEBFF1EF49318F248059D109AB3A1C7344989CB65

Uniqueness

Uniqueness Score: -1.00%

Function 013DD0A8 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 013DD136
GetCurrentThread.KERNEL32 ref: 013DD173
GetCurrentProcess.KERNEL32 ref: 013DD1B0
GetCurrentThreadId.KERNEL32 ref: 013DD209

Memory Dump Source

Source File: 00000003.00000002.1743246090.00000000013D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13d0000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4ad4e2d6c7150888ee09fe9680a5a3b9dbb7f4acd87ff23d440a74025bfb75a4
Instruction ID: a6edefb61bca2ceb2e5a78069c6f5c922ebd0201bbfdfb4b80120ff535243f94
Opcode Fuzzy Hash: 4ad4e2d6c7150888ee09fe9680a5a3b9dbb7f4acd87ff23d440a74025bfb75a4
Instruction Fuzzy Hash: F05189B19003498FDB54DFA9D94879EBBF1EF48314F208459E009A7390D7345988CF65

Uniqueness

Uniqueness Score: -1.00%

Function 013DD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 013DD136
GetCurrentThread.KERNEL32 ref: 013DD173
GetCurrentProcess.KERNEL32 ref: 013DD1B0
GetCurrentThreadId.KERNEL32 ref: 013DD209

Memory Dump Source

Source File: 00000003.00000002.1743246090.00000000013D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13d0000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 5d05e753867d6ef8f31f70bdb949bcc58b37e71a9412541143f0f214cc564228
Instruction ID: 1453b53c63972bad3ff9754104d8c8da842f22bc1bb5a9a906935a3fcf7d43b7
Opcode Fuzzy Hash: 5d05e753867d6ef8f31f70bdb949bcc58b37e71a9412541143f0f214cc564228
Instruction Fuzzy Hash: 6A5177B19003098FDB58DFA9D948B9EBBF5FF48314F208459E419A73A0DB345A88CF65

Uniqueness

Uniqueness Score: -1.00%

Function 069E1297 Relevance: 2.6, Strings: 2, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 069E1336
$dq, xrefs: 069E13EB

Memory Dump Source

Source File: 00000003.00000002.1791026005.00000000069E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69e0000_RegAsm.jbxd

Similarity

API ID:
String ID: $dq$$dq
API String ID: 0-2340669324
Opcode ID: eca10f42084b52f1dc20dbe1014d167b3520bd76c14624d482cb8243bf438d39
Instruction ID: f72202a28464baaa38cd8637e9340b92c7d5b551409bc01aa378c08118523d89
Opcode Fuzzy Hash: eca10f42084b52f1dc20dbe1014d167b3520bd76c14624d482cb8243bf438d39
Instruction Fuzzy Hash: C341F2747402019FD7869BA88C54A3B76EBAF99705F114469EB02CB7E2CEB1DC058791

Uniqueness

Uniqueness Score: -1.00%

Function 013DAE30 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 013DB086

Memory Dump Source

Source File: 00000003.00000002.1743246090.00000000013D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13d0000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8ef9e843c20d69d0e9191efa5ac400cf80ab569fe1bb041374c927a1db04adc5
Instruction ID: 1a118ed1c288c1086b928940c8cd9e1fb34cfd7962b784c4f382f4117599fd86
Opcode Fuzzy Hash: 8ef9e843c20d69d0e9191efa5ac400cf80ab569fe1bb041374c927a1db04adc5
Instruction Fuzzy Hash: 9C8165B1A00B058FDB24DF29E54075ABBF5FF88308F00896DD58AD7A90DB75E949CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013D4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 013D59F1

Memory Dump Source

Source File: 00000003.00000002.1743246090.00000000013D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13d0000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 13de6a5d66e8552948176efc08fd4be6f86d3d60067375af7895a73d82077eae
Instruction ID: eb6c57aef4f702ff62237e4cf59820b79addc44cf7876a342e2cc91e77f92840
Opcode Fuzzy Hash: 13de6a5d66e8552948176efc08fd4be6f86d3d60067375af7895a73d82077eae
Instruction Fuzzy Hash: 6941F1B1C0072DCADB24CFA9C884B8DBBB5FF49314F20806AD509AB255DBB56949CF91

Uniqueness

Uniqueness Score: -1.00%

Function 013D5935 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 013D59F1

Memory Dump Source

Source File: 00000003.00000002.1743246090.00000000013D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13d0000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4d666d4350f68ec988c6f37df0d2b6b1656349791756cd211c0a16e05f657dab
Instruction ID: 7a956cc7224453ae6008493b416da49f91a8a97d56964350c077b82a782cc72a
Opcode Fuzzy Hash: 4d666d4350f68ec988c6f37df0d2b6b1656349791756cd211c0a16e05f657dab
Instruction Fuzzy Hash: 5F4112B1C00729CEDB24CFA9C884B8DBBB5FF49314F24805AD408AB251DBB5294ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 013DD300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 013DD387

Memory Dump Source

Source File: 00000003.00000002.1743246090.00000000013D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13d0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d6aed6a0822a8d3a3c6d71b1dcd209038545618ca8eb96ea67ef76e47bc58037
Instruction ID: b64f5062f2677aa38effdeb21933ed2b639e9f2004106959c065642e354f42c9
Opcode Fuzzy Hash: d6aed6a0822a8d3a3c6d71b1dcd209038545618ca8eb96ea67ef76e47bc58037
Instruction Fuzzy Hash: 4021C2B59003489FDB10CFAAD984ADEBFF4EB48324F14841AE919A3350D774A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 013DD2F9 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 013DD387

Memory Dump Source

Source File: 00000003.00000002.1743246090.00000000013D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13d0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3e43d4945802a7edb6938ef9d13b8d841eaadc1c49664501a00ef82974d004ed
Instruction ID: 2a09f9d4e4155808e9d4e18b1c1678f8f93f80b5186c8e4630e72eb88594ef3f
Opcode Fuzzy Hash: 3e43d4945802a7edb6938ef9d13b8d841eaadc1c49664501a00ef82974d004ed
Instruction Fuzzy Hash: 7C21E4B5D003489FDB10CF99D985ADEBBF4EB48324F14841AE918B3350D374A954CF64

Uniqueness

Uniqueness Score: -1.00%

Function 013DA870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,013DB101,00000800,00000000,00000000), ref: 013DB312

Memory Dump Source

Source File: 00000003.00000002.1743246090.00000000013D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13d0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 39eb47ff007db3b60c1d5d9dab41a6c58d6017dc2ef93ca64f0a04b40556c658
Instruction ID: 0bd70408ed937c2ab2d7f44ebc0719570f1ba32f56f51c2e55482adfcd779928
Opcode Fuzzy Hash: 39eb47ff007db3b60c1d5d9dab41a6c58d6017dc2ef93ca64f0a04b40556c658
Instruction Fuzzy Hash: CB1126B6D003498FDB10CF9AD844ADEFBF4EB89324F11842ED919A7200C774A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 013DB2A0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,013DB101,00000800,00000000,00000000), ref: 013DB312

Memory Dump Source

Source File: 00000003.00000002.1743246090.00000000013D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13d0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9407b3aa77b32e8047f903b0bfbe497a6bf4d043438534f62ff189f32d850214
Instruction ID: 1bf46a84a86e8f4fe0723fd42fa565fd31a2be8b3b9d2f6a5278f50482cccd6b
Opcode Fuzzy Hash: 9407b3aa77b32e8047f903b0bfbe497a6bf4d043438534f62ff189f32d850214
Instruction Fuzzy Hash: CA2147B68003498FDB10CFAAD844ADEFFF4EB49324F10852ED929A7240C774A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 013DB020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 013DB086

Memory Dump Source

Source File: 00000003.00000002.1743246090.00000000013D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13d0000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f7ea10c9c52f213dfd58e6104d678c971f590d6468265bf756fc1958e5867d32
Instruction ID: dc5d976b229649ee1221007a0bd7f6dcd32de0f28dbf1580e42177bc36dc391a
Opcode Fuzzy Hash: f7ea10c9c52f213dfd58e6104d678c971f590d6468265bf756fc1958e5867d32
Instruction Fuzzy Hash: 661110B6C003498FDB20DF9AD844ADEFBF4EB89324F15841AD929B7210C375A549CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A059D8 Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

d, xrefs: 06A05C29

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 3d0f698eb463f1cfff84550308bbbf0a385e15b41004712ffe692f98c90b57cf
Instruction ID: eaf6e93ef3e2c777bd7fc6989986c9157ee82d58f63aee5b341755282662dd3e
Opcode Fuzzy Hash: 3d0f698eb463f1cfff84550308bbbf0a385e15b41004712ffe692f98c90b57cf
Instruction Fuzzy Hash: 1AC16D34A00602CFCB55DF19D58096ABBF2FF89310755C999E45A8B6A6D730FC46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 069E1BA0 Relevance: 1.4, Instructions: 1437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791026005.00000000069E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24cb57a22885c0e91228416ed013ad430b4afb84f25e366e6f30cd07eca6e81c
Instruction ID: 51135e843719509cad2b4176b1498cd42c3e326e3018fc27720f09c1d5d0f151
Opcode Fuzzy Hash: 24cb57a22885c0e91228416ed013ad430b4afb84f25e366e6f30cd07eca6e81c
Instruction Fuzzy Hash: 0AC24070B002189FCB55DF64C851AADBBB6FF88704F118099E60A9B3A1DF71AE45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06A084C8 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

4'dq, xrefs: 06A085B1

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'dq
API String ID: 0-1167855494
Opcode ID: 50a21e83e1019d299f5e61e03454a0de3b9b5041ac9069ab63277a5881d50c53
Instruction ID: 5d243be5cf0fbc34774ddb58b10bb21c4e61c8faf13574b7757cdee8ecd42ad9
Opcode Fuzzy Hash: 50a21e83e1019d299f5e61e03454a0de3b9b5041ac9069ab63277a5881d50c53
Instruction Fuzzy Hash: F6318C317002058FCB49EB7CA4555AF3BE7ABC82017104439E50ACB385EE39AC4687E1

Uniqueness

Uniqueness Score: -1.00%

Function 06A03DE0 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

4'dq, xrefs: 06A03F25

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'dq
API String ID: 0-1167855494
Opcode ID: 68cf45db09beff4270c107a8579407b287e18a8ac99149c99f4120de0f491cdd
Instruction ID: 0b28752e9b853609bb32b8458224555103c8fec87c16415650f2f58360ad05f9
Opcode Fuzzy Hash: 68cf45db09beff4270c107a8579407b287e18a8ac99149c99f4120de0f491cdd
Instruction Fuzzy Hash: 9F312871B003524FCB19AB38A85456E7BE6EFCA31135548AEE80A8B791DE34EC07C791

Uniqueness

Uniqueness Score: -1.00%

Function 06A0B358 Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

4'dq, xrefs: 06A0B399

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'dq
API String ID: 0-1167855494
Opcode ID: 1471cbdd54bb63e07b41a90ee51dced462fd234ce014cd4ffd02b6b63886ff6f
Instruction ID: eb260e6bb85456404a462c7211a1ac57bfbf1d355215967fd5c6e463b328ef41
Opcode Fuzzy Hash: 1471cbdd54bb63e07b41a90ee51dced462fd234ce014cd4ffd02b6b63886ff6f
Instruction Fuzzy Hash: 4D01A2B0E05246DFCB05EFB8EA9419C7FB2FF55201B1544AED446EB350DA340E49CB21

Uniqueness

Uniqueness Score: -1.00%

Function 06A03EC8 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4'dq, xrefs: 06A03F25

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'dq
API String ID: 0-1167855494
Opcode ID: 7e4836848b1333b29a2554ee702e2039c9de74374e37026f8c8f86789f89ab92
Instruction ID: 52156da2cf6b3d8e3f9e5ab5aab53fee9dadb5062378af03800e337f59b96d18
Opcode Fuzzy Hash: 7e4836848b1333b29a2554ee702e2039c9de74374e37026f8c8f86789f89ab92
Instruction Fuzzy Hash: 9FF067313103124F8708EB69E85196E7BDAEBD9212351492DE80A8BA54EE20BD4B87A5

Uniqueness

Uniqueness Score: -1.00%

Function 06A0B368 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4'dq, xrefs: 06A0B399

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'dq
API String ID: 0-1167855494
Opcode ID: fd32ebf49f3074eedce5b79084841baf684edde07f214d17671bef6066f61a23
Instruction ID: 3e830fdef900ae5b1a37dc5a543edb65c6c0552517f1eb660c1a5a835a2677e8
Opcode Fuzzy Hash: fd32ebf49f3074eedce5b79084841baf684edde07f214d17671bef6066f61a23
Instruction Fuzzy Hash: B0F03CB0E0120AEFCB04EFB8E65555D7BB6FB44201B1445A9D90AA7354EA381E44DB54

Uniqueness

Uniqueness Score: -1.00%

Function 069E00D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791026005.00000000069E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 082c15874bc3942571c01267cdee67c94c26c61bb6e7f22dd14c55c01675a42c
Instruction ID: afd00ec5d0c65b67c84cccc655fca1d9241a7f6956664177233c2cb925458ad6
Opcode Fuzzy Hash: 082c15874bc3942571c01267cdee67c94c26c61bb6e7f22dd14c55c01675a42c
Instruction Fuzzy Hash: DC426930B006298FCBA5AF78D45062EBBF2FF95705B50495CD503AB792CF79AC058B82

Uniqueness

Uniqueness Score: -1.00%

Function 069E2070 Relevance: .6, Instructions: 570COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791026005.00000000069E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 747b058d298fed0836946efaffd557accdb6624391305719c6773c50f85f7077
Instruction ID: 1195bbd6545f7761228846c2db63031b356d47dbb204d857af90eb235c398898
Opcode Fuzzy Hash: 747b058d298fed0836946efaffd557accdb6624391305719c6773c50f85f7077
Instruction Fuzzy Hash: E622A474B102148FCB559B24C856EAE77FAEFC8704F118189EA0A5B791CF71EE418F91

Uniqueness

Uniqueness Score: -1.00%

Function 069E4050 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791026005.00000000069E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec62c47c337fc6b8dca34b8de42345ac7877d08a4e92eb516850472d034defa
Instruction ID: 2fb48408a5cbf8c43785c96da50b159ee131e433b8e6eb6efec6612ffdede97c
Opcode Fuzzy Hash: 5ec62c47c337fc6b8dca34b8de42345ac7877d08a4e92eb516850472d034defa
Instruction Fuzzy Hash: 38D11A74B002049FCB55DFA9C894EAEBBF6EF89704F118099E505DB3A2DA71ED41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 069E00B8 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791026005.00000000069E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcc50b34f3ffc3e49fe57b415fa98e041bd6f5c7ec63afe227e9511d281fdf2d
Instruction ID: 892fe43181fc7bb88bb51349212c70ff73358c0cb79139accf4bc9decfe9fbfd
Opcode Fuzzy Hash: fcc50b34f3ffc3e49fe57b415fa98e041bd6f5c7ec63afe227e9511d281fdf2d
Instruction Fuzzy Hash: CBC19130B002048FDB859B64C859B6E7BFAFF89704F118059EA029B7A2CFB5DC55CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06A04AFF Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075879d67a695b55a6f38ff82636dc01a2b370ee730c59a90729367ba66d191b
Instruction ID: 3d62e3bf8feba7563e0caff881496d5aa8112e5e3fdc0a4971ba495e715b4408
Opcode Fuzzy Hash: 075879d67a695b55a6f38ff82636dc01a2b370ee730c59a90729367ba66d191b
Instruction Fuzzy Hash: CCC13774B00605CFDB44DF69D484AAABBF2FF89305B1584A9E506DB3A1DB34EC46CB60

Uniqueness

Uniqueness Score: -1.00%

Function 06A07D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e18ca235a2be6a283b5d588c06c5d956354d0f6f7a99552914e9d695f2b06991
Instruction ID: 012e59f88b00269dcb7de246304fc4524a9218a2c67313f7f5e53462b44f9b1b
Opcode Fuzzy Hash: e18ca235a2be6a283b5d588c06c5d956354d0f6f7a99552914e9d695f2b06991
Instruction Fuzzy Hash: 8B514771E00258CFEB54DFA9E980BEEBBF5BF48710F148429D415AB284DB74A946CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06A059C8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08bad7fc9d749175e7ec90cf393509bdc50c6777182200c2ead468396e268ee
Instruction ID: b1dc0fa499f634186088a4d4308bb9ab1e46d62fb6472c0da9e5f52b365231ba
Opcode Fuzzy Hash: b08bad7fc9d749175e7ec90cf393509bdc50c6777182200c2ead468396e268ee
Instruction Fuzzy Hash: 88515775A00205CFDB54DF59D980AAAFBF2FF88310B558999E5599B3A1D730F801CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06A07D4C Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f94c778bf02c181886dacd6c7d4a9030a086f398b7eff162947b3c786a4da1d5
Instruction ID: 58a4e8ccca907c871458c37a7898df84edbf47b171436bf44611b0f77d1c1860
Opcode Fuzzy Hash: f94c778bf02c181886dacd6c7d4a9030a086f398b7eff162947b3c786a4da1d5
Instruction Fuzzy Hash: 825138B1E00258DFEB54DFA9E984BDEBBF5AF49700F148429E415AB280DB74A845CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06A05579 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ce8f1c0b5eee97dc71864351e0e0963dc202d8bc8d9321abeb5e643315c98e2
Instruction ID: 0f3d6dd9200c972dbddb1ff77275082c81910c756a5e22f06378a0baa2aa71cf
Opcode Fuzzy Hash: 2ce8f1c0b5eee97dc71864351e0e0963dc202d8bc8d9321abeb5e643315c98e2
Instruction Fuzzy Hash: 82316875B112119FCB09EF38D884A6EBBB2BF89301B448469F905CB395DB30DD02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A05588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bc89225ab3acee4d02b2ebf24ff8f0f6ef46d19884e7acbf356fb7e1464afe6
Instruction ID: b7c70085a3c66b23625e6e1bccfd0fa2bc4206887a787656448fc7ac2b7a8aa3
Opcode Fuzzy Hash: 2bc89225ab3acee4d02b2ebf24ff8f0f6ef46d19884e7acbf356fb7e1464afe6
Instruction Fuzzy Hash: BE312375B112119FCB19EF38D88496EBBB6FF89301B548469F9058B3A5DB31ED02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A087A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ca5705ff1fb022e69b261775896f362031d07aca3b302a92fa597c4ae6f4a7f
Instruction ID: 6a945f659af0caa2f9d2ac37085ad2cd5c62ffd3954f9d86133fd4857df7bbd6
Opcode Fuzzy Hash: 5ca5705ff1fb022e69b261775896f362031d07aca3b302a92fa597c4ae6f4a7f
Instruction Fuzzy Hash: 724102B1D012489FDF54DFAAE944ADEFBB6AF88310F14802AD415B7290DB34A949CF94

Uniqueness

Uniqueness Score: -1.00%

Function 069E10D0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791026005.00000000069E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720d0db5b3d6d48a49fffabf70676ee0a01ec50c536a24be6e987769820f886f
Instruction ID: c99469925f4681640aa5907d827f9ef783ee6e4c92852faa112b068e063bb30e
Opcode Fuzzy Hash: 720d0db5b3d6d48a49fffabf70676ee0a01ec50c536a24be6e987769820f886f
Instruction Fuzzy Hash: BF31E330B042408FDB568BA8CC14A6A7BF6EF96710F2584AAD516CB7A3CF34CC05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06A08795 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b400300012ed3322f98994817857022684836c40d774f9326e1cd6b9e00f7434
Instruction ID: 8da46e695dacd0f3f584225cd5b5fd273705ed3a402fddbacaa231a79955510f
Opcode Fuzzy Hash: b400300012ed3322f98994817857022684836c40d774f9326e1cd6b9e00f7434
Instruction Fuzzy Hash: 343113B1D012489FEB54DFAAD944ADEBFF6AF48300F14802AD415BB290DB35A949CF54

Uniqueness

Uniqueness Score: -1.00%

Function 069E360B Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791026005.00000000069E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b39127986180758c3e826aa618f90cb6bd27626cb0a41160cb99dbf5de8db62
Instruction ID: ec3a38de9749d31afe90b71a39f8502ef2fb4ab4a2c95e3a82673ede332c491c
Opcode Fuzzy Hash: 5b39127986180758c3e826aa618f90cb6bd27626cb0a41160cb99dbf5de8db62
Instruction Fuzzy Hash: 11213D35B401049FCB54DF65C884DAABBB2FF88715F2180A9F9099F3A2DA31ED05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06A08A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2073bd493085a0e05f26f019821d1ecec1999eb56ab14940d78b11d3f1de3810
Instruction ID: b8674cb806bffddca9eaaba08f384fbc2d7740205556c1a00c8a21f6afd4cf67
Opcode Fuzzy Hash: 2073bd493085a0e05f26f019821d1ecec1999eb56ab14940d78b11d3f1de3810
Instruction Fuzzy Hash: 603123B1D01258DFDF14DFA9E890ADEBBF5AF48310F14802AE405B7280CB78A945CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0129D654 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1742858620.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_129d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2db0fe841bcf7d3d5d8b8be3c42babf94604d5077c06c131cdd299303a442f6
Instruction ID: 9edd2f254dce0aa44c2107a779163e140f33f7ba058ef5202b2df1ee8a483cf7
Opcode Fuzzy Hash: d2db0fe841bcf7d3d5d8b8be3c42babf94604d5077c06c131cdd299303a442f6
Instruction Fuzzy Hash: 3C2148B6510244EFCF05CF58D9C4B2ABFA5FB88314F24C668EA0D0B246C336D416DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0129D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1742858620.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_129d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d7ef6075c1a0bda42511e612c779c87796aaa7b918dd25f413255917d8d5bc
Instruction ID: 731b2e409b45a8535cbbfdf0316960d94e90bb7b4f00b3dea350edc2d994f52d
Opcode Fuzzy Hash: 53d7ef6075c1a0bda42511e612c779c87796aaa7b918dd25f413255917d8d5bc
Instruction Fuzzy Hash: A72124B5510209DFDF01DF48C9C0B66BF65FB94324F24C568D90A0B206C336E456DAA1

Uniqueness

Uniqueness Score: -1.00%

Function 012AD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1742899342.00000000012AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12ad000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b05730e7995b112895fe54387db6e01d12f196399225a3a6770e72c4364b20
Instruction ID: 59cc070088ae4ac8040050fe091217ecb5f89a60aa93a70c3696dc8b1e896d0f
Opcode Fuzzy Hash: 30b05730e7995b112895fe54387db6e01d12f196399225a3a6770e72c4364b20
Instruction Fuzzy Hash: CF2142B0694308DFCB11CF68D9C4B22BBA1EB84314F60C96DD90A4B742C37AD807CA61

Uniqueness

Uniqueness Score: -1.00%

Function 06A0C0BF Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea90caa99bc06046500b0e6c74bc13ce60f7f29fbe5fbae4576911b8850953ff
Instruction ID: 4f7d8b282d6421d3220bde4bc1d75803ac3ba9716fd0938f24d8e30fb9d1ea6c
Opcode Fuzzy Hash: ea90caa99bc06046500b0e6c74bc13ce60f7f29fbe5fbae4576911b8850953ff
Instruction Fuzzy Hash: 7C113B722053954FC302CF28DDA47EB3FE6DF82305B04455FD4C68B262CA215D1AC751

Uniqueness

Uniqueness Score: -1.00%

Function 06A08A8C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 933eddd0ea9c76a90c1d97ab38d7713d778a633817778af50ac3a1abd024f8a0
Instruction ID: 338c7546ec50c62cfefd3c0f570d3b4ac1fd644357e678f32791c39848eeae50
Opcode Fuzzy Hash: 933eddd0ea9c76a90c1d97ab38d7713d778a633817778af50ac3a1abd024f8a0
Instruction Fuzzy Hash: 402144B1D013489FDF54EFA9D894B9EBBF8AF09310F148029E405A7380CB78A945CB94

Uniqueness

Uniqueness Score: -1.00%

Function 012AD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1742899342.00000000012AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12ad000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64fe9b5366ec70282bb9c7e2590ff895bf9fcad11e7de191a542633a882ac024
Instruction ID: 3f9d56df0ce758bf6167b8902520c239b5f88ddaf9b6c9b4159202dc634f5558
Opcode Fuzzy Hash: 64fe9b5366ec70282bb9c7e2590ff895bf9fcad11e7de191a542633a882ac024
Instruction Fuzzy Hash: 7A21B0755483849FCB03CF24D994711BF71EB46314F28C5DAD9498F6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 06A0BC5D Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a93c21f034c50f896c647411dd29b6891a6d21a73771e22ad68f5a640439281d
Instruction ID: 3c102faeed6de99469ae0b5beab34f71ca1c7bd8528aaf86265eb156f10f5fd0
Opcode Fuzzy Hash: a93c21f034c50f896c647411dd29b6891a6d21a73771e22ad68f5a640439281d
Instruction Fuzzy Hash: E711E1B22102155FCB85B738A8505BE3BE7FFE2246305082DE60B87601DE206D4B87B1

Uniqueness

Uniqueness Score: -1.00%

Function 0129D64F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1742858620.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_129d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76b64262ce5a84015d8a22a2ffddec681db0ffbce5b5348a29b5f34a6a2bf4a
Instruction ID: 23e9bbe4fc13366ecc534ef624f24b327ddd028e515c993f52d32f1964ae5c17
Opcode Fuzzy Hash: b76b64262ce5a84015d8a22a2ffddec681db0ffbce5b5348a29b5f34a6a2bf4a
Instruction Fuzzy Hash: 1F21D276504284DFCF06CF48D9C4B5ABF72FB88314F24C6A9DA490B256C33AD416DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0129D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1742858620.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_129d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84cb766ada7fbb598ee014b1ccd1c5bca89836becd0d68ec9e965d0554f0dc82
Instruction ID: 6d896dd15c0d5c8634599fa3db698d9c61c1049dbdf8499439aa37a753d208c6
Opcode Fuzzy Hash: 84cb766ada7fbb598ee014b1ccd1c5bca89836becd0d68ec9e965d0554f0dc82
Instruction Fuzzy Hash: 3A11E176504285CFDF02CF48D9C4B56BF71FB84324F24C6A9D9090B616C33AE45ADBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A08350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57de8b8601eb064edc0df4035e65092f591e2222985ec7b1ea59213ddb40e652
Instruction ID: e23e089646685d8daa324a245137e0a3ff1237d996de63480ac16d255668cdaf
Opcode Fuzzy Hash: 57de8b8601eb064edc0df4035e65092f591e2222985ec7b1ea59213ddb40e652
Instruction Fuzzy Hash: DC018471B002199BDF50DEA9EC44ABFF7FAEBD8751B14403AE604D3240EB309D1587A1

Uniqueness

Uniqueness Score: -1.00%

Function 06A06E90 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d38b159cdf555039c19c7a5e6c80cd7067eddb0c725824d91be82a7ee6d7d392
Instruction ID: 6e0ef779e0b1d161895ab8478e7b1f037a18ee82e802ce3c03b0ae73420d1219
Opcode Fuzzy Hash: d38b159cdf555039c19c7a5e6c80cd7067eddb0c725824d91be82a7ee6d7d392
Instruction Fuzzy Hash: 3A0126776041A82ACB514E996C01ABB3FDDDB8C166B084022FE84C2241C028C82197B0

Uniqueness

Uniqueness Score: -1.00%

Function 06A0C499 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 463c82b034f6c05ca7847ee07e6885e9426732e9c38831e8413de6feb2435018
Instruction ID: b1c1677205a40c3631c1d1d1682522a271452fc4cba77b39a60aea0b7fcc8dbf
Opcode Fuzzy Hash: 463c82b034f6c05ca7847ee07e6885e9426732e9c38831e8413de6feb2435018
Instruction Fuzzy Hash: 7F01E1B02047058FC325EF38E50465E7BE3EFDA316B118A29D04A87744CF749C0ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A0BC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27748e6994875da75a9116449bf09d1076e2ab1e872985f658f9ca823c171b95
Instruction ID: 2561591ba8195356d4e63149dbf71c54fa49bd4342bd1474667bad2d738f6ac1
Opcode Fuzzy Hash: 27748e6994875da75a9116449bf09d1076e2ab1e872985f658f9ca823c171b95
Instruction Fuzzy Hash: 70017CB22102164B8B84B73CE55453E7AE3FFE1256754482CE60B8B640DE707D8B87A1

Uniqueness

Uniqueness Score: -1.00%

Function 0129DA4D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1742858620.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_129d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41474479d2ac94e99a7da25f79614b585acb1ed8c98b78f11aebba959d74ece7
Instruction ID: 3d3ef9fde8b682048fda80442386feaa1038afe901f6e43d2492457a8b4c0463
Opcode Fuzzy Hash: 41474479d2ac94e99a7da25f79614b585acb1ed8c98b78f11aebba959d74ece7
Instruction Fuzzy Hash: 2C01F27101C3499AEB208A9DDC84B66BFD8DF51325F18C41AEE090B282C67C9840D6B1

Uniqueness

Uniqueness Score: -1.00%

Function 06A0E8B0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4d9218f7226ea5ba5e5fee625188a4eff8083002604cf46ca326ea0b016893b
Instruction ID: 53f8c513ebc83d6a078c281b688158f8b4f8e06d596fd03b9bab4bda44fa25b9
Opcode Fuzzy Hash: d4d9218f7226ea5ba5e5fee625188a4eff8083002604cf46ca326ea0b016893b
Instruction Fuzzy Hash: AE01F9346183489FCB45DB74D81489D3FB6EF8630075484E9E505CB362DB36DD01D791

Uniqueness

Uniqueness Score: -1.00%

Function 06A0C4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45a12f47289dea422d041d476d848abb67cfb98ae33118ea830fc0ad3a48422e
Instruction ID: 07db8c8efbc70f4ccac0a03e95fec7d02cfc865f055cfe7bb0dea85755f00611
Opcode Fuzzy Hash: 45a12f47289dea422d041d476d848abb67cfb98ae33118ea830fc0ad3a48422e
Instruction Fuzzy Hash: 25015E742006058FD725EF79E54866A77E3FBD5316B108A29D14B87744CF74AC0ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A05508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f4ae6a58b6d86ebd3adee3c8f31096d48aebc9480093a53d0a5e300af261fa9
Instruction ID: 372bafee4fea994df1a05bcc7a726c8149c65f63e1d2aca75a8e02d614077a33
Opcode Fuzzy Hash: 6f4ae6a58b6d86ebd3adee3c8f31096d48aebc9480093a53d0a5e300af261fa9
Instruction Fuzzy Hash: D5016238E15711CFEBA5AB25F60452777F7BF843097148828E44686594DA75F481CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06A0C170 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48e4bec032b9f4f4dce3385bf7137362263f4f21e1b58248bc2fb38a6d08446e
Instruction ID: 3077af9c0614508009584a05becb3a4f506534baa03572a5df2374280debc68c
Opcode Fuzzy Hash: 48e4bec032b9f4f4dce3385bf7137362263f4f21e1b58248bc2fb38a6d08446e
Instruction Fuzzy Hash: 4D01F4B1901B05DFD315DF25E908596BFF6FF49300700892AE48AC7710DB34A90ACFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A08F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 292b92f169b77aab2fa2cda07542aa39c3b639493dd33484f49296854c352c45
Instruction ID: 8e5db3fb656e1672aa5b9378354829ac192c129bf00ca76d2ca9f0973ed5d148
Opcode Fuzzy Hash: 292b92f169b77aab2fa2cda07542aa39c3b639493dd33484f49296854c352c45
Instruction Fuzzy Hash: 0901D6B4D04209EFDF44EFA9E5456AEBBF5BF48305F1081AAE415A3380E7780A44DF94

Uniqueness

Uniqueness Score: -1.00%

Function 06A08F42 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4f5783ebb517051f17bb1b75eb7424ee6381771a3ebbfcaad881a2b37b03f2b
Instruction ID: fe9209d36881ec5ea40db025e2b70767776e00d1e1c38b90f92c4b5362801280
Opcode Fuzzy Hash: d4f5783ebb517051f17bb1b75eb7424ee6381771a3ebbfcaad881a2b37b03f2b
Instruction Fuzzy Hash: FF015AB4C0828ADFDF50DFA4E9496EEBFB5AF09315F10419AE410A7381D7740A41DB94

Uniqueness

Uniqueness Score: -1.00%

Function 06A0ACB8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32f22a7d766f218dd3c93e8729d262d4a206a3084d5c99996ce6c491a11ea9a1
Instruction ID: 6947d21508ceb8c263ca00966bfe6e4fd1a08748c9bff31b95b1499893c8a568
Opcode Fuzzy Hash: 32f22a7d766f218dd3c93e8729d262d4a206a3084d5c99996ce6c491a11ea9a1
Instruction Fuzzy Hash: 93F0E9B23093645FC71237786C240BE3FB6D9D669234504DEE28ACB192DA545907C3F1

Uniqueness

Uniqueness Score: -1.00%

Function 0129DA4C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1742858620.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_129d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70ad9de81dca15a5db80bb7be3d15f5e4fb7f41fc8e5864d51ade54c83c93a2d
Instruction ID: 1490e9fdb1babede2679431e1cc9a040110f0a44b2bfb852223ad212b3477e55
Opcode Fuzzy Hash: 70ad9de81dca15a5db80bb7be3d15f5e4fb7f41fc8e5864d51ade54c83c93a2d
Instruction Fuzzy Hash: 4DF0F6320083449EFB108A0EDD84B62FFD8EB41735F18C45EEE084B286C37CA840CAB0

Uniqueness

Uniqueness Score: -1.00%

Function 06A06EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 417c87a01bc08a9f90865b7a12d09b56e0969a9eab4907d44885fc253b132d7a
Instruction ID: aa475bd8c5600eb523249a21c4bee827a288364f76d00249a35a9c951ba2608c
Opcode Fuzzy Hash: 417c87a01bc08a9f90865b7a12d09b56e0969a9eab4907d44885fc253b132d7a
Instruction Fuzzy Hash: 3FF012662041E83F8F518EAA5C10DFB7FEDDA8E1657084156FE98D2141C429C925ABB0

Uniqueness

Uniqueness Score: -1.00%

Function 06A0ADE9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b833f035058fa81f7e5875d72976886cbc8d0736e166e33b61e7783d3fcee6e3
Instruction ID: 152446ee284c9728f4a2954ac348cbe1eebca815fd982ee6001ab6ac76ee80ec
Opcode Fuzzy Hash: b833f035058fa81f7e5875d72976886cbc8d0736e166e33b61e7783d3fcee6e3
Instruction Fuzzy Hash: 6DF0A732304151AFC754776DA8547DFBFDBEFCA655F04452DE20E87242CA611C4583B5

Uniqueness

Uniqueness Score: -1.00%

Function 06A08FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d424e66ca1a549e5366cec0fdb323c768eda0e0d05fce57513bd3cc31568cd
Instruction ID: 09f6414e00dfb60a748a2293d03226b61e8d4f5347ff97497a9b6347673887a8
Opcode Fuzzy Hash: a0d424e66ca1a549e5366cec0fdb323c768eda0e0d05fce57513bd3cc31568cd
Instruction Fuzzy Hash: 92F0A9B4C082499FEB40EFB4E8450AEBFB1EF6A301F0041C6E406E7291E6394A01DB40

Uniqueness

Uniqueness Score: -1.00%

Function 06A067C8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bf165dd5c06af9260b9dd2c1148a8ead20a45576c6acbb2b037045452b79ef4
Instruction ID: 039b18745b94eb0504f19c287fd0f9058dd0c13063d696ad7a203dac05be688b
Opcode Fuzzy Hash: 7bf165dd5c06af9260b9dd2c1148a8ead20a45576c6acbb2b037045452b79ef4
Instruction Fuzzy Hash: 24F09A72B103009BE7219B68A805FA57BE5AB52719F158266F214DF1E2E7B1E80AC740

Uniqueness

Uniqueness Score: -1.00%

Function 06A054F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d22053c887496fbeb940974cf401beae4f38c07cb88d1d380c3c97c8a00ad9a2
Instruction ID: 53516aa3bcb2019689ae2ad2a2cd0ad13c94fd6ba1fb73a3d34cfa6699110b29
Opcode Fuzzy Hash: d22053c887496fbeb940974cf401beae4f38c07cb88d1d380c3c97c8a00ad9a2
Instruction Fuzzy Hash: E7F02439D017418FEBA4DB61E60076BBBF2BF80315F08886CD046469A4D6B5F485CF40

Uniqueness

Uniqueness Score: -1.00%

Function 06A0AC60 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b328f18aadd1d3667877e82e529f84944046a001812c215b9986fd3ed0f5623a
Instruction ID: b13e420d5e542f56c6038e8f581dee8a37c002e00ec5ac49fc3684e3379ed905
Opcode Fuzzy Hash: b328f18aadd1d3667877e82e529f84944046a001812c215b9986fd3ed0f5623a
Instruction Fuzzy Hash: BCF0A7726183A45FC71367386C344EE3F66DED6665305009BD289CB193CE650D46C7F6

Uniqueness

Uniqueness Score: -1.00%

Function 06A08340 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1a19a21e8831cacbfb0e844acab58b06c4020e8e515f43f86624388cfd63ae
Instruction ID: 18eb91bfeb955fc619f45aba048c9c0fb028a3b8b78225765cd55011a950ef5a
Opcode Fuzzy Hash: 0e1a19a21e8831cacbfb0e844acab58b06c4020e8e515f43f86624388cfd63ae
Instruction Fuzzy Hash: 8EF02772F042198BCF50DEA8AC446AFBBE9AFD4211F0C043AD644C3280F730D411C362

Uniqueness

Uniqueness Score: -1.00%

Function 06A0ADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27c081cf611133a5a5166c9e6c8288ccb2e91c3f499d36cadc0835fc67182848
Instruction ID: 4d9ca458f26f4a77e246c7403436726ca98dcb86590b17692c2039768e2bc9fe
Opcode Fuzzy Hash: 27c081cf611133a5a5166c9e6c8288ccb2e91c3f499d36cadc0835fc67182848
Instruction Fuzzy Hash: 14E09231300111AFC7107A6EA498AAEBADAEBC9351B00442CE20EC3241CAB11C4547B5

Uniqueness

Uniqueness Score: -1.00%

Function 06A0C180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26a2026dfa5352131132b9e5326c4d71b54dcaa1884a29351dc72ae2a8a7f586
Instruction ID: 17d5ded7b2e0457374dc7c5b0acaf2883d872ce46e2ee25634c142e1ac9c865a
Opcode Fuzzy Hash: 26a2026dfa5352131132b9e5326c4d71b54dcaa1884a29351dc72ae2a8a7f586
Instruction Fuzzy Hash: 5FF09074500B01CFD715DF26E548512BBF6FF88301700C62EE44B83A10DB74A90ACF94

Uniqueness

Uniqueness Score: -1.00%

Function 06A0C120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509150f6e7d35c7ecda78c65d4c6069b7a7529bd5a56f214a3d068a4f198e9e
Instruction ID: 69a0ddec011190720e375903663cb546ba44b914691d175db7ddb48884ecc02e
Opcode Fuzzy Hash: f509150f6e7d35c7ecda78c65d4c6069b7a7529bd5a56f214a3d068a4f198e9e
Instruction Fuzzy Hash: 3BE065712007618FC711EB2DE5087AE7FE6DFD5315F04092DE24B8B641CBA56C068BA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A0CC38 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bb72a1b8e5037003e156c833b6b75e4c34d788782b5870358bdde5f978f577f
Instruction ID: c3e6dadc8e6491cfab62a6deb553203477176363091a18e364ddaf59f445fd3b
Opcode Fuzzy Hash: 5bb72a1b8e5037003e156c833b6b75e4c34d788782b5870358bdde5f978f577f
Instruction Fuzzy Hash: F1E0DFB22053518FDB52EF28F8446DEBBA9EBA2210B014162D000DB751CA7C0C46CBE3

Uniqueness

Uniqueness Score: -1.00%

Function 06A05698 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1931777c433fc264df0fcce2ab2ce297e6dc007678c457750c1e593f6250b2be
Instruction ID: 4e4f968d13584f9a40ed996d36b10cac7ea6aa127ddaeb778fcb2cb4f673b21d
Opcode Fuzzy Hash: 1931777c433fc264df0fcce2ab2ce297e6dc007678c457750c1e593f6250b2be
Instruction Fuzzy Hash: 25E012B250D2414FD3159B64B8099863BE4EB51324F55887EF044CA096E7359447CA65

Uniqueness

Uniqueness Score: -1.00%

Function 06A0B500 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1ab7a68aff8bedc3b64a61dbb5013abf58b0dc14c41df7411b28fea58b295dd
Instruction ID: 3b06854e0bb93a3a0472b585f4c49e699cf2474734a7fc95b297675a164e6b14
Opcode Fuzzy Hash: a1ab7a68aff8bedc3b64a61dbb5013abf58b0dc14c41df7411b28fea58b295dd
Instruction Fuzzy Hash: 0BF039B5D04209EFCB01DFB4DA488CDBBB6EB84200F1082AAD806E3244EA314B55DB90

Uniqueness

Uniqueness Score: -1.00%

Function 06A0CE88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 447840e767661842b2fc03169fd7be192fb599bbb574467a4402c5090a82eb76
Instruction ID: c2580c71898490ef55f47aea2bd9340da9654ac01b92677bb0a9e6c499ff92f6
Opcode Fuzzy Hash: 447840e767661842b2fc03169fd7be192fb599bbb574467a4402c5090a82eb76
Instruction Fuzzy Hash: D6E026F5205382AFCF43DB30B41A46A3BAAEB5220030600E9DC86DB302E92C5C0683D2

Uniqueness

Uniqueness Score: -1.00%

Function 06A0E1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a33eefd3cf75022711ef1d63fecbb424b265eeeecba42d63fa5e171c880223f
Instruction ID: b6d2d8f3d1bf8134ff921f897396e0eaebb808315c15ac4e4be40ff448749ac7
Opcode Fuzzy Hash: 9a33eefd3cf75022711ef1d63fecbb424b265eeeecba42d63fa5e171c880223f
Instruction Fuzzy Hash: 45E048F2949355EFCB01DF78A9508AD7BF5DB5210172046D6D809E7261D5340F158761

Uniqueness

Uniqueness Score: -1.00%

Function 06A0E8F8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce2e53cb71dd8eb2559a2d0c59c1af35f51a457c54ba4514f1f1170a1a50e847
Instruction ID: 8dc305629c2528ce90187732c4f84ab510184900e218bde4af7e53dd90912dd2
Opcode Fuzzy Hash: ce2e53cb71dd8eb2559a2d0c59c1af35f51a457c54ba4514f1f1170a1a50e847
Instruction Fuzzy Hash: F6E0123A2542449FC7429B54D8408993F79BF5A65474940D5F5808F372C622D821DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A0AC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8faa864441ef82362cf0f1dc74c4b82d3e5653fb4a427fcb300298e144e56a
Instruction ID: 32355c7698c1a2482f31959c45986df71b03bf74e2b0c4c30a3e458fcf41b5bd
Opcode Fuzzy Hash: 3c8faa864441ef82362cf0f1dc74c4b82d3e5653fb4a427fcb300298e144e56a
Instruction Fuzzy Hash: BBD05E32310229978B1677A9B4184BF7BABEBC9662301042EE70FCB240CEA51D0787E5

Uniqueness

Uniqueness Score: -1.00%

Function 06A0B510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5de7d63449054f61547962491b6072f826a2f8bef31fb57768eb41d47a4b096f
Instruction ID: 8711f862a535674c4cf757024b29c12b87143cc6bb2072a1ed2994e7a568f421
Opcode Fuzzy Hash: 5de7d63449054f61547962491b6072f826a2f8bef31fb57768eb41d47a4b096f
Instruction Fuzzy Hash: 3EE09275D0020DEFCB40DFE8E9448DDBBB9EB48200F1082AAD909A3200EB306B55EF90

Uniqueness

Uniqueness Score: -1.00%

Function 06A0E280 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1dac1a3e7fc4b1e8c4cef71a8120f206854f13ce63c8a2699ca1ba89c0034d5
Instruction ID: e4ca46f517bda40d9c3e459a62f5cbb59aeff5ff343888ae0bbb23392497b24d
Opcode Fuzzy Hash: b1dac1a3e7fc4b1e8c4cef71a8120f206854f13ce63c8a2699ca1ba89c0034d5
Instruction Fuzzy Hash: AEE04FB16006279BCB44EF24FE0664673A9F749744F110165D801B76A0C77C2D599BD2

Uniqueness

Uniqueness Score: -1.00%

Function 06A0E210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd3b24e457cb9e9fbf600c6307a38736ce1851ea235f2cdc8cad160e21bca641
Instruction ID: ec9b219e7896b9e7a40918502aea7b48f20987a68787faf1144329ece18af23f
Opcode Fuzzy Hash: bd3b24e457cb9e9fbf600c6307a38736ce1851ea235f2cdc8cad160e21bca641
Instruction Fuzzy Hash: 8ED017B2A0020DFF8B40EFA8E90195EB7F9EB44205B1085A99409E3200EA352F009BA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A0F8EA Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17c0c04f795f0bc49303d1e2bdaa10a454868d46ba5a67abba7bc81c60e05fed
Instruction ID: ed48132114f4d3f905cba75921e0ee278a192d017df6061f85bc50391df12060
Opcode Fuzzy Hash: 17c0c04f795f0bc49303d1e2bdaa10a454868d46ba5a67abba7bc81c60e05fed
Instruction Fuzzy Hash: 69C012B37900204F0AE9A66CB0101AD66D397D85A23AA007AEA0AC3348DD608C864B90

Uniqueness

Uniqueness Score: -1.00%

Function 06A0DFD1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25322b15a9bf4b4aa744a043399dbb7b24e529d53f3423909fa8b446f5c14a6
Instruction ID: 59b90a289f752a9c6598e7cebf3cce9d7cc5244938716fee29fbbd5e2e2aef79
Opcode Fuzzy Hash: e25322b15a9bf4b4aa744a043399dbb7b24e529d53f3423909fa8b446f5c14a6
Instruction Fuzzy Hash: 33B09B6638F7805ED71605244C155453A164FE7E1470400DFD7539D1A6C612044B43E1

Uniqueness

Uniqueness Score: -1.00%

Function 06A03721 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7d002279a471f24bed9af6143647064568712c88f7b040865133c5d8fc6eafc
Instruction ID: 6594ad9538077bb91fe62e429a66ed6ec9d44faf0be80951763745ea4aefe8dd
Opcode Fuzzy Hash: e7d002279a471f24bed9af6143647064568712c88f7b040865133c5d8fc6eafc
Instruction Fuzzy Hash: CDC02BF2C343400FF30061906C06F057F104374702F031021E712071C3E644D0088161

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06A0E2C7 Relevance: 46.6, Strings: 37, Instructions: 387COMMON

Download Yara Rule

Strings

DGj, xrefs: 06A0E431
DGj, xrefs: 06A0E40C
DGj, xrefs: 06A0E543
DGj, xrefs: 06A0E456
DGj, xrefs: 06A0E770
DGj, xrefs: 06A0E309
DGj, xrefs: 06A0E680
DGj, xrefs: 06A0E630
DGj, xrefs: 06A0E4CB
DGj, xrefs: 06A0E51B
DGj, xrefs: 06A0E3C2
DGj, xrefs: 06A0E748
DGj, xrefs: 06A0E32E
DGj, xrefs: 06A0E2E4
DGj, xrefs: 06A0E4F3
DGj, xrefs: 06A0E658
DGj, xrefs: 06A0E39D
DGj, xrefs: 06A0E3E7
DGj, xrefs: 06A0E6A8
DGj, xrefs: 06A0E5BB
DGj, xrefs: 06A0E608
DGj, xrefs: 06A0E798
DGj, xrefs: 06A0E6F8
DGj, xrefs: 06A0E5E3
DGj, xrefs: 06A0E353
DGj, xrefs: 06A0E378
DGj, xrefs: 06A0E7C3
DGj, xrefs: 06A0E47B
DGj, xrefs: 06A0E819
DGj, xrefs: 06A0E844
DGj, xrefs: 06A0E86F
DGj, xrefs: 06A0E593
DGj, xrefs: 06A0E4A3
DGj, xrefs: 06A0E720
DGj, xrefs: 06A0E56B
DGj, xrefs: 06A0E7EE
DGj, xrefs: 06A0E6D0

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-3760891704
Opcode ID: 610070f79c68b70077f7ba84fe620a72a2cd1eac1f79f937f9d02e05f5bcdada
Instruction ID: d1c1cc8269b3c352911670c99cd96552c67aea5bf81e2febd84a1bd29c861f4f
Opcode Fuzzy Hash: 610070f79c68b70077f7ba84fe620a72a2cd1eac1f79f937f9d02e05f5bcdada
Instruction Fuzzy Hash: 2DD1AE30310611ABC705AAB99C93EBDA797FB8A301B40493CD12A4F791EFB96D1943C7

Uniqueness

Uniqueness Score: -1.00%

Function 06A0E2D8 Relevance: 46.6, Strings: 37, Instructions: 383COMMON

Download Yara Rule

Strings

DGj, xrefs: 06A0E431
DGj, xrefs: 06A0E40C
DGj, xrefs: 06A0E543
DGj, xrefs: 06A0E456
DGj, xrefs: 06A0E770
DGj, xrefs: 06A0E309
DGj, xrefs: 06A0E680
DGj, xrefs: 06A0E630
DGj, xrefs: 06A0E4CB
DGj, xrefs: 06A0E51B
DGj, xrefs: 06A0E3C2
DGj, xrefs: 06A0E748
DGj, xrefs: 06A0E32E
DGj, xrefs: 06A0E2E4
DGj, xrefs: 06A0E4F3
DGj, xrefs: 06A0E658
DGj, xrefs: 06A0E39D
DGj, xrefs: 06A0E3E7
DGj, xrefs: 06A0E6A8
DGj, xrefs: 06A0E5BB
DGj, xrefs: 06A0E608
DGj, xrefs: 06A0E798
DGj, xrefs: 06A0E6F8
DGj, xrefs: 06A0E5E3
DGj, xrefs: 06A0E353
DGj, xrefs: 06A0E378
DGj, xrefs: 06A0E7C3
DGj, xrefs: 06A0E47B
DGj, xrefs: 06A0E819
DGj, xrefs: 06A0E844
DGj, xrefs: 06A0E86F
DGj, xrefs: 06A0E593
DGj, xrefs: 06A0E4A3
DGj, xrefs: 06A0E720
DGj, xrefs: 06A0E56B
DGj, xrefs: 06A0E7EE
DGj, xrefs: 06A0E6D0

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-3760891704
Opcode ID: a659010fbd5e1bb968d594091ed8c4fba1ae40c741826d29f6bdeed0dc008780
Instruction ID: 9195980bd0f0c37b2cf3a0fce9098647c963364d9f074c3b08458d62d021ac92
Opcode Fuzzy Hash: a659010fbd5e1bb968d594091ed8c4fba1ae40c741826d29f6bdeed0dc008780
Instruction Fuzzy Hash: 92D1AE30310611ABC705AAB99C93EBDA697FB8B301B44493CD12A4F791EFB96C1943C7

Uniqueness

Uniqueness Score: -1.00%

Function 06A0CC7F Relevance: 16.4, Strings: 13, Instructions: 148COMMON

Download Yara Rule

Strings

DGj, xrefs: 06A0CC9C
DGj, xrefs: 06A0CE58
DGj, xrefs: 06A0CDC4
DGj, xrefs: 06A0CDE9
DGj, xrefs: 06A0CD9F
DGj, xrefs: 06A0CCE6
DGj, xrefs: 06A0CE33
DGj, xrefs: 06A0CD30
DGj, xrefs: 06A0CCC1
DGj, xrefs: 06A0CD55
DGj, xrefs: 06A0CD0B
DGj, xrefs: 06A0CE0E
DGj, xrefs: 06A0CD7A

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-2950335420
Opcode ID: d503168d923e26f5a993f737bd2f277d335d481a8b238b4c547910cd13fc7edd
Instruction ID: 1f0a5aaeba93067882e2f56a6bda1c98b2a6adde5c555cb4ebd2ff85298ae923
Opcode Fuzzy Hash: d503168d923e26f5a993f737bd2f277d335d481a8b238b4c547910cd13fc7edd
Instruction Fuzzy Hash: 5C41A1303106116BD705AAB99C93ABD6793FB97200B404A38D22E4FA82DFB96D0943D7

Uniqueness

Uniqueness Score: -1.00%

Function 06A0CC90 Relevance: 16.4, Strings: 13, Instructions: 143COMMON

Download Yara Rule

Strings

DGj, xrefs: 06A0CC9C
DGj, xrefs: 06A0CE58
DGj, xrefs: 06A0CDC4
DGj, xrefs: 06A0CDE9
DGj, xrefs: 06A0CD9F
DGj, xrefs: 06A0CCE6
DGj, xrefs: 06A0CE33
DGj, xrefs: 06A0CD30
DGj, xrefs: 06A0CCC1
DGj, xrefs: 06A0CD55
DGj, xrefs: 06A0CD0B
DGj, xrefs: 06A0CE0E
DGj, xrefs: 06A0CD7A

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-2950335420
Opcode ID: c7e320a8e0ccb67dc61dd69bda589afc8d628423eea273bd337801a59f9ab6e0
Instruction ID: e8d8c63b5300f261f9445237cfb01a01e21caa0eb58a877d61cf203aeb7beb9c
Opcode Fuzzy Hash: c7e320a8e0ccb67dc61dd69bda589afc8d628423eea273bd337801a59f9ab6e0
Instruction Fuzzy Hash: FA4171303106116BD705AAB99C83ABD6793FB97201B404A38D22E4FA85DFBD6D0947D7

Uniqueness

Uniqueness Score: -1.00%

Function 06A0CED1 Relevance: 10.1, Strings: 8, Instructions: 101COMMON

Download Yara Rule

Strings

DGj, xrefs: 06A0CFEF
DGj, xrefs: 06A0CF5B
DGj, xrefs: 06A0CFA5
DGj, xrefs: 06A0CF36
DGj, xrefs: 06A0CFCA
DGj, xrefs: 06A0CF11
DGj, xrefs: 06A0CEEC
DGj, xrefs: 06A0CF80

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-4266538241
Opcode ID: c384ce9041842240e21064b00cfd67701e6516da365eccfbcda886836710072e
Instruction ID: b7200d7854c21086d835f0159d6944960242471cec4aa2760c261f3583972902
Opcode Fuzzy Hash: c384ce9041842240e21064b00cfd67701e6516da365eccfbcda886836710072e
Instruction Fuzzy Hash: A731B4303103116BC706AAA99C83BBD6B93FB87200B404A38E11E4FB81DFB96D4943D7

Uniqueness

Uniqueness Score: -1.00%

Function 06A0CEE0 Relevance: 10.1, Strings: 8, Instructions: 93COMMON

Download Yara Rule

Strings

DGj, xrefs: 06A0CFEF
DGj, xrefs: 06A0CF5B
DGj, xrefs: 06A0CFA5
DGj, xrefs: 06A0CF36
DGj, xrefs: 06A0CFCA
DGj, xrefs: 06A0CF11
DGj, xrefs: 06A0CEEC
DGj, xrefs: 06A0CF80

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-4266538241
Opcode ID: 09ba6cbdffe0411cead8491d8582edb9c29fa9dafef99c74a58af2ccc5e5bf10
Instruction ID: 8d24a577b8731465df496f38e6efcec81c64e3ebb6476840c7ea6c3d83c086e1
Opcode Fuzzy Hash: 09ba6cbdffe0411cead8491d8582edb9c29fa9dafef99c74a58af2ccc5e5bf10
Instruction Fuzzy Hash: EB2195303102116BC705AAA99C83FBD6793FB86200B404A38E21E4FA81DFB96C4943D7

Uniqueness

Uniqueness Score: -1.00%

Function 06A0C968 Relevance: 8.8, Strings: 7, Instructions: 88COMMON

Download Yara Rule

Strings

DGj, xrefs: 06A0C9D6
DGj, xrefs: 06A0CA7A
DGj, xrefs: 06A0C9AD
DGj, xrefs: 06A0CA51
DGj, xrefs: 06A0CA28
DGj, xrefs: 06A0C9FF
DGj, xrefs: 06A0C984

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-3215742008
Opcode ID: 0a9f2ef18fc6ef81b1cdd14ab8f1be5d087ed1d057540d044fd2ec6a2b1295c6
Instruction ID: a8111b2c12938670d8701aef6cac8e3d7c219a056b69f30f7c2509eef111b358
Opcode Fuzzy Hash: 0a9f2ef18fc6ef81b1cdd14ab8f1be5d087ed1d057540d044fd2ec6a2b1295c6
Instruction Fuzzy Hash: F731D9303002936FDB016BB9DC55DAD7B93FBA77017044638E11A9F690CEB89D8A87C2

Uniqueness

Uniqueness Score: -1.00%

Function 06A0C978 Relevance: 8.8, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

DGj, xrefs: 06A0C9D6
DGj, xrefs: 06A0CA7A
DGj, xrefs: 06A0C9AD
DGj, xrefs: 06A0CA51
DGj, xrefs: 06A0CA28
DGj, xrefs: 06A0C9FF
DGj, xrefs: 06A0C984

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-3215742008
Opcode ID: 164ab447e0e704532a8462e280e7f866c0f1c9dca51113e54fb701c59abfdbde
Instruction ID: 7bd46770958c7c9f38581ff8f8eed94553c409fd054904e27031af17e276db9b
Opcode Fuzzy Hash: 164ab447e0e704532a8462e280e7f866c0f1c9dca51113e54fb701c59abfdbde
Instruction Fuzzy Hash: B121BC303002936BCB056FA9DC46DBD7B93FBA7701B004538E1199F690CEB99D8A87C2

Uniqueness

Uniqueness Score: -1.00%

Function 06A0D538 Relevance: 7.6, Strings: 6, Instructions: 79COMMON

Download Yara Rule

Strings

DGj, xrefs: 06A0D579
DGj, xrefs: 06A0D60D
DGj, xrefs: 06A0D5E8
DGj, xrefs: 06A0D59E
DGj, xrefs: 06A0D5C3
DGj, xrefs: 06A0D554

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-1101258311
Opcode ID: d0b4cf4781c588596f6693a5fc8f1a5f27b165d1a5692ca87928de1d90266551
Instruction ID: d259692cadbbdb76edafdfeb747e99d7ba5c95f94efa2f0080e3a6d8dc275593
Opcode Fuzzy Hash: d0b4cf4781c588596f6693a5fc8f1a5f27b165d1a5692ca87928de1d90266551
Instruction Fuzzy Hash: 5721D3303103516FC7065AA99C93ABD6B93FB97600B404A3CD11A4FB81DFB95D1943D3

Uniqueness

Uniqueness Score: -1.00%

Function 06A0D548 Relevance: 7.6, Strings: 6, Instructions: 73COMMON

Download Yara Rule

Strings

DGj, xrefs: 06A0D579
DGj, xrefs: 06A0D60D
DGj, xrefs: 06A0D5E8
DGj, xrefs: 06A0D59E
DGj, xrefs: 06A0D5C3
DGj, xrefs: 06A0D554

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-1101258311
Opcode ID: 351ed81a23075aa9e743d918bba303dd2ee93c476a508f8d094986fa9bfcee7a
Instruction ID: 171bdc7152d154143ae05a1aee3a47cf3439180df0f21bc37dc9b7519677f74d
Opcode Fuzzy Hash: 351ed81a23075aa9e743d918bba303dd2ee93c476a508f8d094986fa9bfcee7a
Instruction Fuzzy Hash: A711A4303102117BC7016AA99C83EBDA793FB87600B404A3CE11A4FA81DFBA6D5943D3

Uniqueness

Uniqueness Score: -1.00%

Function 06A0ED10 Relevance: 5.2, Strings: 4, Instructions: 241COMMON

Download Yara Rule

Strings

(_dq, xrefs: 06A0EF79
(_dq, xrefs: 06A0EDF9
(_dq, xrefs: 06A0ED7A
(_dq, xrefs: 06A0EEFA

Memory Dump Source

Source File: 00000003.00000002.1791057472.0000000006A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a00000_RegAsm.jbxd

Similarity

API ID:
String ID: (_dq$(_dq$(_dq$(_dq
API String ID: 0-2092114380
Opcode ID: ff8225ec91c5565a6dcab52d4d44b3c749cebff0b23d63b50ae2d2de939f556d
Instruction ID: e796e05f3b187da03b99ef262f02dd36214cfe0ddd28fa1ecc99541838ddfe9e
Opcode Fuzzy Hash: ff8225ec91c5565a6dcab52d4d44b3c749cebff0b23d63b50ae2d2de939f556d
Instruction Fuzzy Hash: 3F91AC79A04304AFDB45AF78D4105AE7BB2FF86300F24846ADD069B381DA35DE06CBE1

Uniqueness

Uniqueness Score: -1.00%

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	tZvjMg3Hw9.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	5.42.66.10
	[V2]launcher.exe	Get hash	malicious	PureLog Stealer, RedLine, Xmrig	Browse	45.15.156.167
	SecuriteInfo.com.Trojan.PWS.Siggen3.32416.6905.9348.exe	Get hash	malicious	RedLine	Browse	5.42.65.101
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.96
	VOrqSh1Fts.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse	5.42.66.10
	WlCIinu0yp.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, Socks5Systemz, Vidar, zgRAT	Browse	5.42.66.10
	file.exe	Get hash	malicious	LummaC, GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse	5.42.65.64
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.96
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	5.42.65.64
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.96

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.6739546549390685
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	502'272 bytes
MD5:	b09b19c780bfaa784ccf35dc454f9326
SHA1:	0efc9a13e26c279bcf9d07bdb62f928f19860c7a
SHA256:	4bf00732a644554a0bef0eb0fa080a182a63b52eda03dd8d4df8704feebf20d2
SHA512:	862ba80daa00c9402db064a028dd20c79afdda5fa0d7211319f1b84831a2b62023bd2e6ddcbb0367feb1afbe3d3c835a2c745d38a4e6a1953fa140e6c694c8bd
SSDEEP:	12288:aW5NIYF4bnCv2clgw4exVxfY/pTiQwBNhKHo:F7IY+wh4eQpTiQwDW
TLSH:	3EB4F10675C1C073E5B314310AF1DAB89EBEBDB00A65AADF67940F7E5F30142D631A6A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{.+z?.E)?.E)?.E)..F(3.E)..@(..E)..A(*.E)..A(-.E)..F(+.E)..D(:.E)?.D)e.E)..@(r.E)..@(>.E)...)>.E)..G(>.E)Rich?.E)........PE..L..

Entrypoint:	0x406239
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6633D7BF [Thu May 2 18:13:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	ab27116ad46b656bb5d70aa3050a97a2

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c5fc	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7c000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7d000	0x1a60	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2aba8	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2aae8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2120f	0x21400	eea591e7044a57e321ef84feff1625cc	False	0.5809592340225563	data	6.627182847461709	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d30	0x9e00	c10f3fb03e9a1ab0638518744af45fda	False	0.43482990506329117	data	4.959860378128255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x1d54	0x1000	96f6fc94400f9b3c80d126cafa6f2df3	False	0.190673828125	data	3.018020491461944	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.Left	0x2f000	0x4c4c4	0x4c600	47cf34fa0aa3573e62d9e3071b564611	False	0.9980181055646481	data	7.998997410016008	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7c000	0x1e0	0x200	5b005c249129c6a5b1fa0a8e8a6bce9e	False	0.53125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7d000	0x1a60	0x1c00	ffa018fa0ff6a602e133d892d6803856	False	0.7205636160714286	data	6.362035067940247	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Users\user\AppData\Local\Temp\TmpCD1A.tmp

C:\Users\user\AppData\Local\Temp\TmpCD2B.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
file.exe

Function 008851FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00880143 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00871379 Relevance: 3.3, APIs: 2, Instructions: 287
COMMON

Function 00887965 Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Function 008753C9 Relevance: 3.1, APIs: 2, Instructions: 116
COMMON

Function 00887567 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 00884EE6 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00873D0A Relevance: 3.0, APIs: 2, Instructions: 31
memoryCOMMON

Function 008852C6 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre