Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1435951
MD5:	702021300aed8dfde070019d752b020d
SHA1:	45f152925534102013fbe5c17805ca938499256d
SHA256:	e75a30472c88c4a2d875b19a60c704d773de97c025a87e5e813b02cbaccb4678
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5228 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 702021300AED8DFDE070019D752B020D)

RegAsm.exe (PID: 712 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "5.42.65.96:28380", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.2196742233.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.2198042480.000000000323A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5228	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 712	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 712	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.8df028.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.8df028.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.8b0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 5.42.65.96 - Destination IP: 192.168.2.6

Timestamp:	05/03/24-13:40:54.255282
SID:	2043234
Source Port:	28380
Destination Port:	49699
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.6 - Destination IP: 5.42.65.96

Timestamp:	05/03/24-13:40:54.078459
SID:	2046045
Source Port:	49699
Destination Port:	28380
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 5.42.65.96 - Destination IP: 192.168.2.6

Timestamp:	05/03/24-13:40:59.478662
SID:	2046056
Source Port:	28380
Destination Port:	49699
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.6 - Destination IP: 5.42.65.96

Timestamp:	05/03/24-13:41:06.269199
SID:	2043231
Source Port:	49699
Destination Port:	28380
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "5.42.65.96:28380", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 24%

Perma Link

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008C8EA6 FindFirstFileExW,

0_2_008C8EA6

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.6:49699 -> 5.42.65.96:28380
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.6:49699 -> 5.42.65.96:28380
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 5.42.65.96:28380 -> 192.168.2.6:49699
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 5.42.65.96:28380 -> 192.168.2.6:49699

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 5.42.65.96:28380

Source: global traffic

TCP traffic: 192.168.2.6:49699 -> 5.42.65.96:28380

Source: Joe Sandbox View

IP Address: 5.42.65.96 5.42.65.96

Source: Joe Sandbox View

ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU

Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.96

Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003461000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: RegAsm.exe, 00000001.00000002.2198042480.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: RegAsm.exe, 00000001.00000002.2198042480.000000000323A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: RegAsm.exe, 00000001.00000002.2198042480.000000000323A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003461000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.00000000033C9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16V
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: RegAsm.exe, 00000001.00000002.2198042480.00000000034D1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: RegAsm.exe, 00000001.00000002.2198042480.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.000000000344F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003432000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003432000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: RegAsm.exe, 00000001.00000002.2198042480.0000000003432000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: file.exe, file.exe, 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.2196742233.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip

Source: file.exe, 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: RegisterRawInputDevices

memstr_81dae805-f

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpDC13.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpDC02.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008CB50B	0_2_008CB50B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008CCD70	0_2_008CCD70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BEEE0	0_2_008BEEE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C3653	0_2_008C3653
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BBE6D	0_2_008BBE6D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C3F3F	0_2_008C3F3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_011EDC74	1_2_011EDC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_067A67D8	1_2_067A67D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_067AA3E8	1_2_067AA3E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_067AA3D8	1_2_067AA3D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_067A6FF8	1_2_067A6FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_067A6FE8	1_2_067A6FE8

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 008B6A00 appears 49 times

Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStoutest.exe8 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .Left ZLIB complexity 0.9980692512274959

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/5@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Mutant created: NULL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\TmpDC02.tmp

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

Virustotal: Detection: 24%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.1.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: section name: .DAX
Source: file.exe	Static PE information: section name: .Left
Source: file.exe	Static PE information: section name: .INV

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B6158 push ecx; ret	0_2_008B616B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D5F3D push esi; ret	0_2_008D5F46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_011E01A5 push esp; ret	1_2_011E01B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_067AE060 push es; ret	1_2_067AE070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_067AECF2 push eax; ret	1_2_067AED01

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 11E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2F90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2D90000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 2363			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 6099			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 5.4 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2588	Thread sleep time: -26747778906878833s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2616	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008C8EA6 FindFirstFileExW,

0_2_008C8EA6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: RegAsm.exe, 00000001.00000002.2198042480.00000000035A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJm6+yF+1A6ySN83i+WdwHy5TP6AGa54yNOQDMt0K/OHXfg+kqThLIfk6QFsLDCjZdpZTGOzjUsCOwZe5C6Gi8Q8TVSedBLpSfsvQj8BDp18kmZ3ex54YP0+Gs0yuOc0oHyahpuklKSN9DNVuBZhWH/uMHS1PAuQ5a2Lju9F/SWeKm7prBc0jVP84iPJxdnHVJ/HDDDbXL54Z89qdU0Vcin6gqmwXrJjGgP4IA8IR19qewIwTnUCQdrTZp1GW0u9j1R6sUgPUrm2c5cvXl9oot3E2Yi+lA6TVxs+wzTv0RyoJlnAb/LVyrQ+JXXkt08JQiqZojt7zmAq6A6TMAI3d99XjZOb1H2Ej05cPkbrRi3jsQ/1cA/+FiEaSdYURoSjyCbui7SR58sFKCEAn3HKH4uwm3eDW6eeqSVnn3vRu5S+ZPUrZgKYs8lgl1/fYieGCfbdnVWn1in27qZ19Yfhv4WKpf3SAPgywfR4sYK3wdc8VGoHmK3TWFL5jmOUHB49Ogy2jYoedRvh3h9D96fGhUBv0WbVKW3Fxq4ViXVL2x9NKNgA+vC8A5zUncE8H2TafulfEOSRqFccYu86ht5uc0nLgpiCrzoulmnAYZLfk4zbvX51WQrYMsc8ORmzRWmqqLFXZVINxxVKaxrpheUhYRfRx54cZnzZZxdMOYT0VhpWbZdIcVFHnb3QBFJEgxwyQpCTte0yQjzn7uCUZsuA+iYIJO4a+Hmq+9ONtmOcMMYl7TbktlwpTMf366yxqm+uPbWY4C
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: RegAsm.exe, 00000001.00000002.2207111392.000000000574E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: RegAsm.exe, 00000001.00000002.2200150085.0000000004275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008B67DD IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_008B67DD

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008CA021 mov eax, dword ptr fs:[00000030h]		0_2_008CA021
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C010F mov ecx, dword ptr fs:[00000030h]		0_2_008C010F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008CC620 GetProcessHeap,

0_2_008CC620

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B6939 SetUnhandledExceptionFilter,	0_2_008B6939
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B6A4A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_008B6A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B67DD IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_008B67DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BA713 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_008BA713

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: CFE008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008B64BC cpuid

0_2_008B64BC

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_008CC0C0
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_008C5022
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_008CC1E9
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_008CC2EF
Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_008CBA5A
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_008CC3BE
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_008CBCFC
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_008CBDE2
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_008C5548
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_008CBD47
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_008CBE6D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008B66D0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_008B66D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.8df028.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.8df028.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2196742233.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 712, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000001.00000002.2198042480.000000000323A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\walletsLR
Source: RegAsm.exe, 00000001.00000002.2198042480.000000000323A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q4C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: RegAsm.exe, 00000001.00000002.2198042480.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: RegAsm.exe, 00000001.00000002.2198042480.000000000323A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR
Source: RegAsm.exe, 00000001.00000002.2198042480.000000000323A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR
Source: RegAsm.exe, 00000001.00000002.2198042480.000000000323A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR
Source: RegAsm.exe, 00000001.00000002.2198042480.000000000323A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: qdC:\Users\user\AppData\Roaming\Binance
Source: RegAsm.exe, 00000001.00000002.2198042480.000000000323A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR
Source: RegAsm.exe, 00000001.00000002.2198042480.000000000323A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q&%localappdata%\Coinomi\Coinomi\walletsLR
Source: RegAsm.exe, 00000001.00000002.2198042480.000000000323A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q8C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2198042480.000000000323A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 712, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.8df028.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.8df028.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2196742233.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 712, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	11 Input Capture	241 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	3 Data from Local System	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Install Root Certificate	DCSync	134 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	24%	Virustotal		Browse
file.exe	100%	Avira	HEUR/AGEN.1314931
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21Response	4%	Virustotal		Browse
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id12Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/	2%	Virustotal		Browse
http://tempuri.org/Entity/Id14ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	1%	Virustotal		Browse
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	1%	Virustotal		Browse
http://tempuri.org/Entity/Id8	1%	Virustotal		Browse
http://tempuri.org/Entity/Id19Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id6	1%	Virustotal		Browse
http://tempuri.org/Entity/Id13ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	1%	Virustotal		Browse
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	1%	Virustotal		Browse
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	1%	Virustotal		Browse
http://tempuri.org/Entity/Id22	1%	Virustotal		Browse
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	1%	Virustotal		Browse
http://tempuri.org/Entity/Id24Response	1%	Virustotal		Browse
http://tempuri.org/Entity/Id5ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id21ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id24	1%	Virustotal		Browse
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	1%	Virustotal		Browse
http://tempuri.org/Entity/Id11	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	1%	Virustotal		Browse
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	1%	Virustotal		Browse
http://tempuri.org/Entity/Id14	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15	1%	Virustotal		Browse
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	1%	Virustotal		Browse
http://tempuri.org/Entity/Id16Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id17	1%	Virustotal		Browse
http://tempuri.org/Entity/Id19	1%	Virustotal		Browse
http://tempuri.org/Entity/Id11ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8ResponseD	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id14ResponseD	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	RegAsm.exe, 00000001.00000002.2198042480.0000000003432000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.000000000344F000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13ResponseD	RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	file.exe, file.exe, 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.2196742233.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1ResponseD	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1Response	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21ResponseD	RegAsm.exe, 00000001.00000002.2198042480.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	RegAsm.exe, 00000001.00000002.2198042480.0000000003461000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15ResponseD	RegAsm.exe, 00000001.00000002.2198042480.000000000323A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id11ResponseD	RegAsm.exe, 00000001.00000002.2198042480.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	RegAsm.exe, 00000001.00000002.2198042480.0000000003432000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17ResponseD	RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	RegAsm.exe, 00000001.00000002.2198042480.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8ResponseD	RegAsm.exe, 00000001.00000002.2198042480.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	RegAsm.exe, 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.42.65.96	unknown	Russian Federation		39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1435951
Start date and time:	2024-05-03 13:40:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 84 Number of non-executed functions: 45
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:40:59	API Interceptor	45x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
5.42.65.96	file.exe	Get hash	malicious	RedLine	Browse
	tZvjMg3Hw9.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	WlCIinu0yp.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, Socks5Systemz, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC, GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.96
	tZvjMg3Hw9.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	5.42.66.10
	[V2]launcher.exe	Get hash	malicious	PureLog Stealer, RedLine, Xmrig	Browse	45.15.156.167
	SecuriteInfo.com.Trojan.PWS.Siggen3.32416.6905.9348.exe	Get hash	malicious	RedLine	Browse	5.42.65.101
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.96
	VOrqSh1Fts.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse	5.42.66.10
	WlCIinu0yp.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, Socks5Systemz, Vidar, zgRAT	Browse	5.42.66.10
	file.exe	Get hash	malicious	LummaC, GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse	5.42.65.64
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.96
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	5.42.65.64

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 05:47:14 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.468213012568913
Encrypted:	false
SSDEEP:	48:8S3d5TvG90lRYrnvPdAKRkdAGdAKRFdAKR6P:8S7by7
MD5:	5D3CC3EBC2FE9A3127EBC33DAB8AC98C
SHA1:	8E57592446EC44174EA522C0251A96A16682EEF9
SHA-256:	FE110C1E2FC5A6487EEDD697FF91357D1AFB17E1EE27E2E372180E09D6ED0CD8
SHA-512:	CE7D0680EB84951151AF185C924CE662FC95251F3DF63C52743483CDB138DF2D0C8FFE00207D9CB8AB7B6E7C8022B31F3FDB781E3C7DF1911829303D5FDD1C97
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,.....R<.W....X.&&... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.IEW.5....B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEW@2....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.2..Chrome..>......CW.VEW.2....M.....................7...C.h.r.o.m.e.....`.1.....EW.2..APPLIC~1..H......CW.VEW.2..........................7...A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.L .chrome.exe..F......CW.VEW.5.........................l...c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlq0
MD5:	0C1110E9B7BBBCB651A0B7568D796468
SHA1:	7AEE00407EE27655FFF0ADFBC96CF7FAD9610AAA
SHA-256:	112E21404A85963FB5DF8388F97429D6A46E9D4663435CC86267C563C0951FA2
SHA-512:	46E37552764B4E61006AB99F8C542D55B2418668B097D3C6647D306604C3D7CA3FAF34F8B4121D94B0E7168295B2ABEB7C21C3B96F37208943537B887BC81590
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\TmpDC02.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpDC13.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.236561860707032
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	558'592 bytes
MD5:	702021300aed8dfde070019d752b020d
SHA1:	45f152925534102013fbe5c17805ca938499256d
SHA256:	e75a30472c88c4a2d875b19a60c704d773de97c025a87e5e813b02cbaccb4678
SHA512:	34cf3a888f35bee61a72ca5bb418a8676ff66d3be44af31d709548b9ba8ba0c8fed84a6c44baab74965a72d3b60e5d74d178589614a06a24bbf966b2ffa7ccc0
SSDEEP:	12288:a/kIWN053iBXmiHvxIsFCmelWpqKoQ/P6znImCruFPyeJegy91Ho:aMIb3mHpzeqqdQ/P6MJepa1
TLSH:	87C4F11279C18172D57324360AF1DBB85E3EBD700E61AD9FA3D40FBF4B342919A24A97
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(tY.F'Y.F'Y.F'..E&U.F'..C&..F'..B&L.F'..B&K.F'..E&M.F'..G&\.F'Y.G'..F'..C&..F'..C&X.F'..D&X.F'RichY.F'................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x406102
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6634C399 [Fri May 3 10:59:37 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f23588e58d9b5c75df2f16b529527a2e

Entrypoint Preview

Instruction
call 00007F8A9945BFCBh
jmp 00007F8A9945B829h
push ebp
mov ebp, esp
jmp 00007F8A9945B9BFh
push dword ptr [ebp+08h]
call 00007F8A994672A1h
pop ecx
test eax, eax
je 00007F8A9945B9C1h
push dword ptr [ebp+08h]
call 00007F8A99462609h
pop ecx
test eax, eax
je 00007F8A9945B998h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007F8A99458698h
jmp 00007F8A994597A9h
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F8A9945C2B3h
pop ecx
pop ebp
ret
cmp ecx, dword ptr [0042D040h]
jne 00007F8A9945B9B3h
ret
jmp 00007F8A9945C2CFh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F8A9945B989h
jmp 00007F8A9945B992h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0042D040h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0042D040h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7e000	0xdae	.INV
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7c000	0x1a6c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2aba8	0x1c	.DAX
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2aae8	0x40	.DAX
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x13c	.DAX
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x211ef	0x21200	74721851a7749ef6e44e879029958779	False	0.5832768278301886	data	6.644360937306272	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.DAX	0x23000	0x9cf6	0x9e00	99d6bc4bea04511f397ebd520b8df780	False	0.4341871044303797	data	4.953927952055476	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x1d54	0x1000	96f6fc94400f9b3c80d126cafa6f2df3	False	0.190673828125	data	3.018020491461944	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.Left	0x2f000	0x4c4d4	0x4c600	3847e3ea5f4cd2f26084e74d800339bb	False	0.9980692512274959	data	7.999114778984702	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x7c000	0x1a6c	0x1c00	6f40397f4829021ef609cc1670e7efd9	False	0.7197265625	data	6.348967303435409	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.INV	0x7e000	0xdae	0xde00	1c77006257b50536491ca5c7a4b57571	False	0.029402449324324325	data	0.5553493164852099	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
USER32.DLL	OpenIcon, RegisterRawInputDevices, OemToCharBuffW, TranslateAccelerator, EvaluateProximityToRect, DrawTextA, DrawStateA, IsCharAlphaNumericW, RegisterClipboardFormatA, LoadKeyboardLayoutA, EnumDisplaySettingsW, DdeCreateStringHandleA, OemToCharA, SendMessageTimeoutW, GetIconInfoExW, InvertRect, GetSystemMenu, FreeDDElParam, SetCursor, GetWindowContextHelpId, PrintWindow, DwmGetDxSharedSurface, ReleaseDwmHitTestWaiters, OpenWindowStationW, DwmGetRemoteSessionOcclusionEvent, GetParent, TrackPopupMenuEx, _UserTestTokenForInteractive, DdeQueryStringW, ScrollChildren
KERNEL32.DLL	LoadLibraryExW, CreateFileW, VirtualProtect, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetModuleHandleW, GetCurrentProcess, TerminateProcess, HeapSize, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, WriteConsoleW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, GetFileType, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetProcessHeap, ReadConsoleW
MSVCRT.DLL	_mbsupr_s, _set_errno, _wtoi64, _mbsnextc_l, _islower_l, _wutime64, _vfwprintf_l, __pwctype_func, _mktemp, _popen, __CxxCallUnwindDtor, _fwscanf_s_l, _gcvt, _sprintf_l, _cwscanf_l, _wcstoul_l, _wtempnam_dbg, _vcprintf, __ExceptionPtrCopy, _swprintf_s_l, _get_environ, _mbscpy, _fprintf_s_l, _wspawnvpe, exit

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/03/24-13:40:54.255282	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	28380	49699	5.42.65.96	192.168.2.6
05/03/24-13:40:54.078459	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49699	28380	192.168.2.6	5.42.65.96
05/03/24-13:40:59.478662	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	28380	49699	5.42.65.96	192.168.2.6
05/03/24-13:41:06.269199	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49699	28380	192.168.2.6	5.42.65.96

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 3, 2024 13:40:53.676842928 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:40:53.850569963 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:40:53.850658894 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:40:53.862823963 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:40:54.036683083 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:40:54.078459024 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:40:54.255281925 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:40:54.299222946 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:40:59.303356886 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:40:59.478662014 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:40:59.478678942 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:40:59.478693962 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:40:59.478708029 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:40:59.478724003 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:40:59.478806019 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:40:59.533607006 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:40:59.592117071 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:40:59.767750025 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:40:59.776021004 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:40:59.949605942 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:40:59.949851036 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:40:59.949970007 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:40:59.951816082 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:00.002362013 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:00.535037994 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:00.709830046 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:00.752372026 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:01.220105886 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:01.393780947 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:01.439837933 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:02.106873035 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:02.282646894 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:02.284765959 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:02.458890915 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:02.502377987 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:02.529186010 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:02.702419043 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:02.702456951 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:02.702469110 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:02.702646971 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:02.703469992 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:02.719048023 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:02.892894983 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:02.939872026 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:02.968991041 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:03.144088984 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:03.171344042 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:03.346113920 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:03.349737883 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:03.523808002 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:03.564846992 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:03.698149920 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:03.872234106 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:03.924384117 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:03.948499918 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.121787071 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.121851921 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.122009993 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.122068882 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.122091055 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.122140884 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.122299910 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.122378111 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.122450113 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.122518063 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.122679949 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.122730970 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.297333002 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.297444105 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.297518015 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.297719955 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.297734022 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.297792912 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.297877073 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.297977924 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.298012018 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.298280001 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.298511982 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.298655987 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.298829079 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.298829079 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.298943996 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.298957109 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.299021006 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.299202919 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.299285889 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.299412012 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.299438953 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.299829960 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.299880028 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.300057888 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.300283909 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.300430059 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.300693989 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.300743103 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.300915003 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.301068068 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.471226931 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.471447945 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.471565962 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.471877098 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.472136974 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.472368002 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.472459078 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.472628117 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.472904921 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.473196030 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.473402977 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.473601103 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.474715948 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.474947929 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.475197077 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.475835085 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.476452112 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.476530075 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.476890087 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.477217913 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.477269888 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.477642059 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.478085041 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.478147030 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.478188992 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.478698969 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.480144024 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.480619907 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.480894089 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.480956078 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.645869970 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.645883083 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.646096945 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.646132946 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.646378994 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.646605015 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.646799088 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.647044897 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.647186041 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.647310972 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.647753000 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.647818089 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.648144960 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.648183107 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.648569107 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.648751020 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.649086952 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.654109955 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.654313087 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.654350042 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.654433012 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.654690981 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.654846907 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.655015945 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.655366898 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.655437946 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.655467033 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.655879021 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.656182051 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.656604052 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.657085896 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.657100916 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.657490969 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.657783031 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.658085108 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.658389091 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.658581018 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.658639908 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.827863932 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.827912092 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.828145027 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.828213930 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.828320026 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.828764915 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.828875065 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.829343081 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.829394102 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.829798937 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.829812050 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.829895020 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.830108881 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.830316067 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.830444098 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.830840111 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.830858946 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.831041098 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.832247019 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.832386017 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.832458973 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.832470894 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.832482100 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.832484961 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.832565069 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.832731009 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.832812071 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.833122015 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.833525896 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.833647966 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.833703995 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.833914995 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.834041119 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.834213018 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.834479094 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.834816933 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.834876060 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:04.835048914 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:04.835112095 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:05.006036043 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.006438017 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.006702900 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.006769896 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.006829977 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.006916046 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.007128000 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.007299900 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.007741928 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.007870913 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.008233070 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.008543015 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.008869886 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.008960009 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.009412050 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.009772062 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.009876013 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.010013103 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.010057926 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:05.010152102 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:05.010238886 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.010377884 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.010636091 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.010996103 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.011096001 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.011447906 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.011627913 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.011888981 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.011945009 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.012326956 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.012523890 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.012924910 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.013035059 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.013518095 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.013669014 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:05.183653116 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.183707952 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.184000015 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.184192896 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.184407949 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.184751987 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.184856892 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.185256958 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.185534954 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.185692072 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.185914993 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.186001062 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.186343908 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.186680079 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.186815977 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.187313080 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.187429905 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.187529087 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.187716007 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.187876940 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.188229084 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.188402891 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.188601017 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.189042091 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.189086914 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.189282894 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.189467907 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.189640999 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.189769983 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.190284967 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.191613913 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.198142052 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:05.371896029 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.378849983 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:05.552824020 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.554728985 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:05.728843927 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.733381987 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:05.907135010 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:05.909033060 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:06.083153963 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:06.092482090 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:06.268219948 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:06.269198895 CEST	49699	28380	192.168.2.6	5.42.65.96
May 3, 2024 13:41:06.448920012 CEST	28380	49699	5.42.65.96	192.168.2.6
May 3, 2024 13:41:06.488807917 CEST	49699	28380	192.168.2.6	5.42.65.96

Target ID:	0
Start time:	13:40:52
Start date:	03/05/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x8b0000
File size:	558'592 bytes
MD5 hash:	702021300AED8DFDE070019D752B020D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:40:52
Start date:	03/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xa80000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000001.00000002.2196742233.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000001.00000002.2198042480.0000000003038000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2198042480.000000000323A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.3%
Total number of Nodes:	1378
Total number of Limit Nodes:	28

Executed Functions

Function 008CA021 Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9395896353acccf952a291b6f0163853f95de6a84289665eef3950dd9f5b70ca
Instruction ID: 94e8610925ebdf19c7d74490912a19384d8011454e34e9f553386fe2d68c9026
Opcode Fuzzy Hash: 9395896353acccf952a291b6f0163853f95de6a84289665eef3950dd9f5b70ca
Instruction Fuzzy Hash: 01E04632911668EBCB18DB9C8944E8AB2BCFB45B84B11449EB501E3200C274DE00C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 008C010F Relevance: .0, Instructions: 12
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60db8ef128b66eb642bb16a09a4d214568f9693845bcad6d0eb7c0ed8f4044be
Instruction ID: 1f66ecd61bb7424158fcfd3bcaffd768291cebeee06c30d3a5e0472bedf9736d
Opcode Fuzzy Hash: 60db8ef128b66eb642bb16a09a4d214568f9693845bcad6d0eb7c0ed8f4044be
Instruction Fuzzy Hash: 68C08C38000A00CACE3989149671BA473F6F3917C2F88248DC4028B642D53EDCC2DB02

Uniqueness

Uniqueness Score: -1.00%

Function 008C51EB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,E64169D8,?,008C52F8,?,?,00000000,00000000), ref: 008C52AC

Strings

ext-ms-, xrefs: 008C5256
api-ms-, xrefs: 008C5242

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 1d63fa68fe5458f7f103f57f44a95368931515b8c8ce6ffb73a6eb5ea52ccee8
Instruction ID: b24ec8e1b4504843bb8be8d143debb86e3099b526ad8c6e7f40d51f787ea2ec5
Opcode Fuzzy Hash: 1d63fa68fe5458f7f103f57f44a95368931515b8c8ce6ffb73a6eb5ea52ccee8
Instruction Fuzzy Hash: E2218172A02A15ABDF319B659C44F5A37B8FF41760F240229E956EB390D730FD4196E0

Uniqueness

Uniqueness Score: -1.00%

Function 008C009B Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,008C0095,00000000,008BA712,?,?,E64169D8,008BA712,?), ref: 008C00AC
TerminateProcess.KERNEL32(00000000,?,008C0095,00000000,008BA712,?,?,E64169D8,008BA712,?), ref: 008C00B3
ExitProcess.KERNEL32 ref: 008C00C5

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: eef2d279e3eee8f64be0ed06ae96068415d260ef5067c349d4a7e7399369ad71
Instruction ID: 1b421326a3c0e51acd4976f8ebac8ee5fd0b40305e0533d68c32d8ee1de467b4
Opcode Fuzzy Hash: eef2d279e3eee8f64be0ed06ae96068415d260ef5067c349d4a7e7399369ad71
Instruction Fuzzy Hash: 22D06C35014608ABCB216F64EC4EA9D7F2AFA44792B194019B9098A122DB72D992EE81

Uniqueness

Uniqueness Score: -1.00%

Function 008C52B6 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87a331ce20a0dd34887542b63515b3cae326bab8030cb13bc93762e10ef929bc
Instruction ID: 2a77c4dc9c28fef3d97938c2769baf070181cf3cc9cd67167572fc35331e3a91
Opcode Fuzzy Hash: 87a331ce20a0dd34887542b63515b3cae326bab8030cb13bc93762e10ef929bc
Instruction Fuzzy Hash: BD01F533211A155B9F128E7DEC44F9A33E6FBC6360B14822AF904DB295DA70E9828690

Uniqueness

Uniqueness Score: -1.00%

Function 008B3D0A Relevance: 1.5, APIs: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(0092B028,000004AC,00000040,00000000), ref: 008B3D26

Part of subcall function 008B3062: OpenIcon.USER32(00000000), ref: 008B307C

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: IconOpenProtectVirtual
String ID:
API String ID: 1301268471-0
Opcode ID: 83e3c5ec1d9013b42b441ff9419ee9a61243361edb872896eb5c4658d2afaf43
Instruction ID: 194abb1c616fcd81af8f9d0d853d44ab0c68b070617ba9ba05810c44475466ff
Opcode Fuzzy Hash: 83e3c5ec1d9013b42b441ff9419ee9a61243361edb872896eb5c4658d2afaf43
Instruction Fuzzy Hash: BCE0D86395562077D721A2559C06ECF27ECDFC2721F108035F600E6245DA399F0A83F9

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 008CCD70 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 008CCF54

Strings

1#INF, xrefs: 008CCEA6
1#SNAN, xrefs: 008CCE7C
1#IND, xrefs: 008CCE75
1#QNAN, xrefs: 008CCE83

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: a94b5b2bc06b0a6076017c7f0c3c7102b3eae4d636c526e6ae864a5ca3a77082
Instruction ID: d740f947d2d024ca12b984728e950e90bdc8ed2ed95356c6e32ddea677578a9e
Opcode Fuzzy Hash: a94b5b2bc06b0a6076017c7f0c3c7102b3eae4d636c526e6ae864a5ca3a77082
Instruction Fuzzy Hash: 57D2F671E086288BDB65DE28DD40BEAB7B5FB44305F1445EED40EE7240EB78AE858F41

Uniqueness

Uniqueness Score: -1.00%

Function 008CC1E9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,008CC507,00000002,00000000,?,?,?,008CC507,?,00000000), ref: 008CC282
GetLocaleInfoW.KERNEL32(?,20001004,008CC507,00000002,00000000,?,?,?,008CC507,?,00000000), ref: 008CC2AB
GetACP.KERNEL32(?,?,008CC507,?,00000000), ref: 008CC2C0

Strings

OCP, xrefs: 008CC23D
ACP, xrefs: 008CC207

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 7a3a2c3738f9f56bc3c9dda11d6ca9d2afbf743b7d822d83a1b4a6223e6a959c
Instruction ID: 87eac695e912a2c74883cb14809f67c7b7432296c0092d8cd264b7f3d9af915f
Opcode Fuzzy Hash: 7a3a2c3738f9f56bc3c9dda11d6ca9d2afbf743b7d822d83a1b4a6223e6a959c
Instruction Fuzzy Hash: 0821AC32A04204AAEB309FE4C901F9773BAFB54F65B5A856CE90ED7200E732DE41D360

Uniqueness

Uniqueness Score: -1.00%

Function 008CC3BE Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008C2A40: GetLastError.KERNEL32(?,00000008,008C879F,00000000,008BA890), ref: 008C2A44
Part of subcall function 008C2A40: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 008C2AE6

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 008CC4CA
IsValidCodePage.KERNEL32(00000000), ref: 008CC513
IsValidLocale.KERNEL32(?,00000001), ref: 008CC522
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 008CC56A
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 008CC589

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 0ed17a4620f44a385acfccc6fb5333c44dbb44fa9dbf64a96e8fde55a14dc8e8
Instruction ID: 2e09c16d10fdb992aa056d904b25c36380586332001640109ed2a7c793b95c84
Opcode Fuzzy Hash: 0ed17a4620f44a385acfccc6fb5333c44dbb44fa9dbf64a96e8fde55a14dc8e8
Instruction Fuzzy Hash: 25517D71A00209ABDB24EFA9CC51FBA77B8FF08700F18846DF919E7190EB70D9018B65

Uniqueness

Uniqueness Score: -1.00%

Function 008CBA5A Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008C2A40: GetLastError.KERNEL32(?,00000008,008C879F,00000000,008BA890), ref: 008C2A44
Part of subcall function 008C2A40: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 008C2AE6

GetACP.KERNEL32(?,?,?,?,?,?,008C0A4E,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 008CBB1B
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,008C0A4E,?,?,?,00000055,?,-00000050,?,?), ref: 008CBB46
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 008CBCA9

Strings

utf8, xrefs: 008CBC18

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 49bd243f6d22f02556ac7f6504e36942d7179dad2a6341e2fe3ac6c95f09142d
Instruction ID: 343be7dbca2a67a8fdd119ea040f13fe417815ab32a38be11c5347adb313f48e
Opcode Fuzzy Hash: 49bd243f6d22f02556ac7f6504e36942d7179dad2a6341e2fe3ac6c95f09142d
Instruction Fuzzy Hash: AA71E131640A06AADB28AB79CC87FBA77B8FF44310F14402EF956D7181EB74ED419662

Uniqueness

Uniqueness Score: -1.00%

Function 008C3F3F Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 008C3FCC

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 957b6a68e01d3e16632ce3fb5a3ba364fe60901d2c6598131793219a536d9919
Instruction ID: b297a5886117734b03756f3a87f2981dbac660330ca72768e4e736e0a6f358a5
Opcode Fuzzy Hash: 957b6a68e01d3e16632ce3fb5a3ba364fe60901d2c6598131793219a536d9919
Instruction Fuzzy Hash: F8B143329042459FDB158F68C8A2FEEBBB5FF55300F18916EE944EB241C235DD81CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 008B67DD Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 008B67E9
IsDebuggerPresent.KERNEL32 ref: 008B68B5
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 008B68CE
UnhandledExceptionFilter.KERNEL32(?), ref: 008B68D8

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 56f368164ea70d2564048cd1faca0dc64695380fecc84ede307772ede9a03a3e
Instruction ID: 4c2e2406623fe82e179de8e1f12fe46320d425ddee2a73b5e7038198e2ab39f8
Opcode Fuzzy Hash: 56f368164ea70d2564048cd1faca0dc64695380fecc84ede307772ede9a03a3e
Instruction Fuzzy Hash: C931F775D05229DBDB20DFA4D9897CDBBB8FF08300F1041AAE40DAB250EB749A859F45

Uniqueness

Uniqueness Score: -1.00%

Function 008CBE6D Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 008C2A40: GetLastError.KERNEL32(?,00000008,008C879F,00000000,008BA890), ref: 008C2A44
Part of subcall function 008C2A40: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 008C2AE6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008CBEC1
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008CBF0B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008CBFD1

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: f9a2c407a9363f89a230b86434605354c51e191757b7213f19ac5d1b554f33ac
Instruction ID: 0fdbf50b787e51743e6c6a51ae7b6d18b23559866a1c1a7cd706b93d9a68cf08
Opcode Fuzzy Hash: f9a2c407a9363f89a230b86434605354c51e191757b7213f19ac5d1b554f33ac
Instruction Fuzzy Hash: 7D617B71910A17DBEB289F28CD82FBAB7B8FF04300F10816DE909C6285EB74D981DB51

Uniqueness

Uniqueness Score: -1.00%

Function 008BA713 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 008BA80B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 008BA815
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 008BA822

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 26ec6bc2c7cda8c8971316f45015e46cc516a36341575b6983336708ffb80d92
Instruction ID: d3bf0ac8d445b0da94e1bb09e89ee6f1086d838c623f4e85955d8ad766dd7ba7
Opcode Fuzzy Hash: 26ec6bc2c7cda8c8971316f45015e46cc516a36341575b6983336708ffb80d92
Instruction Fuzzy Hash: 0631C1749512299BCB25DF28D889BC9BBB8FF08310F5041EAE41CA7290EB749F858F45

Uniqueness

Uniqueness Score: -1.00%

Function 008BEEE0 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf5c6875ad8b9aa219ef09fa5f3f671408767bcd021872790bb57096a96beff6
Instruction ID: 945d0106b9298cc208f2d1db8f40b880777812838edecad2a665f5ac887e32c3
Opcode Fuzzy Hash: cf5c6875ad8b9aa219ef09fa5f3f671408767bcd021872790bb57096a96beff6
Instruction Fuzzy Hash: 86F11D75E002199FDF14CFA9D8806EDBBB1FF88314F158269E929E7391D730AE458B90

Uniqueness

Uniqueness Score: -1.00%

Function 008C3653 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,008C364E,?,?,00000008,?,?,008D15F5,00000000), ref: 008C3880

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d50a42db6c28b897d5af579da26622a46983333baa31b68b0e82280e66183d4f
Instruction ID: 20186e53fcdca56ca1e4c6702deb45e6f2de6fe33e4b5b0334b03380db005094
Opcode Fuzzy Hash: d50a42db6c28b897d5af579da26622a46983333baa31b68b0e82280e66183d4f
Instruction Fuzzy Hash: 9AB1E7756106099FD719CF28C48AF657BB0FB45364F25C66CE89ACF2A1C335EA92CB40

Uniqueness

Uniqueness Score: -1.00%

Function 008B64BC Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 008B64D2

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: ff7ce12b7fc2fd5219276feaee041456088b56f08a2c85a0b465492d1ce89271
Instruction ID: eb958369d6952f16887c2f6888f43fd96056938e2921565139adc9087950d31a
Opcode Fuzzy Hash: ff7ce12b7fc2fd5219276feaee041456088b56f08a2c85a0b465492d1ce89271
Instruction Fuzzy Hash: 93516EB19026158FEB28CF68D8857AABBF5FB48310F14866BD405EB355E3789D50CF50

Uniqueness

Uniqueness Score: -1.00%

Function 008C8EA6 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a55bdaf88aa98df6612d863ef28438ab3c687193df26a393b2903fdb1f5018e5
Instruction ID: 19d216a4a5130533eb4f61fe2e92188fb8957951d5d31b5cb7823169af5ee2db
Opcode Fuzzy Hash: a55bdaf88aa98df6612d863ef28438ab3c687193df26a393b2903fdb1f5018e5
Instruction Fuzzy Hash: 0A41C1B5840219AEDF20DF69CC89FAABBB9FF45300F1442EDE419E3201DA319E848F10

Uniqueness

Uniqueness Score: -1.00%

Function 008BBE6D Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 008BBFFB

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8c498c1e6756398407336b0f663cbe07a97cab2f4434ada9889b2e5902105f6d
Instruction ID: f26f263bea4144ac7ca2f0bf3ec9a232abdfb414161aad042cde541e8ea8971c
Opcode Fuzzy Hash: 8c498c1e6756398407336b0f663cbe07a97cab2f4434ada9889b2e5902105f6d
Instruction Fuzzy Hash: 65C17D70600A4A8FCB24CF6CC890AFABBA1FF45314F144619D556EB7A2C7B1ED46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 008CC0C0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 008C2A40: GetLastError.KERNEL32(?,00000008,008C879F,00000000,008BA890), ref: 008C2A44
Part of subcall function 008C2A40: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 008C2AE6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008CC114

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 8a2a91db53b75d43899d3022592be69c96c5f93b9fddffd43d03928519198698
Instruction ID: 0d1043e90c2a5dc02e779fffe6c13b4f0b981c20b078ef5b0aeb11733fa2858e
Opcode Fuzzy Hash: 8a2a91db53b75d43899d3022592be69c96c5f93b9fddffd43d03928519198698
Instruction Fuzzy Hash: FC218E32611206ABDB289A2ADC42FBA77B8FF45314F14007EF90AD6142EB34ED458B51

Uniqueness

Uniqueness Score: -1.00%

Function 008CBD47 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008C2A40: GetLastError.KERNEL32(?,00000008,008C879F,00000000,008BA890), ref: 008C2A44
Part of subcall function 008C2A40: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 008C2AE6

EnumSystemLocalesW.KERNEL32(008CBE6D,00000001,00000000,?,-00000050,?,008CC49E,00000000,?,?,?,00000055,?), ref: 008CBDB9

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a2a0262931043775f449b2252c4a281a6f00f8cf70a1524daf332289e9338b5e
Instruction ID: 19dff60f946463abac367f3d2ded3ab0587d0ceaf948f7d1d64d75a07a1982df
Opcode Fuzzy Hash: a2a0262931043775f449b2252c4a281a6f00f8cf70a1524daf332289e9338b5e
Instruction Fuzzy Hash: 7611C636200B055FDB189F39C892ABAB7A1FB80759F14442CEA8787A40D771E942DB40

Uniqueness

Uniqueness Score: -1.00%

Function 008CC2EF Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 008C2A40: GetLastError.KERNEL32(?,00000008,008C879F,00000000,008BA890), ref: 008C2A44
Part of subcall function 008C2A40: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 008C2AE6

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,008CC089,00000000,00000000,?), ref: 008CC31B

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 544cb3be789793f512fcc331dc74e6178249f01467aa9e4e700758fca3bc3d0b
Instruction ID: d6365d8f55a26ea6aa3286501b8bb46589b280d33440b79f7ac25edbedb596b7
Opcode Fuzzy Hash: 544cb3be789793f512fcc331dc74e6178249f01467aa9e4e700758fca3bc3d0b
Instruction Fuzzy Hash: C6F0D632A10151ABDB289A349845FBA7778FB40764F08842CEC0AE3280EA30FD02C5D0

Uniqueness

Uniqueness Score: -1.00%

Function 008CBDE2 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008C2A40: GetLastError.KERNEL32(?,00000008,008C879F,00000000,008BA890), ref: 008C2A44
Part of subcall function 008C2A40: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 008C2AE6

EnumSystemLocalesW.KERNEL32(008CC0C0,00000001,?,?,-00000050,?,008CC462,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 008CBE2C

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e509d636ced3edae0b60ee3478a8db78f6d890ae5761ed453030487ae92db89b
Instruction ID: fd7932e240c14c3b7702c8537c5ccaccb3ed8a4c5e9fc1af95cd1c6ea1af5e12
Opcode Fuzzy Hash: e509d636ced3edae0b60ee3478a8db78f6d890ae5761ed453030487ae92db89b
Instruction Fuzzy Hash: 16F0C2362007045FDB249F799882FBA7BA5FB80768F05442CFA068B690D7B1DC02DA50

Uniqueness

Uniqueness Score: -1.00%

Function 008C5022 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008BCD04: EnterCriticalSection.KERNEL32(?,?,008C2718,?,008DC338,00000008,008C28DC,?,?,?), ref: 008BCD13

EnumSystemLocalesW.KERNEL32(008C5015,00000001,008DC3F8,0000000C,008C5444,00000000), ref: 008C505A

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 12ff2ec138f22485273b8f140f0a1963ce07cf522de54a6e1b4290e691cb4340
Instruction ID: c9d60ab83d05e32983eccefafa6503a0a4fe30842fd486dfff86a9bcdf7675ee
Opcode Fuzzy Hash: 12ff2ec138f22485273b8f140f0a1963ce07cf522de54a6e1b4290e691cb4340
Instruction Fuzzy Hash: 54F03732A60604DFDB00EF98E842B9D77B0FB48721F00862AF410EB3A1DB799940DF81

Uniqueness

Uniqueness Score: -1.00%

Function 008CBCFC Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008C2A40: GetLastError.KERNEL32(?,00000008,008C879F,00000000,008BA890), ref: 008C2A44
Part of subcall function 008C2A40: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 008C2AE6

EnumSystemLocalesW.KERNEL32(008CBC55,00000001,?,?,?,008CC4C0,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 008CBD33

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e71f5785e949d37c7466eb220411fad1c370ecda7cc81220ad96ab9fca06466e
Instruction ID: 9f88b00a447582f6a095816eb54ea83935c76381ae5b87b0fb2d105de4ac18b6
Opcode Fuzzy Hash: e71f5785e949d37c7466eb220411fad1c370ecda7cc81220ad96ab9fca06466e
Instruction Fuzzy Hash: 47F0E53630020557CB149F79D846B6A7FA4FFC1720F06406CFA0ACB291CB75D942DB90

Uniqueness

Uniqueness Score: -1.00%

Function 008C5548 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,008C15B4,?,20001004,00000000,00000002,?,?,008C0BB6), ref: 008C557C

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 672eb90673c1f419dcf04331c154bae8c7305faacada697138fa6f03d997777a
Instruction ID: c9d59928fb42c35fe86a0300b0d81319a965bcdf9a0c3bf5a58be458713a1d25
Opcode Fuzzy Hash: 672eb90673c1f419dcf04331c154bae8c7305faacada697138fa6f03d997777a
Instruction Fuzzy Hash: E2E04F31501918BBCF122F64DC08FAE7F26FF44B60F148119FC05A6121CB72EE61AA96

Uniqueness

Uniqueness Score: -1.00%

Function 008B6939 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00006945,008B5F70), ref: 008B693E

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 74d09ceb91de3629445a21df3ff40a6496b574e0b7e9f4471efbc9b314d83bb1
Instruction ID: 44ea7fafb280caf00457cc6e441a81991008c3a07bc608393f8607174031c443
Opcode Fuzzy Hash: 74d09ceb91de3629445a21df3ff40a6496b574e0b7e9f4471efbc9b314d83bb1
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 008CC620 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 008CC620

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 22cc79b67939fce3e2f2f26fb99e2edd6b248d6c7688ab4f8caa13863b313c58
Instruction ID: b5ed8061b4e323dd3e8048e6f40672785e7ead888a01934b33c9496f9aceb47a
Opcode Fuzzy Hash: 22cc79b67939fce3e2f2f26fb99e2edd6b248d6c7688ab4f8caa13863b313c58
Instruction Fuzzy Hash: 5BA02430103101CF4300CF35DF0430C37D575051C130050155400C5130DF3CC000D701

Uniqueness

Uniqueness Score: -1.00%

Function 008CB50B Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: a905187c0504c9e3f9ab25e459e8e9c0f2f12f850d2bec538fa63973eb08cb89
Instruction ID: ce7ca9e03b440cb8e07a04d365578baed9ac97f4bf55befe8a27e0a3799e50a1
Opcode Fuzzy Hash: a905187c0504c9e3f9ab25e459e8e9c0f2f12f850d2bec538fa63973eb08cb89
Instruction Fuzzy Hash: B7B1C135600B059BDB389A29C893FB7B3B8FF94308F14452DE986C6580EB75E9858B11

Uniqueness

Uniqueness Score: -1.00%

Function 008D1093 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,008D09FF), ref: 008D10AC

Strings

log10, xrefs: 008D10EE, 008D10FD
exp, xrefs: 008D112B, 008D1190
pow, xrefs: 008D114A, 008D11F4, 008D1241
log, xrefs: 008D1109, 008D1118
acos, xrefs: 008D11E2
asin, xrefs: 008D11D9
sqrt, xrefs: 008D11EB

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: cd40ed23385079ae9d58d73b4b625125ba6d8252e2bb7338d2b0e675d729eabd
Instruction ID: f207508f2932efabf8f3b0d4f90f8de686ea84d397ca97018a893b0109658614
Opcode Fuzzy Hash: cd40ed23385079ae9d58d73b4b625125ba6d8252e2bb7338d2b0e675d729eabd
Instruction Fuzzy Hash: E451667190460EEBCF109FA8E84C1AEBFB4FF05314F104357E691EA365DB718A298B55

Uniqueness

Uniqueness Score: -1.00%

Function 008B9628 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 008B9747
___TypeMatch.LIBVCRUNTIME ref: 008B9855
_UnwindNestedFrames.LIBCMT ref: 008B99A7
CallUnexpected.LIBVCRUNTIME ref: 008B99C2

Strings

csm, xrefs: 008B96D2
csm, xrefs: 008B977E
csm, xrefs: 008B9665

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 0bd95e4958e8e4942759e8076f8e1a1944999f41401777ef88664250ca48f448
Instruction ID: 898d08baa881cdfee998c7c7033a82b38dd6ea3d609a484e7748dc1cde8ae8a8
Opcode Fuzzy Hash: 0bd95e4958e8e4942759e8076f8e1a1944999f41401777ef88664250ca48f448
Instruction Fuzzy Hash: BEB16871800209EFCF25DFA8C8819EEBBB5FF15310F14416AEA95AB312D731DA51CB96

Uniqueness

Uniqueness Score: -1.00%

Function 008D04BA Relevance: 12.2, APIs: 8, Instructions: 248
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(01024C88,01024C88,?,7FFFFFFF,?,008D078A,01024C88,01024C88,?,01024C88,?,?,?,?,01024C88,?), ref: 008D0560
__alloca_probe_16.LIBCMT ref: 008D061B
__alloca_probe_16.LIBCMT ref: 008D06AA
__freea.LIBCMT ref: 008D06F5
__freea.LIBCMT ref: 008D06FB
__freea.LIBCMT ref: 008D0731
__freea.LIBCMT ref: 008D0737
__freea.LIBCMT ref: 008D0747

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 1b6db024e46fed92bbd6dcbbd2716e9ce02894e0350d483d22bae5e6011da2ee
Instruction ID: 9a1d0fc90c7dc316e681473432824b0547a7eff53b04265b6fe957292ac7c3fa
Opcode Fuzzy Hash: 1b6db024e46fed92bbd6dcbbd2716e9ce02894e0350d483d22bae5e6011da2ee
Instruction Fuzzy Hash: 2471A3729002099BDF219A989C41FAE77B5FF45314F28021AE944FB341E675EC418F61

Uniqueness

Uniqueness Score: -1.00%

Function 008CEDED Relevance: 9.3, APIs: 6, Instructions: 298
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1c03722af5830c002ecd6b2dfb4ab65d836b0abcf483bbd4a5bcae95b120a28
Instruction ID: b97764c51bbb8d268ef30785a1136a403773dc19f64096ddbab5d09cdefa069c
Opcode Fuzzy Hash: e1c03722af5830c002ecd6b2dfb4ab65d836b0abcf483bbd4a5bcae95b120a28
Instruction Fuzzy Hash: 87B19EB0A04649AFEB11DF98C881FAE7BB2FF45304F18416EE514EB292D771D941CB61

Uniqueness

Uniqueness Score: -1.00%

Function 008B483B Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008B4842
std::_Lockit::_Lockit.LIBCPMT ref: 008B484C
int.LIBCPMT ref: 008B4863

Part of subcall function 008B21B2: std::_Lockit::_Lockit.LIBCPMT ref: 008B21C3
Part of subcall function 008B21B2: std::_Lockit::~_Lockit.LIBCPMT ref: 008B21DD

codecvt.LIBCPMT ref: 008B4886
std::_Facet_Register.LIBCPMT ref: 008B489D
std::_Lockit::~_Lockit.LIBCPMT ref: 008B48BD

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 7d48d8a0e8282d54684eb0e6157501c6675b35d1c35bcc2747b7b6bbcb23d83f
Instruction ID: 91ee0825a5895f2f683a24cd32b910cef5938909de696857b5529524b9eb79a0
Opcode Fuzzy Hash: 7d48d8a0e8282d54684eb0e6157501c6675b35d1c35bcc2747b7b6bbcb23d83f
Instruction Fuzzy Hash: 3511AF719006159BCB11EBACC8467EEB7B5FF44320F14051AF501E7392DF74AE048B82

Uniqueness

Uniqueness Score: -1.00%

Function 008B92BA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,008B92B1,008B79E7,008B6989), ref: 008B92C8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 008B92D6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 008B92EF
SetLastError.KERNEL32(00000000,008B92B1,008B79E7,008B6989), ref: 008B9341

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a88230bd33ad9c81493401c99df2f6556513f1f4c8c8f4a0b559dfd1093e2a24
Instruction ID: c422b8ba6e8f0b898aaf3451b55b5cbe00f14a3242bc5d33ecbe217228193722
Opcode Fuzzy Hash: a88230bd33ad9c81493401c99df2f6556513f1f4c8c8f4a0b559dfd1093e2a24
Instruction Fuzzy Hash: 5801FC3224D7116EA728277D7C8AADA3B85FB46375B21532EFA24C53E0EF514C025546

Uniqueness

Uniqueness Score: -1.00%

Function 008C0131 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,E64169D8,?,?,00000000,008D20C7,000000FF,?,008C00C1,?,?,008C0095,00000000), ref: 008C0166
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 008C0178
FreeLibrary.KERNEL32(00000000,?,00000000,008D20C7,000000FF,?,008C00C1,?,?,008C0095,00000000), ref: 008C019A

Strings

CorExitProcess, xrefs: 008C0170
mscoree.dll, xrefs: 008C015F

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e26dc30d290d832535a56ca9ef607f380e020b98c0a9e5b4f9cca2703baff5f0
Instruction ID: 5056dfee07af3375fabf75870231d07d10497080b546da214c6313a73a8d9a4b
Opcode Fuzzy Hash: e26dc30d290d832535a56ca9ef607f380e020b98c0a9e5b4f9cca2703baff5f0
Instruction Fuzzy Hash: BE01A231A54619EFDB128B50DC45FAEBBB8FB04B21F04462AF821E2390DB789900CA90

Uniqueness

Uniqueness Score: -1.00%

Function 008C61EA Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 008C6271
__alloca_probe_16.LIBCMT ref: 008C6332
__freea.LIBCMT ref: 008C6399

Part of subcall function 008C3D30: HeapAlloc.KERNEL32(00000000,01020CF0,00000000,?,008B6126,01020CF0,?,008B26AE,00000044,00000000,01020CF0), ref: 008C3D62

__freea.LIBCMT ref: 008C63AE
__freea.LIBCMT ref: 008C63BE

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 954d2496d35de2df557798ec08b990ed66e852b9ad6ba8774619d0fbd5c72dc9
Instruction ID: c684d4258985732c3d7c3c187a5bf2e83039fcd4395b445b2040f0c15a01e639
Opcode Fuzzy Hash: 954d2496d35de2df557798ec08b990ed66e852b9ad6ba8774619d0fbd5c72dc9
Instruction Fuzzy Hash: 1D517A7260025AAFEF219EA8DC81FAB3BB9FF44714B19453DFD04D6251FA30DC6096A1

Uniqueness

Uniqueness Score: -1.00%

Function 008B4143 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008B414A
std::_Lockit::_Lockit.LIBCPMT ref: 008B4155
std::_Lockit::~_Lockit.LIBCPMT ref: 008B41C3

Part of subcall function 008B42A6: std::locale::_Locimp::_Locimp.LIBCPMT ref: 008B42BE

std::locale::_Setgloballocale.LIBCPMT ref: 008B4170
_Yarn.LIBCPMT ref: 008B4186

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: a9546435c6345056cf6b7b93424884395397cf48bd06239cb44efe23f5f0c8f6
Instruction ID: c9ddc2ceb5fcfe6b51ca3f111e5de7df8acb10811e5e4282418269d1d92180d6
Opcode Fuzzy Hash: a9546435c6345056cf6b7b93424884395397cf48bd06239cb44efe23f5f0c8f6
Instruction Fuzzy Hash: AB018F75A015219FDB06FF68D8865BD7B71FF84350B18410AF8119B382DF74AE46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 008BA402 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,008BA3B3,00000000,00000000,?,?,?,?,008BA4DD,00000002,FlsGetValue,008D4CC8,FlsGetValue), ref: 008BA40F
GetLastError.KERNEL32(?,008BA3B3,00000000,00000000,?,?,?,?,008BA4DD,00000002,FlsGetValue,008D4CC8,FlsGetValue,00000000,?,008B936D), ref: 008BA419
LoadLibraryExW.KERNEL32(?,00000000,00000000,008D4CC8,FlsGetValue,00000000,?,008B936D), ref: 008BA441

Strings

api-ms-, xrefs: 008BA426

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 8e4ff71125f714e5940311e014d9060bd5902d546a774d10bded267b51bd0131
Instruction ID: e817819c68bb48092511df01f59bb7f387dff7d1dc1fd110627076c903a5d829
Opcode Fuzzy Hash: 8e4ff71125f714e5940311e014d9060bd5902d546a774d10bded267b51bd0131
Instruction Fuzzy Hash: 77E01A30294206BBEF201B60EC4AB983A68FF00B41F104020F90DE82E1DFB1D812A69A

Uniqueness

Uniqueness Score: -1.00%

Function 008C709F Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(E64169D8,00000000,00000000,00000000), ref: 008C7102

Part of subcall function 008C8847: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,008C638F,?,00000000,-00000008), ref: 008C88F3

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 008C735D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 008C73A5
GetLastError.KERNEL32 ref: 008C7448

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 85c9c806e2bf395c9bbc70eadeee1aac6b746a68c7d77651f28b4fa528b31bcd
Instruction ID: c4dad6f6de7dd7f8988e48b0ac038939160ace02858f455bec3301738e42b4b1
Opcode Fuzzy Hash: 85c9c806e2bf395c9bbc70eadeee1aac6b746a68c7d77651f28b4fa528b31bcd
Instruction Fuzzy Hash: 58D125B5E04258AFCB15CFA8D880AADBBB5FF49314F18452EE856EB351D630E942CF50

Uniqueness

Uniqueness Score: -1.00%

Function 008B93D1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 008B9498
___AdjustPointer.LIBCMT ref: 008B94BB
___AdjustPointer.LIBCMT ref: 008B9557

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 06263039be665996b1fd75a8c676cd99d63b3e13939400c6925e37fcbab2916e
Instruction ID: 69c4a8794e474cc8b8a2701e6546fcae033969ba8602ef525767d06daae9953f
Opcode Fuzzy Hash: 06263039be665996b1fd75a8c676cd99d63b3e13939400c6925e37fcbab2916e
Instruction Fuzzy Hash: C351DE72604606EFDB2A8F18D851BFA77A4FF44310F14412DEA95D63A1E731EC82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 008C8C63 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 008C8847: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,008C638F,?,00000000,-00000008), ref: 008C88F3

GetLastError.KERNEL32 ref: 008C8CC7
__dosmaperr.LIBCMT ref: 008C8CCE
GetLastError.KERNEL32(?,?,?,?), ref: 008C8D08
__dosmaperr.LIBCMT ref: 008C8D0F

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 86d7f83761179892e69153078b659f6101b83a4d118d29b74adb5a7e1c310a3e
Instruction ID: d8638dcb2f9e671c66647c1fb40af9cb213612943ece0f90a940565aa01d0a99
Opcode Fuzzy Hash: 86d7f83761179892e69153078b659f6101b83a4d118d29b74adb5a7e1c310a3e
Instruction Fuzzy Hash: 7A21B371640619EFDB60AF69C881E6BB7B9FF14364710852CF929D7250DF34EC008BA1

Uniqueness

Uniqueness Score: -1.00%

Function 008BF50B Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6ce18b959aa065b6d68c37d49f45fa76f5128d2441c3ba994b8dea8f9867407
Instruction ID: c981afb74b9eac516ddb2d0ae59b41fecb8ffd76b1e5021f5f10c88ddbf97bcb
Opcode Fuzzy Hash: c6ce18b959aa065b6d68c37d49f45fa76f5128d2441c3ba994b8dea8f9867407
Instruction Fuzzy Hash: 7F219F31600209BFCB30AF798C819EA77A8FF51365710453AFA16D7352E730ED018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 008C9BF9 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 008C9C01

Part of subcall function 008C8847: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,008C638F,?,00000000,-00000008), ref: 008C88F3

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 008C9C39
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 008C9C59

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 974227c0694320be36f0b42ad281aa3929d95df9bf9d5e24f165a4491f19c759
Instruction ID: 075218ceec58e4f94430cb27511c8a960764f3ead10ade2e479907b19f2e6d19
Opcode Fuzzy Hash: 974227c0694320be36f0b42ad281aa3929d95df9bf9d5e24f165a4491f19c759
Instruction Fuzzy Hash: 8B1104E2504659BE672167B95DCEEAF29BCFF85399311046CF802E2101FE34CE024572

Uniqueness

Uniqueness Score: -1.00%

Function 008B19D7 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008B19E3
int.LIBCPMT ref: 008B19F6

Part of subcall function 008B21B2: std::_Lockit::_Lockit.LIBCPMT ref: 008B21C3
Part of subcall function 008B21B2: std::_Lockit::~_Lockit.LIBCPMT ref: 008B21DD

std::_Facet_Register.LIBCPMT ref: 008B1A29
std::_Lockit::~_Lockit.LIBCPMT ref: 008B1A3F

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: e21ead309041ebcbee93eff83a1c1c11827a765e5411fa693f0afc7c883860a8
Instruction ID: 507f14ea851602af175cda5f9e032f1afeeae7e1b2f737a33a873e5465a235b9
Opcode Fuzzy Hash: e21ead309041ebcbee93eff83a1c1c11827a765e5411fa693f0afc7c883860a8
Instruction Fuzzy Hash: AA01A772501524ABCB15FB68DC599EE7768FF44760B20014AF501DB392FF30EE418795

Uniqueness

Uniqueness Score: -1.00%

Function 008B1AC9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008B1AD5
int.LIBCPMT ref: 008B1AE8

Part of subcall function 008B21B2: std::_Lockit::_Lockit.LIBCPMT ref: 008B21C3
Part of subcall function 008B21B2: std::_Lockit::~_Lockit.LIBCPMT ref: 008B21DD

std::_Facet_Register.LIBCPMT ref: 008B1B1B
std::_Lockit::~_Lockit.LIBCPMT ref: 008B1B31

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 9db2e9d922781765bfdc1e90eba5af5b56d44e116e26df95953a558e17b7bd20
Instruction ID: a027ab3c08a41c74e62ce8bd6e72574aac3afcc56f4c1af3da897a9640bcfbde
Opcode Fuzzy Hash: 9db2e9d922781765bfdc1e90eba5af5b56d44e116e26df95953a558e17b7bd20
Instruction Fuzzy Hash: A401F772500514ABCF15ABACDD198EE7B69FF48770B100119F502DB391FF30AE018785

Uniqueness

Uniqueness Score: -1.00%

Function 008B1A50 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008B1A5C
int.LIBCPMT ref: 008B1A6F

Part of subcall function 008B21B2: std::_Lockit::_Lockit.LIBCPMT ref: 008B21C3
Part of subcall function 008B21B2: std::_Lockit::~_Lockit.LIBCPMT ref: 008B21DD

std::_Facet_Register.LIBCPMT ref: 008B1AA2
std::_Lockit::~_Lockit.LIBCPMT ref: 008B1AB8

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: cf9eb7a24b21f046e176489790910a6ef55071acfdd697e726e2335d55b3efff
Instruction ID: 97848af556d5573b2eb701458fe71cab0a8040093a50b2a09c2b492b3847165d
Opcode Fuzzy Hash: cf9eb7a24b21f046e176489790910a6ef55071acfdd697e726e2335d55b3efff
Instruction Fuzzy Hash: BA01A272901524ABCB15ABACDC1A8EE7778FF85360B540249F902DB391EF30AF4187C2

Uniqueness

Uniqueness Score: -1.00%

Function 008D02EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,008CF1AA,00000000,00000001,00000000,00000000,?,008C749C,00000000,00000000,00000000), ref: 008D0306
GetLastError.KERNEL32(?,008CF1AA,00000000,00000001,00000000,00000000,?,008C749C,00000000,00000000,00000000,00000000,00000000,?,008C7A23,00000000), ref: 008D0312

Part of subcall function 008D02D8: CloseHandle.KERNEL32(FFFFFFFE,008D0322,?,008CF1AA,00000000,00000001,00000000,00000000,?,008C749C,00000000,00000000,00000000,00000000,00000000), ref: 008D02E8

___initconout.LIBCMT ref: 008D0322

Part of subcall function 008D029A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,008D02C9,008CF197,00000000,?,008C749C,00000000,00000000,00000000,00000000), ref: 008D02AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,008CF1AA,00000000,00000001,00000000,00000000,?,008C749C,00000000,00000000,00000000,00000000), ref: 008D0337

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 60bbbf10711b688f71ab653078622c52107ade5d2f23268e7108e607e5af448d
Instruction ID: b44aec3725e6987993e33b27223d88ae4306f49d81cb893534b1d0e81d4066a9
Opcode Fuzzy Hash: 60bbbf10711b688f71ab653078622c52107ade5d2f23268e7108e607e5af448d
Instruction Fuzzy Hash: F6F03036145228BFCF226FD9DC48A8D3F26FB083A1F084215FA19D6230C6328821EF91

Uniqueness

Uniqueness Score: -1.00%

Function 008B90C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 008B90FF
__IsNonwritableInCurrentImage.LIBCMT ref: 008B91B3

Strings

csm, xrefs: 008B919D

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 0f2f5d2bf73b8b7486fc2a8f87c0cfaa9d0daafdda51f32471e105207a03b305
Instruction ID: f5aca0f37abcd393daf522f051cef59c116ba6be4ad4261b7cb37df95ad2c799
Opcode Fuzzy Hash: 0f2f5d2bf73b8b7486fc2a8f87c0cfaa9d0daafdda51f32471e105207a03b305
Instruction Fuzzy Hash: B041B234A00209ABCF14DF6CC889ADEBBB5FF45314F148155E968EB392D735EA06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 008B99CD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 008B99F2

Strings

RCC, xrefs: 008B9A0C
MOC, xrefs: 008B9A04

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 48013e9911fd16dfc7caf648ddaeb51f4866b45bb65c0d6a8eed3df3047cb078
Instruction ID: 982f790b0c7dc1b6105edb4e85f26f96dde21acbfb6a42f057cb4e432fa3f2fb
Opcode Fuzzy Hash: 48013e9911fd16dfc7caf648ddaeb51f4866b45bb65c0d6a8eed3df3047cb078
Instruction Fuzzy Hash: C0416772900219EFCF16DF98CC81AEEBBB5FF48300F189099FA59A7221D335A950DB51

Uniqueness

Uniqueness Score: -1.00%

Function 008B1C4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008B1C53
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 008B1C8B

Part of subcall function 008B4241: _Yarn.LIBCPMT ref: 008B4260
Part of subcall function 008B4241: _Yarn.LIBCPMT ref: 008B4284

Strings

bad locale name, xrefs: 008B1C99

Memory Dump Source

Source File: 00000000.00000002.2057007559.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.2056993288.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057027095.00000000008D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.00000000008DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000913000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057040700.0000000000922000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057167155.000000000092B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057180875.000000000092C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057192548.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 16e9b4c1e45c7c2a0e41d5c0308c383357a300a41a975512b0b8caaa3c06e1ef
Instruction ID: c23d20b1ebb9479113c7db31b0891b246d5a580764e813d6c3257de9570840a1
Opcode Fuzzy Hash: 16e9b4c1e45c7c2a0e41d5c0308c383357a300a41a975512b0b8caaa3c06e1ef
Instruction Fuzzy Hash: 86F01D71505B409E83319F6A9481453FBE4FE293103948A2FE1DEC3B11D730A508CB6A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 712, Parent PID: 5228COMMON

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	92
Total number of Limit Nodes:	10

Executed Functions

Function 067A67D8 Relevance: .6, Instructions: 561COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff276f8aaa998b083d3af4959f540e28970b295f3dd3a5fb8325c26753153bac
Instruction ID: 33217190f384d2c3a6ef8a79da472d8748c40dd42b72a8df50ec16a380dca42f
Opcode Fuzzy Hash: ff276f8aaa998b083d3af4959f540e28970b295f3dd3a5fb8325c26753153bac
Instruction Fuzzy Hash: C5229D31A003099FDB55DF68D890BAEBBF2FF89310F188669E5159B251DB30ED46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 067AA3D8 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40daca38a7f6f0f9b72a5cabf71952c2eb8a916a535ac00dc25da2c579dd74c5
Instruction ID: f05433e682ba6c49540d704a4e0e7e2e4e302dd7657d16d159d51e427d34c707
Opcode Fuzzy Hash: 40daca38a7f6f0f9b72a5cabf71952c2eb8a916a535ac00dc25da2c579dd74c5
Instruction Fuzzy Hash: 10D1E774D00318CFCB18EFB8D8546ADBBB2FF8A305F1081A9D51AAB294DB355986CF11

Uniqueness

Uniqueness Score: -1.00%

Function 067AA3E8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76fbd003defa34a018bad44856f2719010dab22647483f9c6bb25c66d918c288
Instruction ID: f55f5a205c0a317c4b64e5f060c78aad99b9165614ab6788823bedbf837631c9
Opcode Fuzzy Hash: 76fbd003defa34a018bad44856f2719010dab22647483f9c6bb25c66d918c288
Instruction Fuzzy Hash: 55D1D874D00318CFCB18EFB8D8546ADBBB2FF8A305F108169D51AAB254DB359986CF51

Uniqueness

Uniqueness Score: -1.00%

Function 011ED0A8 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 011ED136
GetCurrentThread.KERNEL32 ref: 011ED173
GetCurrentProcess.KERNEL32 ref: 011ED1B0
GetCurrentThreadId.KERNEL32 ref: 011ED209

Memory Dump Source

Source File: 00000001.00000002.2197409248.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11e0000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d6f5df189159382714082b66e3ce94a0c3e554f9e10556cdb18dd2da314fb359
Instruction ID: 6ed98a31227a851816b9714c17ec303ed47b75cd87ba6c634c2f8decd88abec1
Opcode Fuzzy Hash: d6f5df189159382714082b66e3ce94a0c3e554f9e10556cdb18dd2da314fb359
Instruction Fuzzy Hash: FC5167B0900749CFEB48CFA9E548B9EBBF1EF88314F24845AD119B73A0D7749848CB65

Uniqueness

Uniqueness Score: -1.00%

Function 011ED0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 011ED136
GetCurrentThread.KERNEL32 ref: 011ED173
GetCurrentProcess.KERNEL32 ref: 011ED1B0
GetCurrentThreadId.KERNEL32 ref: 011ED209

Memory Dump Source

Source File: 00000001.00000002.2197409248.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11e0000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: db88abe16136804a8fb9a0c4a1cbae1ba7574ee2758bf7db0b5653d5a9833cca
Instruction ID: f0c91b4603eccf1e6e381fb699dbea0141679b765e3f8c776f9a662f6832e36a
Opcode Fuzzy Hash: db88abe16136804a8fb9a0c4a1cbae1ba7574ee2758bf7db0b5653d5a9833cca
Instruction Fuzzy Hash: AF5177B0900749CFEB48CFAAE548B9EBBF1EF88314F248459E119B7360D7749848CB65

Uniqueness

Uniqueness Score: -1.00%

Function 011EAE30 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 011EB086

Memory Dump Source

Source File: 00000001.00000002.2197409248.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11e0000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 19e94cfbbb6e818cf59d55ea76ea70daa955d546ffa2aa28657b5597d4d1e5d2
Instruction ID: 89ea4b9d27af67c97814fef58d78ad04e5ca86d1723f56fafdb061772e9ef552
Opcode Fuzzy Hash: 19e94cfbbb6e818cf59d55ea76ea70daa955d546ffa2aa28657b5597d4d1e5d2
Instruction Fuzzy Hash: 897167B0A00B058FE728DF69E14879ABBF1FF88304F04892ED15AD7A50D734E849CB91

Uniqueness

Uniqueness Score: -1.00%

Function 011E5935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 011E59F1

Memory Dump Source

Source File: 00000001.00000002.2197409248.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11e0000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c3a5f159f958137a5aab1a2e6d9190a4638699120483c2568a3d38ee6b741e0b
Instruction ID: af0aba05645f5e663d774c6c93f225591e671c41ec463c4616a7dcefb76c18ce
Opcode Fuzzy Hash: c3a5f159f958137a5aab1a2e6d9190a4638699120483c2568a3d38ee6b741e0b
Instruction Fuzzy Hash: AA41E270D00719CFEB24CFA9C88879DBBF5BF85304F20806AD508AB254D7756946CF51

Uniqueness

Uniqueness Score: -1.00%

Function 011E4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 011E59F1

Memory Dump Source

Source File: 00000001.00000002.2197409248.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11e0000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 45e4ed55948f8310563b4a7de14ced0969c1af347c7d277f74605847aaa4ee35
Instruction ID: 85364b02944de47ef1b2581904763e1408432a12429218c88886c1472a65eae5
Opcode Fuzzy Hash: 45e4ed55948f8310563b4a7de14ced0969c1af347c7d277f74605847aaa4ee35
Instruction Fuzzy Hash: 1341C170D00B19CBEB24CFA9C888B9DBBF5FF85704F20806AD508AB254DB756945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 011ED300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 011ED387

Memory Dump Source

Source File: 00000001.00000002.2197409248.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11e0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 02cf550e34cfdb58cdc615ccc4543502cf84193d5e5630ec6f3b950c549c8e52
Instruction ID: ea749527fa96b4715fd1877cbd58fc54829ec3be3d8b11037f22766c02d7a3d1
Opcode Fuzzy Hash: 02cf550e34cfdb58cdc615ccc4543502cf84193d5e5630ec6f3b950c549c8e52
Instruction Fuzzy Hash: 2721E4B5900248DFDB10CFAAD985ADEFBF4EB48320F14841AE918B3310C378A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 011ED2F9 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 011ED387

Memory Dump Source

Source File: 00000001.00000002.2197409248.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11e0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 486bce274ead3140f47ea12c2bf8979b7f90f6c07141575c923049f508caaf48
Instruction ID: 595444cf284914ceac4bf6fb3c161a09da8940362bdd2a8df9d2d3e3f7f5df78
Opcode Fuzzy Hash: 486bce274ead3140f47ea12c2bf8979b7f90f6c07141575c923049f508caaf48
Instruction Fuzzy Hash: F721E3B5900249DFDB10CFA9D985ADEBBF4AB48320F14841AE918B3310D378A954CF60

Uniqueness

Uniqueness Score: -1.00%

Function 011EA870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,011EB101,00000800,00000000,00000000), ref: 011EB312

Memory Dump Source

Source File: 00000001.00000002.2197409248.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11e0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 33a5e8afb4723422f911ffd7a115eafb84e8a4f5d0a802002846191fe217fffc
Instruction ID: 621e0933c62a9218dd9c11ce97639d6dc9acb5d3a2ceacb04af80f9195a69da2
Opcode Fuzzy Hash: 33a5e8afb4723422f911ffd7a115eafb84e8a4f5d0a802002846191fe217fffc
Instruction Fuzzy Hash: 3D1103B68047499FDB14CF9AC448A9EFBF4EF88710F14842AD919B7200C374A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 011EB2A0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,011EB101,00000800,00000000,00000000), ref: 011EB312

Memory Dump Source

Source File: 00000001.00000002.2197409248.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11e0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2552c5707b53e03b95a9a5aaccb4dee85e4af606dc22588aaefcf69877b3a3b7
Instruction ID: 8097e67fa94b7e7acf8ae6b58eacd938b11ba7d86cd78d70e9899d6a847e176e
Opcode Fuzzy Hash: 2552c5707b53e03b95a9a5aaccb4dee85e4af606dc22588aaefcf69877b3a3b7
Instruction Fuzzy Hash: FE1100B68046498FDB14CFAAC844ADEBBF4AF88720F14842AD919A7210C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 011EB020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 011EB086

Memory Dump Source

Source File: 00000001.00000002.2197409248.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_11e0000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 71ff960972c9fc5ac6941c51c4935d980f3a673723320ee124dd41d82c13ad0a
Instruction ID: 2fb38bd68a550ae63d5f5fbd4e7f8f184a21fcf8fc6791c2fad27380a71f27d8
Opcode Fuzzy Hash: 71ff960972c9fc5ac6941c51c4935d980f3a673723320ee124dd41d82c13ad0a
Instruction Fuzzy Hash: D21110B6C00749CFDB24CF9AC444BDEFBF4AB88620F14842AD528B7210C379A549CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 067A59C8 Relevance: 1.5, Strings: 1, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 067A5C29

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 0c1198f2733e70859c4dc85ffc591e3f5a7233452aef83f2a230fc219a05fe33
Instruction ID: 3a5ab840af97b1602c8346418bc216d2eb5535965b84d3c16817f3a4184678b9
Opcode Fuzzy Hash: 0c1198f2733e70859c4dc85ffc591e3f5a7233452aef83f2a230fc219a05fe33
Instruction Fuzzy Hash: C6C13734600702DFD764CF18C48096ABBF2FF88314B2ACA59D55A9B666D730FD46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06781BA0 Relevance: 1.4, Instructions: 1439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2208493362.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6780000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa0307f4297057f494186a6d9b1167f80c105178be93835d5a3874329b96fdcd
Instruction ID: ce740a7ded7d33dce91a66b10a0139904d06b9db645ca524f077b612be0cad7b
Opcode Fuzzy Hash: fa0307f4297057f494186a6d9b1167f80c105178be93835d5a3874329b96fdcd
Instruction Fuzzy Hash: ECC24F70B502189FCB54DF64C954AEDBBF2EF89700F10409AE616AB3A1DB719E81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06783838 Relevance: .8, Instructions: 784
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2208493362.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6780000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d94e6e828dffffb83eba914497fd74c1904a08ea8204198f972ae39a94b1965
Instruction ID: e0f3c3d8ad714dff325bfdbf2124d455d6edf522be542729a6cd1253ee96d95f
Opcode Fuzzy Hash: 9d94e6e828dffffb83eba914497fd74c1904a08ea8204198f972ae39a94b1965
Instruction Fuzzy Hash: 15621975B402149FCB44DFA8C894EAEBBF6EF89700F118099E606DB3A5DA71ED41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 067800D8 Relevance: .7, Instructions: 676
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2208493362.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6780000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f94eee2086daa182d13f6242d92ec0bb4c1381a24a2c98541115783f64abb26
Instruction ID: 37fd67b33a94aff72767030d0cede85dd6f8eedb706406a8f2d23f72387ea55b
Opcode Fuzzy Hash: 2f94eee2086daa182d13f6242d92ec0bb4c1381a24a2c98541115783f64abb26
Instruction Fuzzy Hash: F042AB707507199FEB64AB78D4A462E7BF2FFC6204B40891CD5079B390DB7AED068B81

Uniqueness

Uniqueness Score: -1.00%

Function 06780D80 Relevance: .6, Instructions: 622COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208493362.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6780000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ba858fd09c483b1a162c299c64b6e51343e696bb86218571c15b502f73ef56
Instruction ID: 3450ff04cd66799813426d8be22bd60f3dfaa1c6e7261888751d494e4a5f904a
Opcode Fuzzy Hash: a6ba858fd09c483b1a162c299c64b6e51343e696bb86218571c15b502f73ef56
Instruction Fuzzy Hash: 20329370B402059FEB55EB69C858A7E7BF6BF89704B14845AE506CB3A2DF34DC02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 067A48A8 Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d635f7c9ba2e994b1fe9eb4175722ee718140689e2021dc1561eb1fd96bb386
Instruction ID: 4be6fdb5b861afba9199f03522cf70a7a05c9010e6b97e2b3886d24c784a3f3b
Opcode Fuzzy Hash: 3d635f7c9ba2e994b1fe9eb4175722ee718140689e2021dc1561eb1fd96bb386
Instruction Fuzzy Hash: EC124634B00605CFCB54DF39C998A6ABBF2BF89301B1585A9E506CB366DB71EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 067A3F50 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6c13791fe5e335643fe33217ade95d9601486ff594fd982b7047686ab292644
Instruction ID: ce7da23780e6851de2e27af0c652e8ed222dba98ed872e8e56e2cadca423f10f
Opcode Fuzzy Hash: f6c13791fe5e335643fe33217ade95d9601486ff594fd982b7047686ab292644
Instruction Fuzzy Hash: D7E15D34F102158FCB54DF69C894AAEBBF6BFC9600B148169E906EB369DB71DC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06781582 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208493362.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6780000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e46064b1acd0a7a97ac14cbd99a53cc433bb07aa896044590b4f4901027ce8e
Instruction ID: 2b534de45275cd398c143bc2836a73f978467ae5b96919ef46b9c153dca5c6e4
Opcode Fuzzy Hash: 7e46064b1acd0a7a97ac14cbd99a53cc433bb07aa896044590b4f4901027ce8e
Instruction Fuzzy Hash: 6AC1C5747402069FEB54AB64C8A4A3E7BE6FF86304F54846AE6078B392DF75DC02C791

Uniqueness

Uniqueness Score: -1.00%

Function 067800B9 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208493362.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6780000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77adde00d93804721dbd4235c937115a32d087e56cf939a2b948b35e4d7dac21
Instruction ID: 1ed0475127cfc12b45575c2b363fcd1186e1731b755b8c729467fb6a9bd67b68
Opcode Fuzzy Hash: 77adde00d93804721dbd4235c937115a32d087e56cf939a2b948b35e4d7dac21
Instruction Fuzzy Hash: 7AC18F34B50204DFDB44AB64C859B7A7BF6FF8A701F108059EA068B3A1CBB5DD45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 067A7D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80b469784c6b187550786b534378c46a425f2f5b1fc9e53288d9c9de5cff3d4a
Instruction ID: fa509dd34e332dc04e5d68e3895291aa8f0f080f143f8277987e8fa6b79451b3
Opcode Fuzzy Hash: 80b469784c6b187550786b534378c46a425f2f5b1fc9e53288d9c9de5cff3d4a
Instruction Fuzzy Hash: E9514375E00318DFDB58CFA9C884BEEBBF5AF88710F148229D415AB244DB749942CF80

Uniqueness

Uniqueness Score: -1.00%

Function 067834D8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208493362.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6780000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d06b85e4414df14970b8a2f75a1391951e7474bdddb071c64a001ebcd603d7a
Instruction ID: 59f54875cddeb9d34c5495f8388392120ea8e84f03dec80417bfffb4e4c0d807
Opcode Fuzzy Hash: 4d06b85e4414df14970b8a2f75a1391951e7474bdddb071c64a001ebcd603d7a
Instruction Fuzzy Hash: 9A513835B506159FCB44DFA9C894DAEBBF2EF89710B118069E906AB361EB30EC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06782FC8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208493362.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6780000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9469811e9d8655232f358020791158d8961b46b2aaae1ddad52cb46704f49c7
Instruction ID: 40a713144692c18712c1bf281b375ebec3f4a1518c9c2af0b79114f2e3746988
Opcode Fuzzy Hash: f9469811e9d8655232f358020791158d8961b46b2aaae1ddad52cb46704f49c7
Instruction Fuzzy Hash: 1F514A35B516149FCB44DFA9C894DAEBBF2FF89710B1180A9E906AB361DB31EC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06783819 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208493362.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6780000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 854add6c5279c627a1d6f8a5ce51b8d8780c4581541e26c1ee9a90d1c0552603
Instruction ID: 956d8b7275fe4f46e74391c4d2254aec81af31c512eb7c7ae43cfb8cf81e0418
Opcode Fuzzy Hash: 854add6c5279c627a1d6f8a5ce51b8d8780c4581541e26c1ee9a90d1c0552603
Instruction Fuzzy Hash: 3F515E75B442009FCB44EF98C994E7F7BF6EF89A10B118085F6069B7A6CA71DC01CB62

Uniqueness

Uniqueness Score: -1.00%

Function 067A6E72 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f9b56b25c2e8d7eee42d79fa1f22fe4d7a80c2e6a87e50a629bdf7a4c20a34
Instruction ID: ec202d279acd024a00cd53f3928d997b05199f2a9239a5c6d75e22f58112a5c4
Opcode Fuzzy Hash: 90f9b56b25c2e8d7eee42d79fa1f22fe4d7a80c2e6a87e50a629bdf7a4c20a34
Instruction Fuzzy Hash: D5514D71505F849FC726CF6EC440897FFF4AF9A204B04896EE5DA87B22D274E904CB61

Uniqueness

Uniqueness Score: -1.00%

Function 067A7D4C Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84d4c02abc556fa70b8d8df9ffd2156d4f641f80161a9107ad3cfc6b993e4ea0
Instruction ID: c9ed295fd9669ecfd6698386cfe90783bb5fccd18218235e3ad730f2a2392043
Opcode Fuzzy Hash: 84d4c02abc556fa70b8d8df9ffd2156d4f641f80161a9107ad3cfc6b993e4ea0
Instruction Fuzzy Hash: 03515674D04359DFDB58CFA9C884BEEBBF5AF88700F148629E405AB240DB749942CF91

Uniqueness

Uniqueness Score: -1.00%

Function 067A3DE0 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa0b66ffb1f26f33ee5d4febef3f46fe69dac5058dfb7e9891d0c86e1b767a92
Instruction ID: 966442710f158642c4b3b683ff768705cd2a5565cf7f66d89330cfebe0493685
Opcode Fuzzy Hash: aa0b66ffb1f26f33ee5d4febef3f46fe69dac5058dfb7e9891d0c86e1b767a92
Instruction Fuzzy Hash: 1531F2317053504FC329AB38E8605AE7BEBDFCA22030945AAE546CB341CE35ED07C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 067A5579 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00e77b4bbda2c2fdcaf0398e9e008f20012fdab7fd7bf3de57064ccf34b45182
Instruction ID: ae070a63076e83e6ad66dd814c6da00c59a41afdb08b5d6d2a9c7fc1e4371b04
Opcode Fuzzy Hash: 00e77b4bbda2c2fdcaf0398e9e008f20012fdab7fd7bf3de57064ccf34b45182
Instruction Fuzzy Hash: 63319E35B01210AFDB55DF34D8449AEBBB3BF8A301B148169EA05CB365DB30DD05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 067A84C8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddcfd5d04d8fce86a564c8aa95e11df513196a730503551082477024e1ed7fc1
Instruction ID: 48bda96fedc5b694670b0c6673086616cc532182360c2d04834c83bfe5f0255a
Opcode Fuzzy Hash: ddcfd5d04d8fce86a564c8aa95e11df513196a730503551082477024e1ed7fc1
Instruction Fuzzy Hash: C231AF757012458FCB08EB79A4645AF77E7ABC8200B544439E606CB385EF35AE0687E2

Uniqueness

Uniqueness Score: -1.00%

Function 067A5588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8315a2fc21652535dbf353b889f71ae546469219fbd1511996d2a831f374e3c6
Instruction ID: 59b743dbd33ebceb7954fdf854ffa347e46488b394359f2379c846a168ae36e9
Opcode Fuzzy Hash: 8315a2fc21652535dbf353b889f71ae546469219fbd1511996d2a831f374e3c6
Instruction Fuzzy Hash: 55315734B01211AFDB55DF38D88896EBBB3BF8A301B108569EA06CB355DB31ED01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 067A87A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2640ae5ed421a97d36198cae781c2a9be6c8fd62323c1e8b70a7076104c0b31e
Instruction ID: c202fb9d4934edc74b9209439db6522af2d5d39ad5610af479d6123328106b31
Opcode Fuzzy Hash: 2640ae5ed421a97d36198cae781c2a9be6c8fd62323c1e8b70a7076104c0b31e
Instruction Fuzzy Hash: E4410FB1D11248DFDB58CFAAD944ADEFBF6AF88310F14802AE415BB250DB34A945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 067A8796 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77190dc0c2de123027051ea294db7b4a1b9f0107695c528025767a0e9d47643e
Instruction ID: a167530dcf75ed63c016a93983c94ebea7e4bda40c44fe397806772901e17764
Opcode Fuzzy Hash: 77190dc0c2de123027051ea294db7b4a1b9f0107695c528025767a0e9d47643e
Instruction Fuzzy Hash: 963133B0D113489FDB14CFAAC954BDEBBF6AF88310F14812AE414B7290DB309945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 067A8A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46e7f51a3665fbd8b59e514d1a5270bee839d05ac6d4e7bfa74a33f47d11b73
Instruction ID: 40417d9a78daf36a984cfccd3d4437581807de5d61c8f7d703356cbb73f16566
Opcode Fuzzy Hash: b46e7f51a3665fbd8b59e514d1a5270bee839d05ac6d4e7bfa74a33f47d11b73
Instruction Fuzzy Hash: 9B31E1B1D01358DFDB54CFA9D894B9EBBB5AF88310F14862AE405B7240C774A945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0118D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2197230523.000000000118D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_118d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb1b2b18d096922a09c3830b343fc4bed2bfc7db2981ebe2639ff54cdfebdb3
Instruction ID: cc33586d574242171e5d79f4443204264c94111384cfc7030a1328baceb7b076
Opcode Fuzzy Hash: ddb1b2b18d096922a09c3830b343fc4bed2bfc7db2981ebe2639ff54cdfebdb3
Instruction Fuzzy Hash: C021F471504304EFDF09EF58E9C0B56BB65FB84324F24C569D9090B696C336E456CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0119D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2197261181.000000000119D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0119D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_119d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 161fe9d2524891a5f9798d0d7468aea74f2d4526a182b837c4dc382bbf6abfaf
Instruction ID: e7191019f42be3da2c20774f1a54f03151ba23b044fcf61b0e3ac509ae61f103
Opcode Fuzzy Hash: 161fe9d2524891a5f9798d0d7468aea74f2d4526a182b837c4dc382bbf6abfaf
Instruction Fuzzy Hash: 16213471604300EFDF19DF68E9C0B26BB61FB84354F28C56DD90A4B242C33AD847CA62

Uniqueness

Uniqueness Score: -1.00%

Function 067A8F42 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba072146e98517e60a92b31dde9704f9ddd3369f2eb5f5ab2e55b41bb1746838
Instruction ID: 55d04696e40572c7d932f93cede08e5e14c0eb955a740943909b52735ee1751e
Opcode Fuzzy Hash: ba072146e98517e60a92b31dde9704f9ddd3369f2eb5f5ab2e55b41bb1746838
Instruction Fuzzy Hash: A2213078D0425ADFCB00CFA8D584AEEBBB1FF49311F2041AAE421AB391D7341A81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 067A8A8C Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d81bbd475c931224bd2fdefdfdbeba83f2c57fc3d6b3742a836b6fb20d75de5
Instruction ID: 408fa7052de01b2bf66125e9588db31a69a93a4f44899134d96478f258b84b93
Opcode Fuzzy Hash: 8d81bbd475c931224bd2fdefdfdbeba83f2c57fc3d6b3742a836b6fb20d75de5
Instruction Fuzzy Hash: E22120B0D01348EFDB14CFA9C895BDEBBF9AF88310F14822AE405A7240CB749945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 067ABC5F Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9830d1ae79eae52f56aa2ce6f8496f39c3f51ab2e7633d93c5d882d0c6f0c19
Instruction ID: de2c2c65691b0b7d9a0ddcddb1cf3f1e44fd8a5b7d3edd93c363fcfa96d7ff41
Opcode Fuzzy Hash: c9830d1ae79eae52f56aa2ce6f8496f39c3f51ab2e7633d93c5d882d0c6f0c19
Instruction Fuzzy Hash: 5211A0302113269FC789A734E864ABE3BB7FEC2284348481DD247CBA40DE24A90787A1

Uniqueness

Uniqueness Score: -1.00%

Function 0118D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2197230523.000000000118D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_118d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a994b626c5b1a2b6fd6d27e6a0f022d141ef464c75df6f036bdb8b2bbfaa7e2a
Instruction ID: 5c46bcb1e4ab738330e4124b6ed366146897cdbbe31af7600fb2dc42777b667c
Opcode Fuzzy Hash: a994b626c5b1a2b6fd6d27e6a0f022d141ef464c75df6f036bdb8b2bbfaa7e2a
Instruction Fuzzy Hash: 5D11CD72504280DFCF06DF48D9C0B56BF61FB84224F24C6A9D8090A656C33AE45ACFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0119D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2197261181.000000000119D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0119D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_119d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac9c5df3739d9922357d97ee08fe41b46f5237faea4d682c3f3ac9d5e7d34632
Instruction ID: 6377fc0a87e6b8a28a3027d07599bf3114e6d3593d2cef60b8ed2aae56fd033f
Opcode Fuzzy Hash: ac9c5df3739d9922357d97ee08fe41b46f5237faea4d682c3f3ac9d5e7d34632
Instruction Fuzzy Hash: 6611DD75904280DFDF16CF58E5C4B15FFA1FB84314F28C6AAD8094B656C33AD44ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 067AC499 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04eef46d46d3ec95fd5e14925449bfa4fc756c1043279cb86f5a9a6aeb782cab
Instruction ID: 967fe1d1dba62332efd81324532ecdc07dd9aa80f085427bfaed1acc2d454bae
Opcode Fuzzy Hash: 04eef46d46d3ec95fd5e14925449bfa4fc756c1043279cb86f5a9a6aeb782cab
Instruction Fuzzy Hash: 9311E1302083118FE325AB34E4186AE3BB3EFC5755B148A2DD146CBA81DF74AC0ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 067A8350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61ce9ee03deffa8a9aec7faf9e82b971c5e0211b771d2c2fb0369297ade3367f
Instruction ID: 600b657a759cc16c60e31a5a15db3ca77ea1c3700f801cf3548ebe8cc8c4b2f2
Opcode Fuzzy Hash: 61ce9ee03deffa8a9aec7faf9e82b971c5e0211b771d2c2fb0369297ade3367f
Instruction Fuzzy Hash: 3A018F32B001199BDB14DEA9EC44ABFBBFBEBD4651B14813AE614D3240EB30991587A1

Uniqueness

Uniqueness Score: -1.00%

Function 067ABC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1c747511fe53787704910a1686a16fba31d45277e8ee05aecac36d9366a0739
Instruction ID: d4270861d45920ce3196e4bd2b21a9d7ca64bf35364b123c2d33d42ce64754e1
Opcode Fuzzy Hash: a1c747511fe53787704910a1686a16fba31d45277e8ee05aecac36d9366a0739
Instruction Fuzzy Hash: AE01BC312103128BC688B778E46467E3AF7FFC2298348882CD2078BE00DE34BC478B91

Uniqueness

Uniqueness Score: -1.00%

Function 0118DB09 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2197230523.000000000118D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_118d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a973db9b811c2eb29b9586d004f3ba16fc9a7d2b388c8e8de5033fe3e39bd79
Instruction ID: b83650fce5c351f3afcb339dd37a6d10655d53151b58ba31b749b94a3610d8d5
Opcode Fuzzy Hash: 7a973db9b811c2eb29b9586d004f3ba16fc9a7d2b388c8e8de5033fe3e39bd79
Instruction Fuzzy Hash: 0A01A771005344DAEF185B69ED84B66FF98EF42764F18C45AED085B2C6C7789484CA72

Uniqueness

Uniqueness Score: -1.00%

Function 067AE8B0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fff91a4206e277e5223a720fedfe8a604bc8ee4803eb5939309c0141260569de
Instruction ID: 7eb019602ff2522d05cd01ccb9d16f1d42ea4f880e2a79e5be2d6cda4a6bc0aa
Opcode Fuzzy Hash: fff91a4206e277e5223a720fedfe8a604bc8ee4803eb5939309c0141260569de
Instruction Fuzzy Hash: 890126342083059FCB029F74D8148697FBAEF86200B1484EAE541CF662DB32DD11D791

Uniqueness

Uniqueness Score: -1.00%

Function 067AB358 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50582a7226150d85dd90b9c24cb89b83903d34a11650cca92b2c3f3b78e38fd7
Instruction ID: 3b5b11665aede282a6cb8189ccae730ebc725b173ad8a0e571b6a9daf185599a
Opcode Fuzzy Hash: 50582a7226150d85dd90b9c24cb89b83903d34a11650cca92b2c3f3b78e38fd7
Instruction Fuzzy Hash: 5401F130A0A34AEFCB45FBB8E85459C7FB5FB45204B1441AAD401D7251DB305E46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 067AC4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feba0a6e116fe805ed1f8f987730735e357aa00a6709c35c4effb0eef36294f8
Instruction ID: ab2ae18b2c04c58614122351715d1fb08926c23935f0b4babf22d4594a804d48
Opcode Fuzzy Hash: feba0a6e116fe805ed1f8f987730735e357aa00a6709c35c4effb0eef36294f8
Instruction Fuzzy Hash: 46018C302046058FE324AB78E0586AE77E3EBC9755B148A2DC25A87A44DF74A80ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 067A5508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b7cf6fb8ab7a5e8b39fef2f77688a7b0fad1a1277104dede31ffc5695eec79
Instruction ID: 2ff02dc7201a772dafee06e5fd84e02fec2541148fada3b006c9b4033c2bc328
Opcode Fuzzy Hash: 04b7cf6fb8ab7a5e8b39fef2f77688a7b0fad1a1277104dede31ffc5695eec79
Instruction Fuzzy Hash: 91016D30E01702CFE7A99E79A414637B7F7BFC4215B188A2CE50686614DA71E8C4CB90

Uniqueness

Uniqueness Score: -1.00%

Function 067A67C8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de2aa1a071f9b5d78e1a6252f735041d6aef17711cb896abe28e8559c93f7aa
Instruction ID: 9990069db805be4e290c28ac0b0ed2af3161a9bf0d943c00dede03f177e6a503
Opcode Fuzzy Hash: 6de2aa1a071f9b5d78e1a6252f735041d6aef17711cb896abe28e8559c93f7aa
Instruction Fuzzy Hash: 30F09631B413006BD7308B68EC45F967FEAAB86714F158266F314CB1E2D7B1D8059790

Uniqueness

Uniqueness Score: -1.00%

Function 067AC170 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b9a09cab247ed67aae530026868742226446a89767142a940cd12e1ce5a0340
Instruction ID: 33eee0841ac24889236d570f91a98759d932651c8f8363c822fdd9a3434b7ae0
Opcode Fuzzy Hash: 9b9a09cab247ed67aae530026868742226446a89767142a940cd12e1ce5a0340
Instruction Fuzzy Hash: F601F430109B558FD716DF26E818466BFF6FF89340700866EE886C3A51DB70AA0ACFD4

Uniqueness

Uniqueness Score: -1.00%

Function 067A8F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47e6757c524582e048799a62764e58e303b8187ace3ded7a6984eb8e4561bcce
Instruction ID: d0950e72d2eb9e41a43eec9ad565ee6512db72c079deda3666393adc166b3c05
Opcode Fuzzy Hash: 47e6757c524582e048799a62764e58e303b8187ace3ded7a6984eb8e4561bcce
Instruction Fuzzy Hash: 9C01C4B4D0421ADFDB54DFA9D9496AEFBF5BB88301F1081A99415B3340E7740A41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0118DB08 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2197230523.000000000118D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_118d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fcbd994be39303a8b23afbc4593d18dadbfa2bc30855ac35b3db1e217aaa3bb
Instruction ID: cdca826ccf2abaad4336d9f567eb1994bd70949f17140ce57313ecd14ba87841
Opcode Fuzzy Hash: 3fcbd994be39303a8b23afbc4593d18dadbfa2bc30855ac35b3db1e217aaa3bb
Instruction Fuzzy Hash: 07F0C271004344EFEB248E0AEC84B62FF98EF81774F18C45AED084B282C3789884CA71

Uniqueness

Uniqueness Score: -1.00%

Function 067AC110 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab37f03a8ab7ea76c121debea50952c026595377786690e847aeb0d127e4d77
Instruction ID: 5ee73a8bc1b0484adee655314937480727c16a5dc9ebff1f4f103dc979aafed8
Opcode Fuzzy Hash: dab37f03a8ab7ea76c121debea50952c026595377786690e847aeb0d127e4d77
Instruction Fuzzy Hash: 65F09C302097E59FC3129739F81469F7FF6DF82244B04056EE242CB652CA555D0587A5

Uniqueness

Uniqueness Score: -1.00%

Function 067A6EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2242fd8c939a20a03aea4a38bbcc7e5993c0df42606cd85ec9b10a38b2136d3a
Instruction ID: 6f80f6b5c12e165d0fcabfe03bd118747d70ad962e57cefaf599c71a2108f6ad
Opcode Fuzzy Hash: 2242fd8c939a20a03aea4a38bbcc7e5993c0df42606cd85ec9b10a38b2136d3a
Instruction Fuzzy Hash: BBF037722041E83F8B555E9A5C10CFB7FEDDA8E5657084156FFE8D2141C42DC921ABB0

Uniqueness

Uniqueness Score: -1.00%

Function 067AACB8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68371335fd06fd5769120faa2e20d09720392267509ef645d9054b119012ec5d
Instruction ID: b9e0a59fcd43169f3ac141123ed1cad4d8535f7d1f771f9c4392584607b0011a
Opcode Fuzzy Hash: 68371335fd06fd5769120faa2e20d09720392267509ef645d9054b119012ec5d
Instruction Fuzzy Hash: 31F0BE726092A59FC716273C68280BD7FA9E9C6A5134841DFD283CB292CA589906D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 067AADE9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8af2d52320baf084050e5579709b7deef4ed1e9dc2aa1ad0237d37742906be
Instruction ID: 310f8119a868312fc1ba47061fabb8c18bcfa00e3ad601abb6d960888df83d6a
Opcode Fuzzy Hash: de8af2d52320baf084050e5579709b7deef4ed1e9dc2aa1ad0237d37742906be
Instruction Fuzzy Hash: D0F02E31204141AFC314376DE85879F7FEAEFCA654F04403DE35AC7283CA655806C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 067A8FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e181fd58c3ae271d2b7adecb02043e2f129f0267c7721baae7fad9d25ea980a
Instruction ID: 8de6d40bb834fd3964f2d0e54facc515f602767fe5a375227e8f73cbc7d7de28
Opcode Fuzzy Hash: 1e181fd58c3ae271d2b7adecb02043e2f129f0267c7721baae7fad9d25ea980a
Instruction Fuzzy Hash: F4F0A9B5C0824ADFDB00CBA4D8591BEBFB0EF9A201F00828AE402EB391E7354A01CF41

Uniqueness

Uniqueness Score: -1.00%

Function 067AB368 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d05d19795bcc6e3b2512c43fcac9b23071ed93b50dd430d8dcd27353e7c258c
Instruction ID: 5f5a6195c9c0c9c12d6f52d9298f9cbde1b8fb9d465dbd7aea3cd7699ea36999
Opcode Fuzzy Hash: 3d05d19795bcc6e3b2512c43fcac9b23071ed93b50dd430d8dcd27353e7c258c
Instruction Fuzzy Hash: ECF04F74A0524EEFCB08FFF8E85859C7BB6FB48205B1445A9C506E7754EB305E45CB41

Uniqueness

Uniqueness Score: -1.00%

Function 067A8341 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8d34f862cdc713a522174fb6d3f0f4673f5d6283814f10c1517390eac81cd65
Instruction ID: 980b4459b58fe81ddca8fe819b77f9eb041baffa8d0a7351672fcde1bfa16790
Opcode Fuzzy Hash: d8d34f862cdc713a522174fb6d3f0f4673f5d6283814f10c1517390eac81cd65
Instruction Fuzzy Hash: C5F0E572F101154BCF10DAB8AD48AFF7FEAAF8419170C0137DA54D3201FB30891983A1

Uniqueness

Uniqueness Score: -1.00%

Function 067AAC60 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae44ed1d3dade41bdcc659e68b198742944948a7b1618f81440338adf5a56427
Instruction ID: f05c56262421d8ad0f93a91d6662d68774db45ad7b4700e265f50f754756c7e6
Opcode Fuzzy Hash: ae44ed1d3dade41bdcc659e68b198742944948a7b1618f81440338adf5a56427
Instruction Fuzzy Hash: 97F082212082E54FC617673C68240ED3F7ADAC751430800DFD286CB283C9580A06C7E6

Uniqueness

Uniqueness Score: -1.00%

Function 067AADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48adaf215617017c5d4f59cf52ca5f7f56c8a614e3aeb36aebd281a787edbe3a
Instruction ID: f7047b958e6d9e148ac43027e4f901b8a04c05b7693a7093589c7377e473f6f9
Opcode Fuzzy Hash: 48adaf215617017c5d4f59cf52ca5f7f56c8a614e3aeb36aebd281a787edbe3a
Instruction Fuzzy Hash: 71E09231200205AFD3187AAAE488A9E7AEAEBCA795B00402DE30EC3241CA65580687A5

Uniqueness

Uniqueness Score: -1.00%

Function 067AC180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61df6f42a761bf72bf69f3c7f54fffa7d26454753233349f58d5cbf049acab54
Instruction ID: 7832ebb94d32ab7aa937c61a0658b029942f80a097ead3eefedbdf45834ab2d6
Opcode Fuzzy Hash: 61df6f42a761bf72bf69f3c7f54fffa7d26454753233349f58d5cbf049acab54
Instruction Fuzzy Hash: DCF09A74504B158FD725EF26E448512BBF6FB8C380B00C62EE98B82A10DB70A90ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 067ACC38 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80065bcd25547a8af0c6c78feef90a09050fdbba753d0dabb489861db48ccf3e
Instruction ID: ef72a1e04c673d4c67e4f4363e530ce327b43b3b3534388f2cff38a980c71ccb
Opcode Fuzzy Hash: 80065bcd25547a8af0c6c78feef90a09050fdbba753d0dabb489861db48ccf3e
Instruction Fuzzy Hash: 55E0D8312063659FC702AB24FC21AEA3B61F786515B004166D000C7A46CB381D078FD1

Uniqueness

Uniqueness Score: -1.00%

Function 067AB500 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14b617807bb2dbe21bab167daad43ecc7d7c2f38d53ca353e98e1cebd4ea7a05
Instruction ID: 99c05178287a9189f79cb5d7a12151035b216d29942ab712c208eaaac1b8b96b
Opcode Fuzzy Hash: 14b617807bb2dbe21bab167daad43ecc7d7c2f38d53ca353e98e1cebd4ea7a05
Instruction Fuzzy Hash: F9F03935D0520DBFCB01DFF4D9488CDBFB9EB44244F1082A6E845E7650EA705B55DB91

Uniqueness

Uniqueness Score: -1.00%

Function 067AC120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a432ab05573608e98ef464a5e49ef3aafa32f7ea920318fb78e58eae5ebbd1
Instruction ID: d30b62d7257f33e5a555d72da9b8584364ff61af423e428c3d92690de6d7f0d2
Opcode Fuzzy Hash: 68a432ab05573608e98ef464a5e49ef3aafa32f7ea920318fb78e58eae5ebbd1
Instruction Fuzzy Hash: 64E06D302047658FC711AB3DF4187AE7BE6EF86358F04052DE2478BA51DBA5A8068BA5

Uniqueness

Uniqueness Score: -1.00%

Function 067ACE88 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b31081756b523b50124491d350aa17671ea536dd583deda7f81d1b2f339bdbf7
Instruction ID: a7ba91425c4052841a5187510d373d0df7b1b0393d9e4e2647e6423b8fb1079f
Opcode Fuzzy Hash: b31081756b523b50124491d350aa17671ea536dd583deda7f81d1b2f339bdbf7
Instruction Fuzzy Hash: 9CE0D83010A3A9FFD703B724F8255A93F75DF83511704415AE801CBA55C7348C4687D1

Uniqueness

Uniqueness Score: -1.00%

Function 067AE1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5600c1f5fa2929c77a0f54cb5a54b59bc6af2ad38335271eca26fe8906235dc7
Instruction ID: 6c16a62e9d7a3f4708fc95558a5a0d2c36fafc38002f78ce1f43c43e0d1425ed
Opcode Fuzzy Hash: 5600c1f5fa2929c77a0f54cb5a54b59bc6af2ad38335271eca26fe8906235dc7
Instruction Fuzzy Hash: 5CE0DF71E49358EFCB11DF68EC509AE3BB1EB8220272042EBD809D76A0E6300F119B52

Uniqueness

Uniqueness Score: -1.00%

Function 067AE8F8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1b0df37abbeec309c63f12acb589afad451e159dfeb29baa8ca173af1cbed69
Instruction ID: 44ea531861580dd3a72b5ebe45d69ba78f23860c83ba7ad4049547cff8811cf5
Opcode Fuzzy Hash: e1b0df37abbeec309c63f12acb589afad451e159dfeb29baa8ca173af1cbed69
Instruction Fuzzy Hash: 2EE08C3925A254AFC7029B18CC008697FB8EF5A60030440CAF580CF2B3C221ED21DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 067AAC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 953964ad11e50ae3fbb621177aa5402c552ede857c773e1393d814eb3d19457e
Instruction ID: 91e341fa193f182a330b5e16746f7af213bb88002a301bdad143fd3323123178
Opcode Fuzzy Hash: 953964ad11e50ae3fbb621177aa5402c552ede857c773e1393d814eb3d19457e
Instruction Fuzzy Hash: 32D05E3531012D9FCA1A776DF8184BE7BABEBC5A62304402EE70BC3280CF696D0687D5

Uniqueness

Uniqueness Score: -1.00%

Function 067AB510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3194c1f9244d9b3f467a32bc14411355ec0d8191ad1c78e4cc3d1b9dcb118a6e
Instruction ID: 84cd2133a28abff34afe2585b094109804a96b50a1a47e7bee058b5e3bc27169
Opcode Fuzzy Hash: 3194c1f9244d9b3f467a32bc14411355ec0d8191ad1c78e4cc3d1b9dcb118a6e
Instruction Fuzzy Hash: 21E09275D0420CEFCB40DFE5E9448DDBBB9FB48204F1082AAD909A3210EB306B55DF80

Uniqueness

Uniqueness Score: -1.00%

Function 067AE280 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda28b4da88bc09a6cd17eae19ebb1c0827782ed2c4c2d29369499d1313beeb6
Instruction ID: 6fa99b65e9bf6ebffeaaa8306cbbf7e972593fd5c59092b0902e4b8df45f3ff8
Opcode Fuzzy Hash: eda28b4da88bc09a6cd17eae19ebb1c0827782ed2c4c2d29369499d1313beeb6
Instruction Fuzzy Hash: C0E086311107158FD748FB14FD65B4433A2E789B19F215159D4028B6B8C77119569BC0

Uniqueness

Uniqueness Score: -1.00%

Function 067848EE Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208493362.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6780000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30649bda9aa68b9206648d2f247a9fa0b89282cb0ace2dba77f321e65153fcda
Instruction ID: 3484e2f644597094948739253f91c2ab30ef81cabee1f33635f17e6ac007f3e1
Opcode Fuzzy Hash: 30649bda9aa68b9206648d2f247a9fa0b89282cb0ace2dba77f321e65153fcda
Instruction Fuzzy Hash: E3D012373540155F8344EA9DF484C96B3DEFFD9A313614067F518CB220C972E805C760

Uniqueness

Uniqueness Score: -1.00%

Function 067AE210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 217b6ca006fb3c83a4cbbf750a6ba3afc39583a6f69b339ce9086a171802c6e9
Instruction ID: 6d590b80bb768e07796c3ee843267a35dc710fd680e5240f081ec47d3f72320c
Opcode Fuzzy Hash: 217b6ca006fb3c83a4cbbf750a6ba3afc39583a6f69b339ce9086a171802c6e9
Instruction Fuzzy Hash: B6D01771A0030DFB8B40EFA8E910A9DB7B9EB45206B1081AA9509E3600EA316E009B90

Uniqueness

Uniqueness Score: -1.00%

Function 067AF8EA Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eae7b4f5cba76a95a5f9e44f8f2be4a759a2c37d6e8d50264269b9754e18ca3
Instruction ID: 3d56d7b3d8ceee54f5c6db15ac5789ab0368b051727ddceafe12650571c918a5
Opcode Fuzzy Hash: 7eae7b4f5cba76a95a5f9e44f8f2be4a759a2c37d6e8d50264269b9754e18ca3
Instruction Fuzzy Hash: 39C012327442311F028CB66CB41806D76D7D3CC9E339A803EE60EC3388DEA08C835780

Uniqueness

Uniqueness Score: -1.00%

Function 067A3721 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6471265e88a1f465d76a8e72b852a7f3be28561ebe3386334d83e3e789e39ac7
Instruction ID: eb9af7a9292902f3110ffbb496ed2306c009933d828dd7c3ed9eda5cfb878b3e
Opcode Fuzzy Hash: 6471265e88a1f465d76a8e72b852a7f3be28561ebe3386334d83e3e789e39ac7
Instruction Fuzzy Hash: B6C0127800A3807FC7024A205E01D927E272B82B00B0A0182B7828A0A386620A64D2B2

Uniqueness

Uniqueness Score: -1.00%

Function 067ADFD1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2208511822.00000000067A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_67a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93f717f1c7bcaf431b4be191a8a182b26f313ba46ff5dab1a8f7c53a71544084
Instruction ID: b3ff89fc39c9feb5d47ccc3aec3e866d4b9e03c486351247be0d416ea7bd4f5f
Opcode Fuzzy Hash: 93f717f1c7bcaf431b4be191a8a182b26f313ba46ff5dab1a8f7c53a71544084
Instruction Fuzzy Hash: 7EC04C3158F2E56EDB0246248C0D4453E159B5265571500DAA6418F4A2E6A144158695

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Users\user\AppData\Local\Temp\TmpDC02.tmp

C:\Users\user\AppData\Local\Temp\TmpDC13.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
file.exe

Function 008CA021 Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Function 008C010F Relevance: .0, Instructions: 12
COMMONLIBRARYCODE

Function 008C51EB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 008C009B Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 008C52B6 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Function 008B3D0A Relevance: 1.5, APIs: 1, Instructions: 30
memoryCOMMON

Function 008D1093 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147
COMMONLIBRARYCODE

Function 008B9628 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Function 008D04BA Relevance: 12.2, APIs: 8, Instructions: 248
COMMONLIBRARYCODE

Function 008CEDED Relevance: 9.3, APIs: 6, Instructions: 298
COMMON

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre