Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1445847
MD5:	fdc69e7726f37315f2f576a3ca749c48
SHA1:	44cb651c3be86b959e4e630e741189ad2c945c44
SHA256:	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955
Tags:	exe
Infos:

Detection

RedLine

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Yara detected RedLine Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for sample

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 3160 cmdline: "C:\Users\user\Desktop\file.exe" MD5: FDC69E7726F37315F2F576A3CA749C48)

RegAsm.exe (PID: 3320 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "5.42.65.115:40551", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.3320371970.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: file.exe PID: 3160	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 3320	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.4f0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "5.42.65.115:40551", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb source: RegAsm.exe, 00000002.00000002.3322128878.0000000005A9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb693405117-2476756634-1003_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32d source: RegAsm.exe, 00000002.00000002.3322128878.0000000005A9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.ServiceModel.pdb source: RegAsm.exe, 00000002.00000002.3320507999.0000000001187000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb8D source: RegAsm.exe, 00000002.00000002.3320801748.0000000001445000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb source: RegAsm.exe, 00000002.00000002.3320801748.0000000001445000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: RegAsm.exe, 00000002.00000002.3320801748.0000000001445000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: RegAsm.exe, 00000002.00000002.3322128878.0000000005A9A000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00504493 FindFirstFileExW,

0_2_00504493

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 5.42.65.115:40551

Source: global traffic

TCP traffic: 192.168.2.6:49699 -> 5.42.65.115:40551

Source: Joe Sandbox View

ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU

Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115

Source: RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24LR
Source: RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Responsex
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9LR
Source: RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Responsex
Source: file.exe, 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000002.00000002.3320371970.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp59F0.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp5A01.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00506AF8	0_2_00506AF8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00503560	0_2_00503560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0308DC74	2_2_0308DC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06B067D8	2_2_06B067D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06B0A3E8	2_2_06B0A3E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06B03F50	2_2_06B03F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06B0A3D8	2_2_06B0A3D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06B06FF8	2_2_06B06FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06B06FE8	2_2_06B06FE8

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 004F51D0 appears 48 times

Source: file.exe, 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenameChazan.exe8 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .data ZLIB complexity 0.9890334243527508

Source: classification engine

Classification label: mal96.troj.evad.winEXE@3/4@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Mutant created: NULL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\Tmp59F0.tmp

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.2.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb source: RegAsm.exe, 00000002.00000002.3322128878.0000000005A9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb693405117-2476756634-1003_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32d source: RegAsm.exe, 00000002.00000002.3322128878.0000000005A9A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.ServiceModel.pdb source: RegAsm.exe, 00000002.00000002.3320507999.0000000001187000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb8D source: RegAsm.exe, 00000002.00000002.3320801748.0000000001445000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb source: RegAsm.exe, 00000002.00000002.3320801748.0000000001445000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: RegAsm.exe, 00000002.00000002.3320801748.0000000001445000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: RegAsm.exe, 00000002.00000002.3322128878.0000000005A9A000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F4964 push ecx; ret	0_2_004F4977
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06B0C711 push es; ret	2_2_06B0C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06B0D413 push es; ret	2_2_06B0D420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06B0ECF2 push eax; ret	2_2_06B0ED01

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 3020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 32A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 30C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00504493 FindFirstFileExW,

0_2_00504493

Source: RegAsm.exe, 00000002.00000002.3322128878.0000000005AE3000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllP

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004F8F06 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_004F8F06

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FC35D mov ecx, dword ptr fs:[00000030h]		0_2_004FC35D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050560E mov eax, dword ptr fs:[00000030h]		0_2_0050560E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00507C0D GetProcessHeap,

0_2_00507C0D

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F5102 SetUnhandledExceptionFilter,	0_2_004F5102
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F5237 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004F5237
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F8F06 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004F8F06
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F4FA6 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004F4FA6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007F018D CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

0_2_007F018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: E2E008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004F4CCC cpuid

0_2_004F4CCC

Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00507047
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_004FF01F
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_005078DC
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_005079AB
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_005072E9
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00507334
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_005073CF
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0050745A
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_004FF545
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_005076AD
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_005077D6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004F4EA0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_004F4EA0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3320371970.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3320, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3320371970.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3320, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	33 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Install Root Certificate	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	HEUR/AGEN.1317026
file.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15LR	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Responsex	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7LR	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	0%	URL Reputation	safe
5.42.65.115:40551	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/actor/next	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id3LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id3Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2LR	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4Responsex	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Responsex	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
5.42.65.115:40551	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://tempuri.org/Entity/Id24LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13LR	RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id3LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	file.exe, 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000002.00000002.3320371970.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24Response	RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/	RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id3Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id4LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2LR	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm	RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage	RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/actor/next	RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id4Responsex	RegAsm.exe, 00000002.00000002.3321344042.000000000347D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.000000000342F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000033D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3321344042.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.42.65.115	unknown	Russian Federation		39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1445847
Start date and time:	2024-05-22 17:04:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal96.troj.evad.winEXE@3/4@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 83 Number of non-executed functions: 43
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
5.42.65.115	Pp8XG0Vz4D.exe	Get hash	malicious	GCleaner	Browse	5.42.65.115/advdlc.php
	mxsujj4FZz.exe	Get hash	malicious	GCleaner, RedLine	Browse	5.42.65.115/advdlc.php
	UzMahCzo58.exe	Get hash	malicious	LummaC, GCleaner, LummaC Stealer	Browse	5.42.65.115/advdlc.php
	hkXE3abs6j.exe	Get hash	malicious	GCleaner, RedLine	Browse	5.42.65.115/advdlc.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	2T6MGxlKZT.exe	Get hash	malicious	SmokeLoader	Browse	5.42.96.170
	file.exe	Get hash	malicious	Unknown	Browse	5.42.66.10
	http://0nline.jjwconstructlon.com	Get hash	malicious	HTMLPhisher	Browse	5.42.65.53
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.85
	https://url12.mailanyone.net/scanner?m=1s9PCz-0000cD-4j&d=4%7Cmail%2F90%2F1716296400%2F1s9PCz-0000cD-4j%7Cin12g%7C57e1b682%7C11949542%7C14589158%7C664C9C811D87B03FE2E6472997A0C22E&o=%2Fphtl%3A%2Fatsnhtaageeteoilogt.rgsigc%2Faz.&s=1YKQiaLIfHH0tTbjCAvEAnTGAIU	Get hash	malicious	HTMLPhisher	Browse	5.42.65.53
	https://url12.mailanyone.net/scanner?m=1s9PCz-0000cD-4j&d=4%7Cmail%2F90%2F1716296400%2F1s9PCz-0000cD-4j%7Cin12g%7C57e1b682%7C11949542%7C14589158%7C664C9C811D87B03FE2E6472997A0C22E&o=%2Fphtl%3A%2Fatsnhtaageeteoilogt.rgsigc%2Faz.&s=1YKQiaLIfHH0tTbjCAvEAnTGAIU	Get hash	malicious	HTMLPhisher	Browse	5.42.65.53
	https://url12.mailanyone.net/scanner?m=1s9PCz-0000cD-4j&d=4%7Cmail%2F90%2F1716296400%2F1s9PCz-0000cD-4j%7Cin12g%7C57e1b682%7C11949542%7C14589158%7C664C9C811D87B03FE2E6472997A0C22E&o=%2Fphtl%3A%2Fatsnhtaageeteoilogt.rgsigc%2Faz.&s=1YKQiaLIfHH0tTbjCAvEAnTGAIU	Get hash	malicious	HTMLPhisher	Browse	5.42.65.53
	file.exe	Get hash	malicious	RisePro Stealer	Browse	5.42.96.64
	8a180cbdd2a7a7b4f60d93c574bee9248b17d5c1cb782850441a41fd6db0727a_dump.exe	Get hash	malicious	RedLine	Browse	5.42.65.85
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.85

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 05:47:14 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.466670658720131
Encrypted:	false
SSDEEP:	48:8Sgd5TvG90lRYrnvPdAKRkdAGdAKRFdAKR6P:8SKby7
MD5:	9A99616405271EB0054FC2D643C1E318
SHA1:	01EE245CAFDEA8583ADBA3E6D9EADB39A1535CA6
SHA-256:	F715A19DFAE95A93D5E1311973B536EACA050F8EA4E564DFF1407093C1043745
SHA-512:	3D2DE7071BDA8B5ABD22E1546532A5C846F650F6B63AB5237B822CA3985439457DA6481400BFA8758DD8E3E01723B9B99822517B45365BF64A8B1BCCB51FD663
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,......`.W....X.&&... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.IEW.5....B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEW@2....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.2..Chrome..>......CW.VEW.2....M.....................7...C.h.r.o.m.e.....`.1.....EW.2..APPLIC~1..H......CW.VEW.2..........................7...A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.L .chrome.exe..F......CW.VEW.5.........................l...c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Temp\Tmp59F0.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp5A01.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	7.639756177727786
Encrypted:	false
SSDEEP:	48:S7SjQDUisflUXD96K3k/4HAose4h+E1NuC/+98j1Gm:ASUDnsmIsAoszNzS8j1r
MD5:	04A53B90991289CA4C58FEA4F98E43DA
SHA1:	5C42FA745B224DEACE90B5F8CB70DCCBDAE7E7CC
SHA-256:	D962E99CB275DFE701428CE0012FF544F65C388FA81E57A8B204F00DD824F00A
SHA-512:	2939621133D3361DFCA427E931540D87A0C81A9686272D62F4BD234DD74C16F783243D0E0169F991505B8364AA5DA8E36D3E7AD444793A1FFD9DF1FE78C60111
Malicious:	false
Reputation:	low
Preview:	........'...............P...............{41744BE4-11C5-494C-A213-BA0CE944938E}.....................RSA1..................v..XU~l2_.......vj....b.... ..&...X.Y...=q...).....`.1.0..~......5DL. ..S>.......<..y...?YOA.... eb.QD..B..<.!..'J..+.'...4fu.z./....]@.y.b...o...).j'......0}B.j..R..-..2.....'=...@....s....;. .v=..;...\$...G....2S....al.ZQ.Q...w...aXzW.....................z..O......5.1..hG._-Y."q....,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... ....-._.K./..~?.ZA.........s.................. ...}..T...C-.P9C...=w9.....m..X.'..P....,.....p..GSU.ul..aq.....:..@wi...GM.9.b,sU..X..SE.,.Yyg.=N.Q....=^..J..A....u...O.....W..v&v.=..m..[f1>t..[^..0*.p....l,...L.t#...w.-$.........\.f.x....!q.a.$.B...`O.....~..q0.2H.K.c...\..J1.MVxX{S.~.%.^.u..9C.Bq.. z.Wb..x..1-...V4...l.W...8...........<K...g.....(L.O...EJ;........8..V...b......-..#H......N.$.c.......u.u.7...l.G...>..-8"..Q.....t...(9..._0s....IR[.}.../.M....r).........\|.9.-.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.711083644811368
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	470'528 bytes
MD5:	fdc69e7726f37315f2f576a3ca749c48
SHA1:	44cb651c3be86b959e4e630e741189ad2c945c44
SHA256:	1692db4e522605d93551ddcabeffa92a2cd43e764a134833644808319784b955
SHA512:	de974aa0e7cb1393eefacbd90a87f2283af59004de217283b9dbba2c338935aa013ba738065747d2491248ca3d781ee7ede0044082a58da3fa21989e3431dc2f
SSDEEP:	12288:REY+q1cYutAScujVzQ/B02L4dj5w2TUTup:W6ScuJzI028dNNUKp
TLSH:	4BA4F150B4C08072DA72153208F4DAB5AE3EFD708E669AAF77550F7E4F30581DB21A6B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......jL$..-J,.-J,.-J,._I-"-J,._O-.-J,._N-;-J,._K---J,.-K,u-J,..N-<-J,..I-:-J,..O-`-J,..O-/-J,..H-/-J,Rich.-J,........PE..L.....Mf...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40490e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x664DEC0B [Wed May 22 12:58:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f9531947707a40ed7d1e9b9b8bfcbdb8

Entrypoint Preview

Instruction
call 00007F8398B32B2Fh
jmp 00007F8398B323C9h
push ebp
mov ebp, esp
jmp 00007F8398B3255Fh
push dword ptr [ebp+08h]
call 00007F8398B3B885h
pop ecx
test eax, eax
je 00007F8398B32561h
push dword ptr [ebp+08h]
call 00007F8398B3854Eh
pop ecx
test eax, eax
je 00007F8398B32538h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007F8398B2F9F4h
jmp 00007F8398B32E22h
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F8398B32E34h
pop ecx
pop ebp
ret
cmp ecx, dword ptr [00473500h]
jne 00007F8398B32553h
ret
jmp 00007F8398B32E50h
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F8398B32529h
jmp 00007F8398B32532h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00473500h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00473500h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25a1c	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x76000	0x1954	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x24048	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x23f88	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1d000	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1a59f	0x1a600	f09877de99aa60c1a877d34417309b01	False	0.5830031842417062	data	6.602101640381143	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.BSS	0x1c000	0x31b	0x400	bc94bcce2d8eb19fefac8aebd3b30246	False	0.6650390625	data	5.4866235669189685	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1d000	0x914e	0x9200	6827ac391127c6dcfe7961ef8c64b104	False	0.3927119006849315	data	4.70806870293617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x27000	0x4e214	0x4d400	cdc41cbbc03b7ace1cc781e8b4ae8e15	False	0.9890334243527508	data	7.991764691270708	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x76000	0x1954	0x1a00	e018dc832bba26f2a74757b6af913349	False	0.7543569711538461	data	6.483056637438508	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

WaitForSingleObject, CreateThread, VirtualAlloc, GetModuleHandleA, GetProcAddress, EncodePointer, DecodePointer, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, MultiByteToWideChar, WideCharToMultiByte, LCMapStringEx, GetStringTypeW, GetCPInfo, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetModuleHandleW, GetCurrentProcess, TerminateProcess, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetProcessHeap, HeapSize, WriteConsoleW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 22, 2024 17:04:57.812869072 CEST	49699	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:04:57.818461895 CEST	40551	49699	5.42.65.115	192.168.2.6
May 22, 2024 17:04:57.818551064 CEST	49699	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:04:57.826517105 CEST	49699	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:04:57.843486071 CEST	40551	49699	5.42.65.115	192.168.2.6
May 22, 2024 17:05:19.274852991 CEST	40551	49699	5.42.65.115	192.168.2.6
May 22, 2024 17:05:19.274940968 CEST	49699	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:05:19.407730103 CEST	49699	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:05:24.440880060 CEST	49706	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:05:24.450691938 CEST	40551	49706	5.42.65.115	192.168.2.6
May 22, 2024 17:05:24.450807095 CEST	49706	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:05:24.451071024 CEST	49706	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:05:24.520884991 CEST	40551	49706	5.42.65.115	192.168.2.6
May 22, 2024 17:05:45.906613111 CEST	40551	49706	5.42.65.115	192.168.2.6
May 22, 2024 17:05:45.906882048 CEST	49706	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:05:46.127964020 CEST	49706	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:05:51.143182993 CEST	49707	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:05:51.154364109 CEST	40551	49707	5.42.65.115	192.168.2.6
May 22, 2024 17:05:51.154583931 CEST	49707	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:05:51.154743910 CEST	49707	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:05:51.212476969 CEST	40551	49707	5.42.65.115	192.168.2.6
May 22, 2024 17:06:12.634043932 CEST	40551	49707	5.42.65.115	192.168.2.6
May 22, 2024 17:06:12.634325027 CEST	49707	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:06:12.634466887 CEST	49707	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:06:17.644033909 CEST	49709	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:06:17.649137974 CEST	40551	49709	5.42.65.115	192.168.2.6
May 22, 2024 17:06:17.649404049 CEST	49709	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:06:17.649651051 CEST	49709	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:06:17.702686071 CEST	40551	49709	5.42.65.115	192.168.2.6
May 22, 2024 17:06:39.040483952 CEST	40551	49709	5.42.65.115	192.168.2.6
May 22, 2024 17:06:39.040663958 CEST	49709	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:06:39.041047096 CEST	49709	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:06:44.049303055 CEST	49710	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:06:44.054541111 CEST	40551	49710	5.42.65.115	192.168.2.6
May 22, 2024 17:06:44.054671049 CEST	49710	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:06:44.054928064 CEST	49710	40551	192.168.2.6	5.42.65.115
May 22, 2024 17:06:44.106388092 CEST	40551	49710	5.42.65.115	192.168.2.6

Target ID:	0
Start time:	11:04:55
Start date:	22/05/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x4f0000
File size:	470'528 bytes
MD5 hash:	FDC69E7726F37315F2F576A3CA749C48
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:04:55
Start date:	22/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xde0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.3320371970.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.6%
Total number of Nodes:	1543
Total number of Limit Nodes:	18

Executed Functions

Function 007F018D Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 007F02FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 007F030F
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 007F032D
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 007F0351
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 007F037C
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 007F03D4
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 007F041F
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 007F045D
Wow64SetThreadContext.KERNEL32(?,?), ref: 007F0499
ResumeThread.KERNELBASE(?), ref: 007F04A8

Strings

Load, xrefs: 007F01CB
ress, xrefs: 007F0217
GetP, xrefs: 007F020F
aryA, xrefs: 007F01D3

Memory Dump Source

Source File: 00000000.00000002.2066730426.00000000007F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: GetP$Load$aryA$ress
API String ID: 2687962208-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: c3292326410d98d99da4159f2e3343151b0f0e2a3e7f144517251735dfe2070f
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 0DB1D77664024AAFDB60CF68CC80BDA77A5FF88714F158524EA0CEB341D774FA518B94

Function 0050560E Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3a586ec2da16d7fd3ee7ee03ae3402aab8ac5a3c6cbba84838bbe677f8115f
Instruction ID: 457176f6b862a6dca86e38a374ba997a1a31c23065881844d2c083669c61672d
Opcode Fuzzy Hash: 6d3a586ec2da16d7fd3ee7ee03ae3402aab8ac5a3c6cbba84838bbe677f8115f
Instruction Fuzzy Hash: 18E08C72911238EBCB25DBC9C908D8AF7ECFB44B04B5100AAF601D3140D271DE00DBD0

Function 004FC35D Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c992419eee8842309e7582ba631cfc6caef1f6ffe052a819ae54955aa5ef9da
Instruction ID: d392dbeb603afc2da91a9cd38266ab2d236367fb4b059821f0f7262894e0f429
Opcode Fuzzy Hash: 4c992419eee8842309e7582ba631cfc6caef1f6ffe052a819ae54955aa5ef9da
Instruction Fuzzy Hash: B6C08C3408090847CF29891893B13BF3358BBD77C2F80188ECA030BBA2C91F9C82DA08

Function 004FF1E8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,BA3E30E8,?,004FF2F5,?,?,00000000,00000000), ref: 004FF2A9

Strings

ext-ms-, xrefs: 004FF253
api-ms-, xrefs: 004FF23F

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: c22f636b4897fc055c631b89c526c9f985c52247673f7f1c42b3650b3cd6d985
Instruction ID: 9a039257622880cae863299a60f9b623eae4b3e8706e463a027e364d64e4fe34
Opcode Fuzzy Hash: c22f636b4897fc055c631b89c526c9f985c52247673f7f1c42b3650b3cd6d985
Instruction Fuzzy Hash: 2D2160359001189BDB315B65EC44A7F3768BF11760F220172FA15A33D0D779ED09D6E5

Function 00502C21 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00502CA8
__alloca_probe_16.LIBCMT ref: 00502D69
__freea.LIBCMT ref: 00502DD0

Part of subcall function 00502001: HeapAlloc.KERNEL32(00000000,004F21BA,?,?,004F5A1A,?,?,?,00000000,?,004F19F6,004F21BA,?,?,?,?), ref: 00502033

__freea.LIBCMT ref: 00502DE5
__freea.LIBCMT ref: 00502DF5

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 44dd3ccea7792dfb05ef162d853585b4430bcb78056f8ccdd787e4fc05245412
Instruction ID: 02a327a856717d68290b297927f07722e1a2c7dca6edde95faeb584752a34197
Opcode Fuzzy Hash: 44dd3ccea7792dfb05ef162d853585b4430bcb78056f8ccdd787e4fc05245412
Instruction Fuzzy Hash: 8B51DE7260021AAFEF259F61CC8AEBF3EA9FF44314F150129FD08D6180EA34CC51D6A4

Function 0050C20E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38
memorysynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040,ole,00000000,?,00564398,0050C302), ref: 0050C222

Part of subcall function 0050C168: _Deallocate.LIBCONCRT ref: 0050C203

CreateThread.KERNELBASE(00000000,00000000,00000188,00517018,00000000,00000000), ref: 0050C256
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0050C25F

Strings

ole, xrefs: 0050C211

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: AllocCreateDeallocateObjectSingleThreadVirtualWait
String ID: ole
API String ID: 53083093-1213916275
Opcode ID: 3d6131ee016f423b2ee6f933ff392ff49b3e7e61a8a0b44dcf9ce86fad7d201e
Instruction ID: cd2a2e4127f68da54de948cf93d2dd82a7237b2cce4e97489fd4a68b91e3debb
Opcode Fuzzy Hash: 3d6131ee016f423b2ee6f933ff392ff49b3e7e61a8a0b44dcf9ce86fad7d201e
Instruction Fuzzy Hash: A3F065B224020C3BE11023A6DC4DFAF3E2CEB877BAF410115B709910C2A91659059675

Function 004FC2E9 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,004FC2E3,00000000,004F8F02,?,?,BA3E30E8,004F8F02,?), ref: 004FC2FA
TerminateProcess.KERNEL32(00000000,?,004FC2E3,00000000,004F8F02,?,?,BA3E30E8,004F8F02,?), ref: 004FC301
ExitProcess.KERNEL32 ref: 004FC313

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f01cbfe1aab1ea5a3f40386b2326edaea2f0d4cc6977a4eb875e72729cb6795e
Instruction ID: 60011b959e11badd6908ec172ab66e5d08e1b159835fac0f9e9a15091b3dc059
Opcode Fuzzy Hash: f01cbfe1aab1ea5a3f40386b2326edaea2f0d4cc6977a4eb875e72729cb6795e
Instruction Fuzzy Hash: 79D09E3200410CAFCF012FA1DE5D96D3F36BF55395F048415BE4D4A131DB369957AAA4

Function 00504F3F Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00504A6F: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 00504A9A

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00504D86,?,00000000,?,00000000,?), ref: 00504FA0
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00504D86,?,00000000,?,00000000,?), ref: 00504FE2

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 6e7f67127ed106060668e3151512be07908a97599aa2ed0845e1bd40c80b21c6
Instruction ID: 114d254298fd12daf329feb7d96abdeed692e53cf707c56e516eb6937304f0d7
Opcode Fuzzy Hash: 6e7f67127ed106060668e3151512be07908a97599aa2ed0845e1bd40c80b21c6
Instruction Fuzzy Hash: E4511370A00A469EDB20CF35C8A96AFBFF5FF90304F18856ED1868B291F6759945CF90

Function 004FF682 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00502D0F,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 004FF6B6
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00502D0F,?,?,00000000,?,00000000), ref: 004FF6D4

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 5a8937ec1466a9da03333e7cebcdb164c99683de337cb715cc8f71c0904f0796
Instruction ID: aa6f7c39c65051cf642d63492ab59cf7b64bd8b46f480b2e55c62314e64aca6f
Opcode Fuzzy Hash: 5a8937ec1466a9da03333e7cebcdb164c99683de337cb715cc8f71c0904f0796
Instruction Fuzzy Hash: 85F0683200011EBBCF125F91DC059EE3F66BF583A0F058025FF1965130CA36C836AB98

Function 00504B43 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00504D92,00504D86,00000000), ref: 00504B75

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 3be3abc91bc9d750bba0e685f3c2b29550bc2fa0f4d56053eeec3e29a9fa1214
Instruction ID: f872728253436cb064ff6fe8dd7d3cb741bc276e6f0f86d9c516df824f50f131
Opcode Fuzzy Hash: 3be3abc91bc9d750bba0e685f3c2b29550bc2fa0f4d56053eeec3e29a9fa1214
Instruction Fuzzy Hash: 3E5127B16041589AEB218A28CD84BEA7FBCFB55304F2405E9D69AD71C2D371AD46DF20

Function 004FF2B3 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08af84cc5b45642dbdd1f88855036f6269d94d5c8f58c3ccc64c1d161604de92
Instruction ID: a562d82e7e1541c33bfb469a1e63c4af8296dad36866a02f9ce4a7d0900523ee
Opcode Fuzzy Hash: 08af84cc5b45642dbdd1f88855036f6269d94d5c8f58c3ccc64c1d161604de92
Instruction Fuzzy Hash: EB01F5376002199F9B15CE6EEC4096B3796BF913207244136FA05CB154EB35DC0A9799

Non-executed Functions

Function 005077D6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00507AF4,00000002,00000000,?,?,?,00507AF4,?,00000000), ref: 0050786F
GetLocaleInfoW.KERNEL32(?,20001004,00507AF4,00000002,00000000,?,?,?,00507AF4,?,00000000), ref: 00507898
GetACP.KERNEL32(?,?,00507AF4,?,00000000), ref: 005078AD

Strings

OCP, xrefs: 0050782A
ACP, xrefs: 005077F4

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: b1d4dbd06f7deb4c8b128182a7e902d8428f3c51013b9167134f8c774116cdf7
Instruction ID: da7c6b8be64e341c08bfa70ee1ff8711c6ae4f327ca7866e9fedb24c6b73c580
Opcode Fuzzy Hash: b1d4dbd06f7deb4c8b128182a7e902d8428f3c51013b9167134f8c774116cdf7
Instruction Fuzzy Hash: 7D21B832E08109AAEB348B94C909B9F7AA7FF58B54F56C464E90AD7190F731FD42C390

Function 005079AB Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004FEC90: GetLastError.KERNEL32(?,00000008,00503196,00000000,004F9083), ref: 004FEC94
Part of subcall function 004FEC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 004FED36

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00507AB7
IsValidCodePage.KERNEL32(00000000), ref: 00507B00
IsValidLocale.KERNEL32(?,00000001), ref: 00507B0F
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00507B57
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00507B76

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: be44929416d5f04c8565af01eb7569598fedd4d9ee530171cb2a7b39416c0108
Instruction ID: 859ea4bd3ba2a6ef82a0c82ecc3e5177d32e28d01c1fb450fdffe9ab4450e4ad
Opcode Fuzzy Hash: be44929416d5f04c8565af01eb7569598fedd4d9ee530171cb2a7b39416c0108
Instruction Fuzzy Hash: 54517071E0420EAFEB10DFA5CC45ABE7BB8FF48700F184469E905E71D1EB70AA448B61

Function 00507047 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004FEC90: GetLastError.KERNEL32(?,00000008,00503196,00000000,004F9083), ref: 004FEC94
Part of subcall function 004FEC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 004FED36

GetACP.KERNEL32(?,?,?,?,?,?,004FCC9C,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00507108
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,004FCC9C,?,?,?,00000055,?,-00000050,?,?), ref: 00507133
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00507296

Strings

utf8, xrefs: 00507205

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 918271f2fece0a57636f1fb447d587e7ae97b507cd3b175c041b9e4f1de3e084
Instruction ID: 886853c6dae00a6921bb0396df2b92d173651afd2c0cae73c80bf545ff5cbc81
Opcode Fuzzy Hash: 918271f2fece0a57636f1fb447d587e7ae97b507cd3b175c041b9e4f1de3e084
Instruction Fuzzy Hash: 77710575E0420BAAEB24AB75DC4ABAF7BA8FF48700F14442AF905D71C1EB70F951C660

Function 004F4FA6 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 004F4FB2
IsDebuggerPresent.KERNEL32 ref: 004F507E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004F5097
UnhandledExceptionFilter.KERNEL32(?), ref: 004F50A1

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: dfc7447d7c5bdb9efdfb52899589ecb8388371d4fcf98888ffa4ac0c14593995
Instruction ID: e9e54b8516a4ea5454da1ecefb9f90eb9a3fa595da12fd59737ecb6a7e7ba783
Opcode Fuzzy Hash: dfc7447d7c5bdb9efdfb52899589ecb8388371d4fcf98888ffa4ac0c14593995
Instruction Fuzzy Hash: 7C311875C0131CDBDB20DFA5D9897CEBBB8AF08300F1041AAE60CAB250EB759A85CF55

Function 0050745A Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 004FEC90: GetLastError.KERNEL32(?,00000008,00503196,00000000,004F9083), ref: 004FEC94
Part of subcall function 004FEC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 004FED36

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005074AE
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005074F8
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005075BE

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 7148415d9d663870ae33a4a14a010099fc512adfecdbd8d0eb5f7852b46e2d2b
Instruction ID: 7e638093166cf3dec783486c2a56a16002912023e922f457d16633b326915bf4
Opcode Fuzzy Hash: 7148415d9d663870ae33a4a14a010099fc512adfecdbd8d0eb5f7852b46e2d2b
Instruction Fuzzy Hash: A8617E7191861B9FDB289F28CD86BBE7BA8FF08300F14417AE91AC61C5E735E945CB50

Function 004F8F06 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 004F8FFE
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 004F9008
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 004F9015

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 3b487fa43306516005a0510b469576e1d4c5b2d617c7198c117cbe316e1cffe9
Instruction ID: 3fc2769fcce0d59578a636b071977c846db05f8d00b7c1139d3a5a5e91d71841
Opcode Fuzzy Hash: 3b487fa43306516005a0510b469576e1d4c5b2d617c7198c117cbe316e1cffe9
Instruction Fuzzy Hash: DF31E57490121D9BCB21DF69D888B9DBBB4BF18310F5041DAE51CA7250EB749F858F58

Function 00503560 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,0050355B,?,?,?,?,?,?,00000000), ref: 0050378D

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 647737eaec63c51f0c3294b394ceff0c1a1b582f63a1f42f7c90074564498ad4
Instruction ID: cb2be053cfba56be33581831ac5841d27978353c519df900fe942e31445c1019
Opcode Fuzzy Hash: 647737eaec63c51f0c3294b394ceff0c1a1b582f63a1f42f7c90074564498ad4
Instruction Fuzzy Hash: 0FB12B71610604DFD714CF28C48AA697FA4FF45364F258698E89ACF2E1C736EA91CB40

Function 004F4CCC Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 004F4CE2

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 1911d80d1635b9def53eac114e98a50673aa189a1db1c1d0c6f3cd3e0fd14771
Instruction ID: 4049cf249c8070f80a284b45d9150c737be77e80da6c8f9e7eea955f72c15e2d
Opcode Fuzzy Hash: 1911d80d1635b9def53eac114e98a50673aa189a1db1c1d0c6f3cd3e0fd14771
Instruction Fuzzy Hash: C0517AB1A002198FDB15CF99D8817ABBBF0FB98324F24842AD501EB390D7B8A944CF54

Function 00504493 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a9e813ece3878ed484c78183ef408a033016769081b15d1458e0b8a2f8ca2e
Instruction ID: 18c175a1756d82018187bcd497655981c3b22b563fb4e0b5a49f52f0841ad2db
Opcode Fuzzy Hash: 90a9e813ece3878ed484c78183ef408a033016769081b15d1458e0b8a2f8ca2e
Instruction Fuzzy Hash: 524190B5804219AFDF20DF69CC89AAEBBB9FF85304F1442D9E518D3241DA359E848F60

Function 005076AD Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 004FEC90: GetLastError.KERNEL32(?,00000008,00503196,00000000,004F9083), ref: 004FEC94
Part of subcall function 004FEC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 004FED36

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00507701

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 1ae6b9c683fa73bf96c07ab1968641a1a1d915bdee3599854d794deb0b917826
Instruction ID: bad776ff36dc9734d2a08a4b4d03abb7e88df4958ba8105ad25c8b346ff425de
Opcode Fuzzy Hash: 1ae6b9c683fa73bf96c07ab1968641a1a1d915bdee3599854d794deb0b917826
Instruction Fuzzy Hash: A321B331A0820AABDB189B29DD46A7E3BA8FF48359F10407AF905C7281EB74ED44C794

Function 00507334 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004FEC90: GetLastError.KERNEL32(?,00000008,00503196,00000000,004F9083), ref: 004FEC94
Part of subcall function 004FEC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 004FED36

EnumSystemLocalesW.KERNEL32(0050745A,00000001,00000000,?,-00000050,?,00507A8B,00000000,?,?,?,00000055,?), ref: 005073A6

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e97e0bb86fff36e522beedf7b796b9693afd33a86229f3eebf98ee7d549e379b
Instruction ID: ed8ee9c19fdabdf7a23b99ffeb78d62de4b57ebe0fe64006b419f20988c49c28
Opcode Fuzzy Hash: e97e0bb86fff36e522beedf7b796b9693afd33a86229f3eebf98ee7d549e379b
Instruction Fuzzy Hash: 7B11293A6047095FEB189F39C8A15BEBF91FF84318B15882DE94647A80E371B803D740

Function 005078DC Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 004FEC90: GetLastError.KERNEL32(?,00000008,00503196,00000000,004F9083), ref: 004FEC94
Part of subcall function 004FEC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 004FED36

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00507676,00000000,00000000,?), ref: 00507908

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 37c87eed7f66dff18ff424788c9159d1328a25bc60b112c2ec5d27049c7250d1
Instruction ID: dc31be004201554f9be71aaa6ffcc1c69716c31bf747114a93ebf364d780d54e
Opcode Fuzzy Hash: 37c87eed7f66dff18ff424788c9159d1328a25bc60b112c2ec5d27049c7250d1
Instruction Fuzzy Hash: 4CF0F936D041196BDB245A25C809BBF7F65FB44764F154C29ED06A31C0EA34FD02C5D0

Function 005073CF Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004FEC90: GetLastError.KERNEL32(?,00000008,00503196,00000000,004F9083), ref: 004FEC94
Part of subcall function 004FEC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 004FED36

EnumSystemLocalesW.KERNEL32(005076AD,00000001,00000000,?,-00000050,?,00507A4F,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00507419

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 65b03ffa0f607a7775127696bed279f53e9e16837bcfc6c73528b135a4fc373d
Instruction ID: df395defd39352bdc6e201787219cf120c17d66f46faf5da50da4d5eb1f7aead
Opcode Fuzzy Hash: 65b03ffa0f607a7775127696bed279f53e9e16837bcfc6c73528b135a4fc373d
Instruction Fuzzy Hash: F0F022366043085FDB245F399885A7E7F91FB84328F15842DFA058B6C0D671BC02C750

Function 004FF01F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004FA8B5: EnterCriticalSection.KERNEL32(?,?,004FE968,?,00515780,00000008,004FEB2C,?,?,?), ref: 004FA8C4

EnumSystemLocalesW.KERNEL32(004FF012,00000001,00515800,0000000C,004FF441,00000000), ref: 004FF057

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: d6aed7e50f102d0478507b5055a999de820327c5c25a0958a33a9cbac685d388
Instruction ID: 720d54bd44555f8360c4ba93915c7c6826285089f2384bb7fbab0f46041a0740
Opcode Fuzzy Hash: d6aed7e50f102d0478507b5055a999de820327c5c25a0958a33a9cbac685d388
Instruction Fuzzy Hash: 3EF03C72A00204DFD700EF98E842BAC7BB0FB58725F10402BE515972A1DBB959459F55

Function 005072E9 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004FEC90: GetLastError.KERNEL32(?,00000008,00503196,00000000,004F9083), ref: 004FEC94
Part of subcall function 004FEC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 004FED36

EnumSystemLocalesW.KERNEL32(00507242,00000001,00000000,?,?,00507AAD,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00507320

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0da9475d7271b8c2dbee0413b626b8c67c3a987a4ebff1076c1da1d2802c92b5
Instruction ID: 79ad5f6a1b2d522fb4b7b1148ac6ef13ca102615d40450bf5a5e5757967343d0
Opcode Fuzzy Hash: 0da9475d7271b8c2dbee0413b626b8c67c3a987a4ebff1076c1da1d2802c92b5
Instruction Fuzzy Hash: 57F0553A70020997CB149F3AC80666EBF90FFC5710B074059FE098B290C631A843C7A0

Function 004FF545 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,004FD804,?,20001004,00000000,00000002,?,?,004FCE04), ref: 004FF579

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 87ea63e5fd940c65825293f9526bfbe35116fc772f8e89c0e1dc46e5118f85d2
Instruction ID: f2773052205015cbec361b7e3a1a7cd930c28a9d628819a6dd48c1fefc010c43
Opcode Fuzzy Hash: 87ea63e5fd940c65825293f9526bfbe35116fc772f8e89c0e1dc46e5118f85d2
Instruction Fuzzy Hash: 07E04F3250052CBBCF126F61DC04ABE7F26EF54750F044026FE0966221CB758D26AAE9

Function 004F5102 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000510E,004F477F), ref: 004F5107

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c1163a237d8932ea4615f05030e28c9e064c8a56059cfab5bc46b2ce975080ab
Instruction ID: b66c968bfc0d500c9bba950305c03b7c13c412d071d3d52e66f50919b62cfe97
Opcode Fuzzy Hash: c1163a237d8932ea4615f05030e28c9e064c8a56059cfab5bc46b2ce975080ab
Instruction Fuzzy Hash:

Function 00507C0D Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00507C0D

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 97270f15a8ee25aa7ca400d4d628e52ff6762b0e65fad048b5bc34f45a6b6a64
Instruction ID: d209848b7740d64ed087e80ff64801f42163b171e98ddabb8276f9bff2b42c92
Opcode Fuzzy Hash: 97270f15a8ee25aa7ca400d4d628e52ff6762b0e65fad048b5bc34f45a6b6a64
Instruction Fuzzy Hash: F6A00170A526018B97508F79AB0934D3AE9AA6A691B05806AA885CA160EAB48558EA11

Function 00506AF8 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 9b50ea3ff1460adefba6b460dd3867fc53c8922e6908a79ef20028ab1b7d32e2
Instruction ID: 432dc49fd3bcb776513a06c9b7a9e2b99ec9086fbb40bc1a40bee9de8b3a5f4b
Opcode Fuzzy Hash: 9b50ea3ff1460adefba6b460dd3867fc53c8922e6908a79ef20028ab1b7d32e2
Instruction Fuzzy Hash: 9FB139756007069BDB34AF25CC92ABFBBE9FF44308F14486DEA83C65C0EA75A955CB00

Function 0050C26A Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 004F116F: __EH_prolog3_catch.LIBCMT ref: 004F1176
Part of subcall function 004F116F: _strlen.LIBCMT ref: 004F1188

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0050C294

Part of subcall function 004F1852: _strlen.LIBCMT ref: 004F186A

_strlen.LIBCMT ref: 0050C2AF
_strlen.LIBCMT ref: 0050C2C5
GetProcAddress.KERNEL32(00000000,?), ref: 0050C2E2

Part of subcall function 0050C20E: VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040,ole,00000000,?,00564398,0050C302), ref: 0050C222
Part of subcall function 0050C20E: CreateThread.KERNELBASE(00000000,00000000,00000188,00517018,00000000,00000000), ref: 0050C256
Part of subcall function 0050C20E: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0050C25F

Part of subcall function 004F1DFE: _Deallocate.LIBCONCRT ref: 004F1E0D

Strings

Write command.For help write '5'Don't TRY TO WRITE WORDS!!!ONLY NUMBERS!!!Like:help and other...root@calculator-unstable:~# , xrefs: 0050C2F0
Cons, xrefs: 0050C2A9, 0050C2AE, 0050C2B6
Madino Mino, xrefs: 0050C27D
ole, xrefs: 0050C2BF, 0050C2C4, 0050C2CC
kernel32.dll, xrefs: 0050C28F
Free, xrefs: 0050C29A

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: _strlen$AddressAllocCreateDeallocateH_prolog3_catchHandleModuleObjectProcSingleThreadVirtualWait
String ID: Cons$Free$Madino Mino$Write command.For help write '5'Don't TRY TO WRITE WORDS!!!ONLY NUMBERS!!!Like:help and other...root@calculator-unstable:~# $kernel32.dll$ole
API String ID: 748853668-4266058140
Opcode ID: c0828fa02f06e1aba496a7102d546c764b01aa039468bd45c1cdfd966d2f4bc8
Instruction ID: bf34c37db23bdbd0e555e0f364e17bfd5c05f3d8d70c87fae12777410d10fe54
Opcode Fuzzy Hash: c0828fa02f06e1aba496a7102d546c764b01aa039468bd45c1cdfd966d2f4bc8
Instruction Fuzzy Hash: 19119471A0020DAAD704EBA6EC46CFF7BB8EF54714710042EF516E2191EE689D05C629

Function 004F7E18 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 004F7F37
___TypeMatch.LIBVCRUNTIME ref: 004F8045
_UnwindNestedFrames.LIBCMT ref: 004F8197
CallUnexpected.LIBVCRUNTIME ref: 004F81B2

Strings

`P, xrefs: 004F7F2E
csm, xrefs: 004F7EC2
csm, xrefs: 004F7E55
csm, xrefs: 004F7F6E

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: `P$csm$csm$csm
API String ID: 2751267872-3795834809
Opcode ID: 4a999b314fd4f74fadfb13d19edecd70219dad521d3ddad4edc8a4d861c9a635
Instruction ID: 97cda5002b587290c46285710285deafb3a4e65aa42a34958a67182ce85f9208
Opcode Fuzzy Hash: 4a999b314fd4f74fadfb13d19edecd70219dad521d3ddad4edc8a4d861c9a635
Instruction Fuzzy Hash: 63B1543180020DAFCF24DFA5C9819BEBBB5BF14314B15455FEA046B212DB38DA62CB99

Function 004F2307 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004F230E
std::_Lockit::_Lockit.LIBCPMT ref: 004F2318
int.LIBCPMT ref: 004F232F

Part of subcall function 004F2867: std::_Lockit::_Lockit.LIBCPMT ref: 004F2878
Part of subcall function 004F2867: std::_Lockit::~_Lockit.LIBCPMT ref: 004F2892

codecvt.LIBCPMT ref: 004F2352
std::_Facet_Register.LIBCPMT ref: 004F2369
std::_Lockit::~_Lockit.LIBCPMT ref: 004F2389
Concurrency::cancel_current_task.LIBCPMT ref: 004F2396

Strings

@DV, xrefs: 004F2323

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID: @DV
API String ID: 2133458128-2579900946
Opcode ID: 541119a71de5c1b98a98b202afd23e63331684d9c7fbc2a7f176eb45cd975c81
Instruction ID: 8a9e85215f761b2745b657775e7768c9bb5eb75a409b2e54705e9310c85a546c
Opcode Fuzzy Hash: 541119a71de5c1b98a98b202afd23e63331684d9c7fbc2a7f176eb45cd975c81
Instruction Fuzzy Hash: D101C47690015D8BCF05EB65D902ABE7BB1BF94318F14050EEA106B391DFBC9E05CB99

Function 004F239C Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004F23A3
std::_Lockit::_Lockit.LIBCPMT ref: 004F23AD
int.LIBCPMT ref: 004F23C4

Part of subcall function 004F2867: std::_Lockit::_Lockit.LIBCPMT ref: 004F2878
Part of subcall function 004F2867: std::_Lockit::~_Lockit.LIBCPMT ref: 004F2892

ctype.LIBCPMT ref: 004F23E7
std::_Facet_Register.LIBCPMT ref: 004F23FE
std::_Lockit::~_Lockit.LIBCPMT ref: 004F241E
Concurrency::cancel_current_task.LIBCPMT ref: 004F242B

Strings

EV, xrefs: 004F23B8

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registerctype
String ID: EV
API String ID: 2958136301-3946306333
Opcode ID: 1b552e3358fbee155e91e99ca5ae32e4015480509ce4843422fbff3959bfd5a8
Instruction ID: fa6b02db89d363c223b6e87fd332fe87ef97489646e751e09e9d5b7b0fa2d557
Opcode Fuzzy Hash: 1b552e3358fbee155e91e99ca5ae32e4015480509ce4843422fbff3959bfd5a8
Instruction Fuzzy Hash: 5701C47190011D8BCB05EBA5C951ABE7B71EF94714F14050EEA017B381DFB89E05CB99

Function 0050187C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00501AF5

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: d9c668e124d1ea135434c0405149b95e4e909f51ad98b0ff4be351b501cae67a
Instruction ID: 95755f232213328c2e8f9d229f8862923d936c5054024f11b987749d46ccafeb
Opcode Fuzzy Hash: d9c668e124d1ea135434c0405149b95e4e909f51ad98b0ff4be351b501cae67a
Instruction Fuzzy Hash: B4B12570A04A49AFDB11CF99C880BBDBFB5FF46304F148159E901AB2D1DB709D41CBAA

Function 00509AF9 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00E205D8,00E205D8,?,7FFFFFFF,?,00509DC9,00E205D8,00E205D8,?,00E205D8,?,?,?,?,00E205D8,?), ref: 00509B9F
__alloca_probe_16.LIBCMT ref: 00509C5A
__alloca_probe_16.LIBCMT ref: 00509CE9
__freea.LIBCMT ref: 00509D34
__freea.LIBCMT ref: 00509D3A
__freea.LIBCMT ref: 00509D70
__freea.LIBCMT ref: 00509D76
__freea.LIBCMT ref: 00509D86

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 719e329fded01a49845c06b6d3720846567663e9c8daf42377e9752180a51fbd
Instruction ID: 4e1cc906184e03cf4d086f8b3fa35b6c0cb1245472f2c660f58b5f089c68a5af
Opcode Fuzzy Hash: 719e329fded01a49845c06b6d3720846567663e9c8daf42377e9752180a51fbd
Instruction Fuzzy Hash: 4271F47294420AABEF219F64DC41BEF7FB9BF85310F280059E904AB2C7E635DC4087A4

Function 004F44DD Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 004F4526
__alloca_probe_16.LIBCMT ref: 004F4552
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 004F4591
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004F45AE
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 004F45ED
__alloca_probe_16.LIBCMT ref: 004F460A
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004F464C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 004F466F

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 3f4515e8c883fd44bcd0667d907c3b1bee32cb62f9b601d93f90fdbeb085eb75
Instruction ID: 43732f8de1308bbef04a4b944c5e6fbc27b50d69e257a88c5b73adee269ee99c
Opcode Fuzzy Hash: 3f4515e8c883fd44bcd0667d907c3b1bee32cb62f9b601d93f90fdbeb085eb75
Instruction Fuzzy Hash: 7751BF7250020EABEB209FA1CC44FBB3BB9EF85754F15452AFB05D6290DB788C118B68

Function 004F78B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 004F78E7
___except_validate_context_record.LIBVCRUNTIME ref: 004F78EF
_ValidateLocalCookies.LIBCMT ref: 004F7978
__IsNonwritableInCurrentImage.LIBCMT ref: 004F79A3
_ValidateLocalCookies.LIBCMT ref: 004F79F8

Strings

csm, xrefs: 004F798D

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 1802eb20950b812d2bd7bda472e591824fadefed72e8b7d47abc2f0167b5b6f9
Instruction ID: 16b3fa85c605300022714d99256952615aac71ccacdffdde9e72fe6e3ce11456
Opcode Fuzzy Hash: 1802eb20950b812d2bd7bda472e591824fadefed72e8b7d47abc2f0167b5b6f9
Instruction Fuzzy Hash: 0141E170A0420D9BCF00DF69C885ABEBFB4EF45324F14819BEA159B392D77D9A11CB94

Function 004F7AAA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,004F7AA1,004F6070,004F5152), ref: 004F7AB8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004F7AC6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004F7ADF
SetLastError.KERNEL32(00000000,004F7AA1,004F6070,004F5152), ref: 004F7B31

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 107afd333ea7d2a8df809abef2daadb012bfdb541292ef0d3a4cbc38183e5ecb
Instruction ID: 15af5a7c3139bcf0afe1176899960e02201e3af2c4ad31223bfc60549aec5889
Opcode Fuzzy Hash: 107afd333ea7d2a8df809abef2daadb012bfdb541292ef0d3a4cbc38183e5ecb
Instruction Fuzzy Hash: F601B53261D2195EAB1527B97D9597B2B94EB223B8720022FF310C71E1FF9E5C06A158

Function 004FC37F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BA3E30E8,?,?,00000000,0050B356,000000FF,?,004FC30F,?,?,004FC2E3,00000000), ref: 004FC3B4
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004FC3C6
FreeLibrary.KERNEL32(00000000,?,00000000,0050B356,000000FF,?,004FC30F,?,?,004FC2E3,00000000), ref: 004FC3E8

Strings

CorExitProcess, xrefs: 004FC3BE
mscoree.dll, xrefs: 004FC3AD

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7f716c59fe619d3762633d80f595682e192ad6216d64a8eaac02c96738e6e7cd
Instruction ID: 77818937717e0e603707512c899461e1d26abb00a1d0ba968f469446bcc96677
Opcode Fuzzy Hash: 7f716c59fe619d3762633d80f595682e192ad6216d64a8eaac02c96738e6e7cd
Instruction Fuzzy Hash: 9201A73194061DEBDB118F94DD49BBEBBB9FB04715F004526E811E26D0DBB49904DB50

Function 004F3E12 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004F3E19
std::_Lockit::_Lockit.LIBCPMT ref: 004F3E24
std::_Lockit::~_Lockit.LIBCPMT ref: 004F3E92

Part of subcall function 004F3F75: std::locale::_Locimp::_Locimp.LIBCPMT ref: 004F3F8D

std::locale::_Setgloballocale.LIBCPMT ref: 004F3E3F
_Yarn.LIBCPMT ref: 004F3E55

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 7e6d03cd7372f7596b091f5eb92cfda2de3b5a0c9a7b6864f5e2f6d3a6748d11
Instruction ID: 02df05fe164cddee9ea91233dfa182093ca5e204db24860281fe3c4516581ae5
Opcode Fuzzy Hash: 7e6d03cd7372f7596b091f5eb92cfda2de3b5a0c9a7b6864f5e2f6d3a6748d11
Instruction Fuzzy Hash: 1E01BCB2A002189BCB06EF65D84197E7B71BFA4305B18000EEA1257381CF786B06DB99

Function 004F25A5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004F25AC
std::_Lockit::_Lockit.LIBCPMT ref: 004F25B9
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004F25F6

Part of subcall function 004F3F10: _Yarn.LIBCPMT ref: 004F3F2F
Part of subcall function 004F3F10: _Yarn.LIBCPMT ref: 004F3F53

Strings

bad locale name, xrefs: 004F2607

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$H_prolog3Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 482894088-1405518554
Opcode ID: 3ba1c5c3cc40dfa5d0145c729cab011d70ee31360bd99a5b5e57943509f9a073
Instruction ID: 486e9babdbcd9d5351d02d2565102aec078d86bd918ffb78decfbf021f6c3401
Opcode Fuzzy Hash: 3ba1c5c3cc40dfa5d0145c729cab011d70ee31360bd99a5b5e57943509f9a073
Instruction Fuzzy Hash: BC0184B15057489EC7209F6A954145BFEE0BF18350740892FE28D83A41C7749544CBAD

Function 004F8BF2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(005150C8,00000000,00000800,?,004F8BA3,00000000,?,00000000,?,?,?,004F8CCD,00000002,FlsGetValue,0050ED08,FlsGetValue), ref: 004F8BFF
GetLastError.KERNEL32(?,004F8BA3,00000000,?,00000000,?,?,?,004F8CCD,00000002,FlsGetValue,0050ED08,FlsGetValue,00000000,?,004F7B5D), ref: 004F8C09
LoadLibraryExW.KERNEL32(005150C8,00000000,00000000,?,005150C8,?,?,?,004F18ED,?,004F18ED,?), ref: 004F8C31

Strings

api-ms-, xrefs: 004F8C16

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 5ff25033dcea2545dae93883c862b7521249ea4df897e344dc10913b84170f42
Instruction ID: 2e77e558bee07c6ca455844ca7a63402fb5125bfb31a6362be5d43664781819f
Opcode Fuzzy Hash: 5ff25033dcea2545dae93883c862b7521249ea4df897e344dc10913b84170f42
Instruction Fuzzy Hash: BFE0483024120CBBEF301FA1DC0AB2D3E64BB11B84F104025FA4CE81E1EB7B991695A8

Function 004FFDCE Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BA3E30E8,00000000,00000000,00000000), ref: 004FFE31

Part of subcall function 00503E34: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00502DC6,?,00000000,-00000008), ref: 00503EE0

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0050008C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 005000D4
GetLastError.KERNEL32 ref: 00500177

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: d2f6760e08c6e18463f32e7084fee9d42a009ec370872d9f0e1cf40cab3a3c44
Instruction ID: 068401bcdf6e8232939a00a4b8a304dce87b47d4a44d4cebb33def59ed5808d1
Opcode Fuzzy Hash: d2f6760e08c6e18463f32e7084fee9d42a009ec370872d9f0e1cf40cab3a3c44
Instruction Fuzzy Hash: 3DD179B5D002589FCB15CFA8D880AAEBBB5FF49304F18412AE955E7391D730A946CB50

Function 004F7BC1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 004F7C88
___AdjustPointer.LIBCMT ref: 004F7CAB
___AdjustPointer.LIBCMT ref: 004F7D47

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: f7da345bf504aa529fc58a5fbdde951a4d24a961ed419e4f7a808e47cc5e2e1b
Instruction ID: 01d18fc53230de1dbf18265c7c07db5d366f1d29dea230f7bd1c5dc50bc07982
Opcode Fuzzy Hash: f7da345bf504aa529fc58a5fbdde951a4d24a961ed419e4f7a808e47cc5e2e1b
Instruction Fuzzy Hash: 5651D17150864E9FDB258F15D841BBA77A4EF04304F14452FEB0287291E73DAC81D7A8

Function 00504250 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00503E34: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00502DC6,?,00000000,-00000008), ref: 00503EE0

GetLastError.KERNEL32 ref: 005042B4
__dosmaperr.LIBCMT ref: 005042BB
GetLastError.KERNEL32(?,?,?,?), ref: 005042F5
__dosmaperr.LIBCMT ref: 005042FC

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 990d7f114831f985811ac3ee576b02305e486e40beb21802e09907fcd74ec0fa
Instruction ID: 67a36253ff8b8375c8774a0ba4d1ab0cab2d6282ad28a36688a61fb9beaee89b
Opcode Fuzzy Hash: 990d7f114831f985811ac3ee576b02305e486e40beb21802e09907fcd74ec0fa
Instruction Fuzzy Hash: F62183B160020AAFDB20AF66C88596FBBACFF45364B148919FB1997291D734EC419F90

Function 004FB5A9 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 278ca52f2c95641206763f68b5bc9e4dd617d4deef12f9c2b412e7f2c2e3f8b2
Instruction ID: d5e2990c8d64a892767a39b1c49878bcefeb52de85c09b73ae1ce7d7b4f52874
Opcode Fuzzy Hash: 278ca52f2c95641206763f68b5bc9e4dd617d4deef12f9c2b412e7f2c2e3f8b2
Instruction Fuzzy Hash: 8E21C57160020DAFEB21AF61DC81D7B77AAEF52358B10451AFA14D7250D738DC008BD9

Function 005051E6 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 005051EE

Part of subcall function 00503E34: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00502DC6,?,00000000,-00000008), ref: 00503EE0

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00505226
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00505246

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 66bd0bc169b5ae2bc6ae7286b1d87c17c433256a979233f9c8ea957ace3c891b
Instruction ID: 3887de6b604c4ee8414ec74cf1a22990d4e887033f31d346d39403134a889929
Opcode Fuzzy Hash: 66bd0bc169b5ae2bc6ae7286b1d87c17c433256a979233f9c8ea957ace3c891b
Instruction Fuzzy Hash: 4D1122B5902A1A7FEB2127B29C8DC7F6DACEFA93987100524F901D1180FE24CE019A71

Function 00509615 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,00508411,00000000,00000001,00000000,00000000,?,005001CB,00000000,00000000,00000000), ref: 0050962C
GetLastError.KERNEL32(?,00508411,00000000,00000001,00000000,00000000,?,005001CB,00000000,00000000,00000000,00000000,00000000,?,00500752,00000000), ref: 00509638

Part of subcall function 005095FE: CloseHandle.KERNEL32(FFFFFFFE,00509648,?,00508411,00000000,00000001,00000000,00000000,?,005001CB,00000000,00000000,00000000,00000000,00000000), ref: 0050960E

___initconout.LIBCMT ref: 00509648

Part of subcall function 005095C0: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,005095EF,005083FE,00000000,?,005001CB,00000000,00000000,00000000,00000000), ref: 005095D3

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,00508411,00000000,00000001,00000000,00000000,?,005001CB,00000000,00000000,00000000,00000000), ref: 0050965D

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 84a09b2376e5c7e6bab2a56d11e8d41f821ad12dfa661d1d09acb7fa8b849a56
Instruction ID: a4f5daf1bd45540d5f1cf571fec219ac2af704059388ad8de67a290437b7b5a7
Opcode Fuzzy Hash: 84a09b2376e5c7e6bab2a56d11e8d41f821ad12dfa661d1d09acb7fa8b849a56
Instruction Fuzzy Hash: 5BF01C36801159BBCF221FE5EC09A8D3F3AFF583A0F004010FA1986175DA728964EB90

Function 005059E2 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 373COMMON

Download Yara Rule

Strings

P6V, xrefs: 00505CF5
P6V, xrefs: 00505A10

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: P6V$P6V
API String ID: 0-2469501823
Opcode ID: 5507e3a8c6278934f1acc53853725ba2ce28ff9ada9ee4a55752c77eb41fdeed
Instruction ID: ce1a7c083f0f6c4bc53b9da3b292cc3ede7733ea55f3326f2f0006cc9f8a3498
Opcode Fuzzy Hash: 5507e3a8c6278934f1acc53853725ba2ce28ff9ada9ee4a55752c77eb41fdeed
Instruction Fuzzy Hash: A0C14572D40609BBEB20DBA8CC86FEE7BF8BB44704F144565FA05FB2C2E57499448B64

Function 0050662E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004FEFD8: HeapFree.KERNEL32(00000000,00000000,?,0050602B,?,00000000,?,?,005062CC,?,00000007,?,?,005067C5,?,?), ref: 004FEFEE
Part of subcall function 004FEFD8: GetLastError.KERNEL32(?,?,0050602B,?,00000000,?,?,005062CC,?,00000007,?,?,005067C5,?,?), ref: 004FEFF9

___free_lconv_mon.LIBCMT ref: 00506672

Strings

P6V, xrefs: 00506644
x7V, xrefs: 0050671A

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast___free_lconv_mon
String ID: P6V$x7V
API String ID: 4068849827-3161767270
Opcode ID: b44d6613e39e6b85a7aa7241aa1801d4cbeb1089ed95819091cba3980408f5a0
Instruction ID: e6b00e6494247b9dd50063fe0a4e07e1400a28ef7722e145738324b35171b8c6
Opcode Fuzzy Hash: b44d6613e39e6b85a7aa7241aa1801d4cbeb1089ed95819091cba3980408f5a0
Instruction Fuzzy Hash: BA316B31604309AFEB30AA3AD845B6A7BE8FF00315F14442EE549D72E1DF35EC908B64

Function 004F81BD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 004F81E2

Strings

RCC, xrefs: 004F81FC
MOC, xrefs: 004F81F4

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 0efc7d716db653decb6e4476e2f0698f817792cded43810352d5257f1af871ec
Instruction ID: e4c748f4395e544262079e37e607fd1e42f6520fec46dc9974a353097893f67a
Opcode Fuzzy Hash: 0efc7d716db653decb6e4476e2f0698f817792cded43810352d5257f1af871ec
Instruction Fuzzy Hash: D241893290060DAFDF15CF94CD81AAEBBB1FF09304F1A409AFA046B211D739A950DB59

Function 004F4956 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004F526A
___raise_securityfailure.LIBCMT ref: 004F5352

Strings

XGV, xrefs: 004F534D

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: XGV
API String ID: 3761405300-2698939161
Opcode ID: f964558a6e708a0f0f0f7246ed57e32a930cbd33b5147dbc19966c5e285a006a
Instruction ID: a53068450f14a458c53c00f4666c368bbc845d67901121ebc2fae2a15a7a8240
Opcode Fuzzy Hash: f964558a6e708a0f0f0f7246ed57e32a930cbd33b5147dbc19966c5e285a006a
Instruction Fuzzy Hash: 002140B45003889ED704DF5DF891A143BE4FBAA700F21412AE6088B3B1E3F44989EF48

Function 004F5365 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004F5370
___raise_securityfailure.LIBCMT ref: 004F542D

Strings

XGV, xrefs: 004F5428

Memory Dump Source

Source File: 00000000.00000002.2066505807.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2066479118.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066538862.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.0000000000517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000054B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066565409.000000000055A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066659962.0000000000566000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: XGV
API String ID: 3761405300-2698939161
Opcode ID: 084abc5f272b3b44167b4b2b7e69604c8accd95f86659fb546422c21b3ac08e6
Instruction ID: cc8fa9c0b36c283843c104dfa41a2618b4893718249a5be278494c779924dbb3
Opcode Fuzzy Hash: 084abc5f272b3b44167b4b2b7e69604c8accd95f86659fb546422c21b3ac08e6
Instruction Fuzzy Hash: 3C11DFB85103889FC744EF5EF9916443BE4FBAA700B01511AE9088B371E7F0958AEF49

Analysis Process: RegAsm.exePID: 3320, Parent PID: 3160COMMON

Execution Graph

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	52
Total number of Limit Nodes:	7

Executed Functions

Function 06B03F50 Relevance: .5, Instructions: 525
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680c61a1f3912f61f2c600dbf8db6f124f458f6ea46b87926b31e96994e05915
Instruction ID: a4f0748498e04b94ca53a205b29e032c2fc7aaf7eb783e012e53bf53e5df0183
Opcode Fuzzy Hash: 680c61a1f3912f61f2c600dbf8db6f124f458f6ea46b87926b31e96994e05915
Instruction Fuzzy Hash: 27125B74B00215DFDB54DF69C494AAEBFF6EF89200B1491A9E906EB3A5DB30DC41CB90

Function 06B067D8 Relevance: .4, Instructions: 416
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ba78b135f4a34559a899fefeef47a2a0b4b1bdc300d37e2be72201f365d83f1
Instruction ID: 845256fcee8e8cf0868317bec95aa9a7c4dd61281d6bb791a57dbc055066f44e
Opcode Fuzzy Hash: 8ba78b135f4a34559a899fefeef47a2a0b4b1bdc300d37e2be72201f365d83f1
Instruction Fuzzy Hash: C6F1C170A002469FDB55DFA8D850B9EBFF2EF89300F1481A9E505DB2A1EB30DD55CB91

Function 06B0A3D8 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1e7014d53eb86e3907a8b0704002f469eddeec30c0ca11debdc33da254f1ce6
Instruction ID: 1c8df13ea0790f0202d265598a8d0172ac68cd25930ad4dbaf9c70b9b11815ee
Opcode Fuzzy Hash: f1e7014d53eb86e3907a8b0704002f469eddeec30c0ca11debdc33da254f1ce6
Instruction Fuzzy Hash: FBD1F5B4A00318CFDB14EFB4D8546ADBBB2FF8A301F1085A9D51AAB354DB359886CF51

Function 06B0A3E8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703139c6bd18a60166b3188612ac259701451371d5cfdd40e9045d253e539c02
Instruction ID: 72f0b4440a1b0f6272aba38515b0454dd3cee5f1132e1bdae9a640c99b1a2609
Opcode Fuzzy Hash: 703139c6bd18a60166b3188612ac259701451371d5cfdd40e9045d253e539c02
Instruction Fuzzy Hash: 32D1E4B4A00318CFDB18EFB4D85469DBBB2FF8A301F1085A9D51AAB394DB319985CF51

Function 0308AE30 Relevance: 1.7, APIs: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0308B086

Memory Dump Source

Source File: 00000002.00000002.3321174492.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3080000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ccc0c483c8d900064a359620eae8270c38ee35804c540e0c11c11e3db0d35d3c
Instruction ID: b2ec2b2f0c98bc0b81534f911280f3c6ce49f73baa075818b679a92ffc0db17c
Opcode Fuzzy Hash: ccc0c483c8d900064a359620eae8270c38ee35804c540e0c11c11e3db0d35d3c
Instruction Fuzzy Hash: 8F8136B0A01B05CFDB64EF69D04479ABBF1FF89304F04892ED48A9BA41D735E849CB91

Function 03085935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 030859F1

Memory Dump Source

Source File: 00000002.00000002.3321174492.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3080000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 17902ad3a7bc2a078664d8bba767fd9af892b25b64bf2d00e5b0a18af3793cd3
Instruction ID: 0805d093d4fd3206980f12abe77cfd2d09ae7a89b0ca853b2b7ac1a834c16b37
Opcode Fuzzy Hash: 17902ad3a7bc2a078664d8bba767fd9af892b25b64bf2d00e5b0a18af3793cd3
Instruction Fuzzy Hash: 4241FFB0C00768CEDB24DFA9C884B8DBBF5BF49304F24806AD448AB255DB756949CF51

Function 03084248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 030859F1

Memory Dump Source

Source File: 00000002.00000002.3321174492.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3080000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8977aa6d857658c33e9447298042697d03a828e2aafc7db2d0ace9060fa323ec
Instruction ID: 4cf2b00f5b8a82520da72d816ea93ab390cb34e1b3778c4675103a2630c1a4ee
Opcode Fuzzy Hash: 8977aa6d857658c33e9447298042697d03a828e2aafc7db2d0ace9060fa323ec
Instruction Fuzzy Hash: 0841EDB0D00729CBDB24DFA9C884B8DBBB5BF49304F20806AD448AB251DB756946CF91

Function 0308A858 Relevance: 1.6, APIs: 1, Instructions: 77
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0308B101,00000800,00000000,00000000), ref: 0308B312

Memory Dump Source

Source File: 00000002.00000002.3321174492.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3080000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a1c43bb1718ca6b53f83c7af0ee80dc298afc3fe78dc63724ee5c12008c6bb98
Instruction ID: 7177966d902d45be1440543533666ab51cf52852f1a04a2102a7e478b26726e5
Opcode Fuzzy Hash: a1c43bb1718ca6b53f83c7af0ee80dc298afc3fe78dc63724ee5c12008c6bb98
Instruction Fuzzy Hash: B72198B6809388CFDB11DFAAD8646DEBFF0AF59310F04805AD584AB301C2789505CFA5

Function 06B059C8 Relevance: 1.6, Strings: 1, Instructions: 318
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 06B05C29

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 7beba311dcee4c9326d7b55979735a1750e2f73baed4bfc0e89526b8061b4d38
Instruction ID: a37ff040e70f0f2cdc5fd1acef445d5c9d6381a1d53670d1a7732b41b1f6526f
Opcode Fuzzy Hash: 7beba311dcee4c9326d7b55979735a1750e2f73baed4bfc0e89526b8061b4d38
Instruction Fuzzy Hash: 66D15A75600602CFD764CF68C5809AABBF2FF88310765CA99D55A9BAA1D730FC46CF90

Function 0308C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0308D2C6,?,?,?,?,?), ref: 0308D387

Memory Dump Source

Source File: 00000002.00000002.3321174492.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3080000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7f13456db5bb63f678ebf5fcad185ec67eec8286e71f0e1313902a37cd9bbc37
Instruction ID: 08b0ad7c5ba3ade9f60d514aea545ebadee4bbb262e363c682f68efa9db02b6c
Opcode Fuzzy Hash: 7f13456db5bb63f678ebf5fcad185ec67eec8286e71f0e1313902a37cd9bbc37
Instruction Fuzzy Hash: 242116B5900748EFDB10CF9AD984ADEFBF4EB48310F14841AE954A7350D378A954CFA5

Function 0308D2F9 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0308D2C6,?,?,?,?,?), ref: 0308D387

Memory Dump Source

Source File: 00000002.00000002.3321174492.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3080000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3937797cf5fdd948ddbd64ccaa27ed393e239788444c36e18915fe1de505bb27
Instruction ID: 218730e24b409e98e4ecc94277c8d6c22358abaea67183de10eb9996a95883da
Opcode Fuzzy Hash: 3937797cf5fdd948ddbd64ccaa27ed393e239788444c36e18915fe1de505bb27
Instruction Fuzzy Hash: 242103B5900208EFDB10CFA9D984AEEBBF4AB48310F14841AE918B3350D378A944CF64

Function 0308A870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0308B101,00000800,00000000,00000000), ref: 0308B312

Memory Dump Source

Source File: 00000002.00000002.3321174492.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3080000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 65c544f6b9abb6afd334c36b5102564d6fb93da6e2c5a1a3627bb3d85c085349
Instruction ID: 0dd6b295d1dd07898245e06321ea52780e8212f1a89fabd6bdd6f568bb4c681c
Opcode Fuzzy Hash: 65c544f6b9abb6afd334c36b5102564d6fb93da6e2c5a1a3627bb3d85c085349
Instruction Fuzzy Hash: 571114B6901749DFDB20DF9AD844AAEFBF4EB48310F14842EE559A7300C374A545CFA5

Function 0308B2A0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0308B101,00000800,00000000,00000000), ref: 0308B312

Memory Dump Source

Source File: 00000002.00000002.3321174492.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3080000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 819901fa42d8b0b4ec4e7b54958d7ce885736528529c074ad74a37f7023da976
Instruction ID: 0c493d37773b8e01f8f500d184a828a46bc9ed6976db463c2172e92f630ea7fc
Opcode Fuzzy Hash: 819901fa42d8b0b4ec4e7b54958d7ce885736528529c074ad74a37f7023da976
Instruction Fuzzy Hash: E31114B6800349CFDB10CFAAC844ADEFBF4AB48310F14841AD959A7300C374A545CFA5

Function 0308B020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0308B086

Memory Dump Source

Source File: 00000002.00000002.3321174492.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3080000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9045f5578d6302f0bf00c1608776906a925b2ee374b70fd4977e369615b55105
Instruction ID: 3f7a91fe44dbdf556089c6104b31a248c8cbe999912f0c98a4a49be39dfe957e
Opcode Fuzzy Hash: 9045f5578d6302f0bf00c1608776906a925b2ee374b70fd4977e369615b55105
Instruction Fuzzy Hash: 0E1113B6C00749CFDB20DF9AC844BDEFBF4AB88610F14841AD568B7210D375A549CFA5

Function 06B048B8 Relevance: .6, Instructions: 619
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a863820e956dd6e4f101d6aecfca84c26783c7f809367fa0f1b5a8013ef75ee4
Instruction ID: 7c407da4981aad5a91b8d799c5691360b266aabcd990eb365d11cc55a4e2ea1d
Opcode Fuzzy Hash: a863820e956dd6e4f101d6aecfca84c26783c7f809367fa0f1b5a8013ef75ee4
Instruction Fuzzy Hash: 27323974B00605CFDB54DF69D598A6ABBF2FF89304B1584A9E606CB3A2DB30EC45CB50

Function 06B048A8 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12c0e3c4e19d60182bb17ceb9e747bba1b9acf8724130c490ce775056234a4db
Instruction ID: c953896f489e7b3debd7463d92cd871280805b5cc76c2bafc3b7620f1df44fff
Opcode Fuzzy Hash: 12c0e3c4e19d60182bb17ceb9e747bba1b9acf8724130c490ce775056234a4db
Instruction Fuzzy Hash: EDB11374B00605CFDB54DF29D998AAABBF2FF89305B1540A9E546DB3A2DB30EC05CB50

Function 06B07D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4965a1c3b8a24c323e3fb9fe4001c4b1cb3ca4fddbd4b7bba77d194a5612f8b
Instruction ID: 3b382bf10d7ee3ad221c7227158ba1278a2210cb0a98cc4813b8c2364c6770bc
Opcode Fuzzy Hash: d4965a1c3b8a24c323e3fb9fe4001c4b1cb3ca4fddbd4b7bba77d194a5612f8b
Instruction Fuzzy Hash: CC5125B1E10258DFEB54CFA9C844BDEFFB5AF88300F14856AD415AB280DB74A846CF81

Function 06B07D4C Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25ff9ef842ab11b1d99662c7a77fc93bf8698c45e5fca17828d034ba60d1a0e
Instruction ID: 3275ffefd402c6c2b4e68a0a2846b99858ab53b1e55ff27e5700d09319669e56
Opcode Fuzzy Hash: d25ff9ef842ab11b1d99662c7a77fc93bf8698c45e5fca17828d034ba60d1a0e
Instruction Fuzzy Hash: B05125B0D112589FEB54CFA9C884BDEFFF5AF48700F148529E405AB280DB74A845CF91

Function 06B03DE0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 651d4876e1bcdb2cdf0c083e05ed8f3d15d247609b24e2253b9107d8bc740420
Instruction ID: 7e193b85104875408a834b7b1358757c7da1eea41e91c74bc564ed1cf548a8bb
Opcode Fuzzy Hash: 651d4876e1bcdb2cdf0c083e05ed8f3d15d247609b24e2253b9107d8bc740420
Instruction Fuzzy Hash: 8B3125717053118FC716E738A8606AE7BE6EFCA21030544AAE806CB781CE35EC07C7A2

Function 06B05579 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c16f1f1fed5b432d13ee20e1609d129066e958154badedfc9046588a33c99127
Instruction ID: c22a819a27306d267c22ef1d75d06428121119e85d3ff2e381dfd421dae08f4e
Opcode Fuzzy Hash: c16f1f1fed5b432d13ee20e1609d129066e958154badedfc9046588a33c99127
Instruction Fuzzy Hash: 38317A75B012119FCB55DF38D884AAE7FB2FF8A201B5085AAE905CB395DB30DD05CB91

Function 06B084C8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a28c15b3eaa5e3fc105c716df373dfcfc65cd4228efd32e55395937b8158b233
Instruction ID: 5ffe0b6d5f9c8de0f9f2b5d35058deaeba4d5a9033c5f8d28d9226e73dda1925
Opcode Fuzzy Hash: a28c15b3eaa5e3fc105c716df373dfcfc65cd4228efd32e55395937b8158b233
Instruction Fuzzy Hash: BD318F717012458FCB05EB79A8645AE7AE7EFC9300B504479E606CB384EF35AD4687E2

Function 06B05588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cf41e78e8daceeb920ea808033ca7de5548f0f022ec977e295dd56195df13e8
Instruction ID: 80d85216d44e2638625c1696db5c6b206e22ceaeb3a2b926445bb4209884d64e
Opcode Fuzzy Hash: 3cf41e78e8daceeb920ea808033ca7de5548f0f022ec977e295dd56195df13e8
Instruction Fuzzy Hash: 3A314675B012159FDB55DF38E884AAEBFB2FF89200B5085A9E905CB395DB30ED05CB90

Function 06B087A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30cb5078783637cac6cf4acfcd3bb2194647c340058eb92f99bd6e021923a08
Instruction ID: b04045d5114152bd8efb30ac4103a4c94035f04d7357e37eba934e50fb122d61
Opcode Fuzzy Hash: e30cb5078783637cac6cf4acfcd3bb2194647c340058eb92f99bd6e021923a08
Instruction Fuzzy Hash: AC41F0B1D01648DFEF54CFAAD944ADEBFB6AF88310F14806AE415B7290DB34A945CF90

Function 06B08797 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94f74b6dd3db70d801e2c68fcec951a74dadc4094148e77c553e612a02a4623a
Instruction ID: f129ead22a9a642d1e306df46f26b182401d2f3f19c2102e6115cac781516277
Opcode Fuzzy Hash: 94f74b6dd3db70d801e2c68fcec951a74dadc4094148e77c553e612a02a4623a
Instruction Fuzzy Hash: B4310EB1D017489FEF14CFAAC940ADEBFF6AF88310F14802AE415AA290DB349945CF90

Function 06B08A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b38022c6f5a817b7e577fca002fe3304b7a7aae3a901056c50a522bf93345971
Instruction ID: 50e3e5e44452c0edc5a11ad32b7f7f396b70cec26eb0e049671f9075612f05a1
Opcode Fuzzy Hash: b38022c6f5a817b7e577fca002fe3304b7a7aae3a901056c50a522bf93345971
Instruction Fuzzy Hash: 1B3102B1D01258DFEF54CFA9D894BDEBFF5AF88310F14806AE405A7280CB75A945CB90

Function 06B06E73 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59fee8a9cc03fca1f5faaf9e6f086938694fa6e749bb9ac7983056f9098e8bdf
Instruction ID: 307a2e9b9056b7da496cd8336e834a509b337699d5adf79d8759ee6499c45cab
Opcode Fuzzy Hash: 59fee8a9cc03fca1f5faaf9e6f086938694fa6e749bb9ac7983056f9098e8bdf
Instruction Fuzzy Hash: AA1157722092E42FC7524AA85C14EFB3FA9DB8A151B084197FAC0D7283C428CD2697B1

Function 013DD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3320670775.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13dd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 446b1e07e283279ec9f0feacf80eb135edb4ded9ad81d6eece870c93706c195b
Instruction ID: c5221c5183d8acbbfe4c6a4c38c0fbaafcae0ccdb36456d3a3a399f717582d32
Opcode Fuzzy Hash: 446b1e07e283279ec9f0feacf80eb135edb4ded9ad81d6eece870c93706c195b
Instruction Fuzzy Hash: 442145B2500204EFDB01DF94E9C0B66BF79FB84328F20C16CD9091B286C736E456CAA2

Function 013DD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3320670775.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13dd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78ee0fd496529ca7c9fbdd36163b4da51e5f32e323aa71e51c772fe99010ca5
Instruction ID: 66fec763f28bf8d7426fad1258419f55a8f545ff4532684ba64dcb99119a3b50
Opcode Fuzzy Hash: b78ee0fd496529ca7c9fbdd36163b4da51e5f32e323aa71e51c772fe99010ca5
Instruction Fuzzy Hash: 5C210372500244EFDB15DF68E9C0B26BF66FB8431CF24C569D9090B686C336D456CBA2

Function 013ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3320723167.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13ed000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdc5f3c2dc8fa1847d94f9e2f7c9ddbcf9e9e6e72835c5195df4c5ed9630507c
Instruction ID: 2ff58438eb711bb4ce6bc8605128adade245f88e34418312bc78376c49bc39f3
Opcode Fuzzy Hash: fdc5f3c2dc8fa1847d94f9e2f7c9ddbcf9e9e6e72835c5195df4c5ed9630507c
Instruction Fuzzy Hash: 3E210071604304EFDB15DF68D988B26BFA5FB84318F28C56DD90A4B686C33AD846CA61

Function 06B08F43 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f49da5d1f0a12946eed88795f6f8dc9b1d091b690574f986e2e7234d4c110389
Instruction ID: 6756b30e53a785fa3c8981f0e9e863039d27ec6e500f2474d2a9706dd07cfe31
Opcode Fuzzy Hash: f49da5d1f0a12946eed88795f6f8dc9b1d091b690574f986e2e7234d4c110389
Instruction Fuzzy Hash: D12102B8D0425ADFDF10CFA8D484AEEBFB5EB09311F2044AAE415AB391D7345A81CB90

Function 06B08A8C Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa908d56d209ecf442d190813145353696d693f98ddaa8c6501480a5ee2865a
Instruction ID: 750e11692e2b88a91d280004c311bc0f756e900d62d8d87cfd7213b1ebeae9fa
Opcode Fuzzy Hash: bfa908d56d209ecf442d190813145353696d693f98ddaa8c6501480a5ee2865a
Instruction Fuzzy Hash: 732124B1D01248DFEF14CFA9C894BDEBFF8AF48310F14802AE404A7280CB759945CBA4

Function 013DD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3320670775.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13dd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a994b626c5b1a2b6fd6d27e6a0f022d141ef464c75df6f036bdb8b2bbfaa7e2a
Instruction ID: 3b60e76044b362d4ab1b506ec40d1bf488e683e6887156a48727eaa3ac5f37a4
Opcode Fuzzy Hash: a994b626c5b1a2b6fd6d27e6a0f022d141ef464c75df6f036bdb8b2bbfaa7e2a
Instruction Fuzzy Hash: 62112672504280DFCB12CF54D9C0B16BF72FB84318F24C6A9D8090B657C33AD45ACBA2

Function 013DD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3320670775.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13dd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a994b626c5b1a2b6fd6d27e6a0f022d141ef464c75df6f036bdb8b2bbfaa7e2a
Instruction ID: b310530fdeefec7d699ce53275a6dd36b7e55a7825c26dd9c45508896c13f782
Opcode Fuzzy Hash: a994b626c5b1a2b6fd6d27e6a0f022d141ef464c75df6f036bdb8b2bbfaa7e2a
Instruction Fuzzy Hash: EB1126B2504280DFCB12CF44D9C0B56BF71FB84328F24C6A9D8090B657C33AE45ACBA2

Function 013ED017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3320723167.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13ed000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac9c5df3739d9922357d97ee08fe41b46f5237faea4d682c3f3ac9d5e7d34632
Instruction ID: e9295326139a62ea4fb80e593547b55d58d63b1664183759072009bb1538a361
Opcode Fuzzy Hash: ac9c5df3739d9922357d97ee08fe41b46f5237faea4d682c3f3ac9d5e7d34632
Instruction Fuzzy Hash: 7F11D075504380DFCB12CF54D5C4B15FFA1FB44318F28C6A9D8094B696C33AD84ACB62

Function 06B0BC5F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 559bf2a501b053d2d439e245074e828d9f3c2811f8269780df9e7f3c080ca57a
Instruction ID: cef795055539d4f4d8f8c1f068348a0fd78c96d062bdcf54824edbe00a23a16e
Opcode Fuzzy Hash: 559bf2a501b053d2d439e245074e828d9f3c2811f8269780df9e7f3c080ca57a
Instruction Fuzzy Hash: F40161723002069BC794AB38F4687BE7AB7FFC6254754481CE24787640DE706D4687B5

Function 06B08350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44478a845740d692d1417b471bbaf5645f75b07f305414360d385a46d6476eb0
Instruction ID: 1f53b78a49b4cb16111b54ecf13347c44a2fb727ef37a27564fb7bd5f9e9dfbe
Opcode Fuzzy Hash: 44478a845740d692d1417b471bbaf5645f75b07f305414360d385a46d6476eb0
Instruction Fuzzy Hash: E8018871B002199BDF10DEA9EC44ABFBBFAFBD8351B144036E604D3240DB309D5587A1

Function 06B0C499 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a2211ccd544ea5694a13168a1ae23d2aaff542841a6fb736005df0e19a0cb
Instruction ID: 20860e6714702c5bff49ec9ae3aef14d3c034236eb041dd2b036623c2823512f
Opcode Fuzzy Hash: f27a2211ccd544ea5694a13168a1ae23d2aaff542841a6fb736005df0e19a0cb
Instruction Fuzzy Hash: 23018E712006068BD324AF29E01875A77E3FFC9315F108A2DD14A97B44DF74AC0ACBA1

Function 06B0BC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97f68a275918e29b1dae0646851637631624caf8c8fe4b984f47b2c9cf7a60e3
Instruction ID: dc3d133fb8f04359012541c09589d5400e944296887f812eee245d782ac2c04a
Opcode Fuzzy Hash: 97f68a275918e29b1dae0646851637631624caf8c8fe4b984f47b2c9cf7a60e3
Instruction Fuzzy Hash: 9F012C723002068BCB95A77CF46867E7AB3FFC6258754492CE2078B650DE70BD4687B6

Function 06B0C4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc74dc44a57ecc5f49b88f684f316c3633dc2fc35f51745c3d2cec1e0c34c47d
Instruction ID: 5ad3cb9e6d57a7caed83efbba95624f683cb5123c53e941dd46d4e0da8e18383
Opcode Fuzzy Hash: dc74dc44a57ecc5f49b88f684f316c3633dc2fc35f51745c3d2cec1e0c34c47d
Instruction Fuzzy Hash: 5E0180712006058BD325AF79F05869A77E3EBC9315B148A2DD14A97B44DF74AC09CBE1

Function 06B05508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 379dbcf5bb7be5fc4650d17ba3c9f69027cef95bdda7d3f00cc87eb8fdd32dee
Instruction ID: 99da83e627db7a817ec317488735e0a49d31dee16306c7f6833503440ba70f16
Opcode Fuzzy Hash: 379dbcf5bb7be5fc4650d17ba3c9f69027cef95bdda7d3f00cc87eb8fdd32dee
Instruction Fuzzy Hash: AD01DB79A11702CFE7B48A39A6047277FF7FF84205704987DD20282A84DA71E480CF80

Function 06B0E8B0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1b3b0dca85957cad4ee6df3e8bfe5db10000492fdd73986690673f8a098fe7f
Instruction ID: 11017df39be1e1f6d1bd39f8b5f207589b90a900216b005f16d91c314b5859bc
Opcode Fuzzy Hash: b1b3b0dca85957cad4ee6df3e8bfe5db10000492fdd73986690673f8a098fe7f
Instruction Fuzzy Hash: A201D134208308DFCB42AF74D8189697FB6EF86200B5088E9E5418B362EB36DC05DB91

Function 013DD5F3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3320670775.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13dd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0715171a2678f2fc3f70fb439b2b5cb8c312316e28be4ee94c5640f582f981
Instruction ID: f2eb2caa2aa3025ee071bf9f48abc63efea41fb7ae86c15678762cf42bb6aa79
Opcode Fuzzy Hash: db0715171a2678f2fc3f70fb439b2b5cb8c312316e28be4ee94c5640f582f981
Instruction Fuzzy Hash: 2BF049B6200A04AFD7208F0ADD84C23FBBDEBD4734319C55AE94A4B752C631EC41CAA0

Function 06B08F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1772c82b0f76b2718c42de8e9f70947ad4b90bd6b3b3d1777d9111434d50064
Instruction ID: a685d0cc70fd04ff6125fe15c1c5eb6056c0424b1d0249e3ba7fec99ce76aa5b
Opcode Fuzzy Hash: b1772c82b0f76b2718c42de8e9f70947ad4b90bd6b3b3d1777d9111434d50064
Instruction Fuzzy Hash: A601C4B4D04219EFEB54DFA9D5456AEBFF5BB48301F1094A99415B3390E7740B40DF90

Function 06B0B358 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a1a3c9436f57b72f7295803f8837fc912b0f24a77649432a0eb3d47aa85d88
Instruction ID: d072ff99f9839e17869f09748b052d89e1a22e9e670e639c07f2f59aeb810e55
Opcode Fuzzy Hash: 04a1a3c9436f57b72f7295803f8837fc912b0f24a77649432a0eb3d47aa85d88
Instruction Fuzzy Hash: BA017C70E0124AEFCB04EFB8F49969CBBB2FB44204F1404A8D906E7210EB341E40CB55

Function 06B03EC8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d917475b76da25f84e205d6ce96cf157d22037a5e6002b7a1c7852a74b1d23d
Instruction ID: f44f85db898e63d93f47ed362874bf58088cc682ca7757bc5025927433d056fc
Opcode Fuzzy Hash: 9d917475b76da25f84e205d6ce96cf157d22037a5e6002b7a1c7852a74b1d23d
Instruction Fuzzy Hash: 0BF030713006028FC619E77DF860AAE77E7EBCA210314492DE54B8B754EF74BD0687A2

Function 013DD5E4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3320670775.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13dd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1b93ff50a9c004942444a3ec556a9ae7e6561f6eb559c28dfd3355ef3c1ea21
Instruction ID: 35ab934fcadae369e420aba2dc69c4c34368b8f0bfdcbda5b2629d49141a3715
Opcode Fuzzy Hash: d1b93ff50a9c004942444a3ec556a9ae7e6561f6eb559c28dfd3355ef3c1ea21
Instruction Fuzzy Hash: F6F04F75104A80AFD725CF05CD84C23BFB9EF867747198489E88A4B752C630FC42CBA0

Function 06B06EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7e48a15daa6f5e997ad16f3b6c173230ab3981a878d66066c74e1318699cddb
Instruction ID: 5d39e121d4442d0786ff5b7f3fcb6cb17a6ec8d658a29474c30090ec52ec4c55
Opcode Fuzzy Hash: d7e48a15daa6f5e997ad16f3b6c173230ab3981a878d66066c74e1318699cddb
Instruction Fuzzy Hash: BBF082622041E83F8B514EAA5C14DFB3FEDDA8E1617084056FE98C2241C429C921ABB0

Function 06B067C8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0689cb50a9e264df9544d4ee7c46eba190db7df014a2b98bfaa1cd9e3df6d406
Instruction ID: 09c671fd5690ed6b9ed579559970971cf3beb8737a4e185047684475f3a508e5
Opcode Fuzzy Hash: 0689cb50a9e264df9544d4ee7c46eba190db7df014a2b98bfaa1cd9e3df6d406
Instruction Fuzzy Hash: D0F02E31B003009FE720CA28AC45FA13FE2EB46310F1482ABF250CB1E2E7B1D8098780

Function 06B0ADE9 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97eee5c701147b1fb7bea7fc41f42d49bf19da7eed9d568c0e5d2d3c61c3234e
Instruction ID: d735e40afcc2d66bec5b28f4decb8545d8dbb9dd1fe7b84aeb0a2536389adfa5
Opcode Fuzzy Hash: 97eee5c701147b1fb7bea7fc41f42d49bf19da7eed9d568c0e5d2d3c61c3234e
Instruction Fuzzy Hash: 24F0A7B2205211AFC7502B69B8A869B7FEEEBCA254B00446DF14BD7242DA751C4587B1

Function 06B054F8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45802c9a7dd6f4d5afb2f2e26b1d2c8899de51a1951ccdf348e4bc1d9378ac20
Instruction ID: f318592c50da5f5f8f0637a5c753fb3304d83f96df612c0c2af14736a55591a5
Opcode Fuzzy Hash: 45802c9a7dd6f4d5afb2f2e26b1d2c8899de51a1951ccdf348e4bc1d9378ac20
Instruction Fuzzy Hash: F4F022369053818FE7A18A61D60076BBFB2EF81210F0894DED04146DA5C730E445CF40

Function 06B08FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f82845eb3e39fe30723f64dd4c1d4cc5782e94febba1f07a655de1c10f2ccdc
Instruction ID: 2cc492cc11fc3812fd3d9dcdcfcdc3f9eaf43e0ba9ea9f746def82afa9b6d9df
Opcode Fuzzy Hash: 7f82845eb3e39fe30723f64dd4c1d4cc5782e94febba1f07a655de1c10f2ccdc
Instruction Fuzzy Hash: DEF0A9F5C08149EFEB00DBB0D8151AEBFB1EB6A201F0045CAE402E7391E6344A01DB40

Function 06B0ACB8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaf3fb62fb011d993e916a17f6fc72fb1f551d7d6136502971f911a046de4da0
Instruction ID: 5294b1373b56bcc684c91a9c34272d7abb090de4f4c80a2ebe68b75085fc732d
Opcode Fuzzy Hash: aaf3fb62fb011d993e916a17f6fc72fb1f551d7d6136502971f911a046de4da0
Instruction Fuzzy Hash: 03F082F37091A09FD722277868280AD3FB6E9C769534944DFD187CB292DA544A06C3A2

Function 06B0B368 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e30d94b983d871aa1638108020e1d48c6df1ec4f7190e0b369aacce0f970e21
Instruction ID: 7f9b41f940620e8046b962c1cf26392536c877b24c223d0d9e3ee3d8262faad7
Opcode Fuzzy Hash: 8e30d94b983d871aa1638108020e1d48c6df1ec4f7190e0b369aacce0f970e21
Instruction Fuzzy Hash: 6AF03C70E0124AEFCB04EFB8F59969C7BB6FB44204B1445A9D906E7750EA341E44CB95

Function 06B0C110 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db2bfb66122adcf502f00fc1fbd6b67c302db160e81d21cf7f720ccc253308f8
Instruction ID: 9eb46f7f8b9a4c3aaade6669795b570c68222d2746bb31628857814ba62d0959
Opcode Fuzzy Hash: db2bfb66122adcf502f00fc1fbd6b67c302db160e81d21cf7f720ccc253308f8
Instruction Fuzzy Hash: 10F0B4312057918FC7129B38F81979F7FE7DF82308F08055DE2868BA41DBA1A80587A5

Function 06B0C170 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a042159d0a3c8e8b57ba2c4181a6942b75c61f74ee231e015437e62c920b523
Instruction ID: 83eaec9b059f8ce786f5af39204549099061dd312e4556234bed6f1c05a0e0da
Opcode Fuzzy Hash: 7a042159d0a3c8e8b57ba2c4181a6942b75c61f74ee231e015437e62c920b523
Instruction Fuzzy Hash: ACF0A471500B058FE725DF25E40C621BBF6FB48341B10891ED48A83B00DB74A545CF94

Function 06B08340 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ab2c5b2fd919fc362841114d3202656b1c7d57b2d4e9044b9c2196ab08f25ca
Instruction ID: 8f3657e655794d594e1ba50e5340337a0306ba27f7535cfce284c5752aaae35f
Opcode Fuzzy Hash: 0ab2c5b2fd919fc362841114d3202656b1c7d57b2d4e9044b9c2196ab08f25ca
Instruction Fuzzy Hash: 06F0A772F142159BCF20DA68AC446FFBFEAEFD8151F0C042AE554D3141E730951583A1

Function 06B0ADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86bddcfbca4227330fa5d7b878c97a7b675719a840527d6e859b6ae3bad64f5f
Instruction ID: b662c7dd67918355805e90be9f13b7144514c05fe02b745b29bb91cb40143959
Opcode Fuzzy Hash: 86bddcfbca4227330fa5d7b878c97a7b675719a840527d6e859b6ae3bad64f5f
Instruction Fuzzy Hash: 61E092B2300101ABC3102A6AB498AAE7BDEEBCA355B00442CF20FD3241CAB11C0547B5

Function 06B0C180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9f37a859f8b0645968e2a6ac3b25465a519d7c6fbd2a4a4359e994ddf936dcb
Instruction ID: 04cc2029ec05bd39c01ebdbd0c90ad7f1965d5d042106af8f30200efd49b25c0
Opcode Fuzzy Hash: f9f37a859f8b0645968e2a6ac3b25465a519d7c6fbd2a4a4359e994ddf936dcb
Instruction Fuzzy Hash: F2F09075500B018FE715DF26E40C622BBF6FB88341700C62EE48A83A10DB74A509CFD8

Function 06B0B500 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00009d4b0e6d665ea999bb3e9bf9d63d79ef7d23f339c6ea9477ea56e2bca05b
Instruction ID: fc0e7d51dbc5801649078085c71895571cca3953cdb8529090cbc1bc9194c2b3
Opcode Fuzzy Hash: 00009d4b0e6d665ea999bb3e9bf9d63d79ef7d23f339c6ea9477ea56e2bca05b
Instruction Fuzzy Hash: 56F03935D0A20DFFCB01DFB4D94A9CDBFB9EB44204F1442A6E805E3250EA315B45CBA1

Function 06B0C120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ec55d2880e0e2cf6c38ef6f8d1102f75d71568a698e46ac5d4744210a0097a8
Instruction ID: f3118bb41fe3dfa3ea810c423d5c29031b20c399023f0bcd17de0bcb4e789980
Opcode Fuzzy Hash: 9ec55d2880e0e2cf6c38ef6f8d1102f75d71568a698e46ac5d4744210a0097a8
Instruction Fuzzy Hash: AEE030312007528FC716A76DF4197AE7BE6DB85314F08052DE24687A41DAA5AC0587A5

Function 06B05698 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9950bfe9555c72a0bcb1541d86ab282d75b8e0618e603f351353969ab93d84c
Instruction ID: 9c6b1e7c3c7cf21a7cc57a09bbc98b826baf93ef320c08cf237f55f6aa23ff18
Opcode Fuzzy Hash: b9950bfe9555c72a0bcb1541d86ab282d75b8e0618e603f351353969ab93d84c
Instruction Fuzzy Hash: DCE092B220C3409FD305EB24EC458967FE4EB93210F0588AEE480C7581EB32D841CBA9

Function 06B0E280 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cad77f5f8e77012492868a3e2af67a7664a9b3990c4c41028be2efd451119ec
Instruction ID: 03b8a898292b0168090db7cb48ed161a5fdb337bd9507f4d48eb3c662afd54ef
Opcode Fuzzy Hash: 2cad77f5f8e77012492868a3e2af67a7664a9b3990c4c41028be2efd451119ec
Instruction Fuzzy Hash: 44E0DF72B012818FD755A238BF1A6C43B62E79A200B032085E8058BAA2C63C0E5687E2

Function 06B0E1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 326e621b150ca90f800d0a0148e6b6c75bccd1bcec5965db65db5395c4fe0bf3
Instruction ID: 491fb0ff7af6a5ee20df8191a14218fb604910958d2932c06458f527a0c124c9
Opcode Fuzzy Hash: 326e621b150ca90f800d0a0148e6b6c75bccd1bcec5965db65db5395c4fe0bf3
Instruction Fuzzy Hash: 4DE048B2A09245EFCB01DB78B9549DD7BB1DB4621472142DAD809D7251D7301F158761

Function 06B0CE88 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c02056e8374a568703fc86cf008ca081f78c7ad45f687e585d09f29bb7841b
Instruction ID: 8bf2d9d1a54ebe5cba34d2cfe656f36aacb984b43c6b109ae2562309adcf21e6
Opcode Fuzzy Hash: 83c02056e8374a568703fc86cf008ca081f78c7ad45f687e585d09f29bb7841b
Instruction Fuzzy Hash: AEE086B4A01241EFDB619B28F64D7D93FA6DB45315F010158ED4787A41CB3C5C5187A1

Function 06B0AC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b66eb2aeb17d185f2b859ea100a10d70a3e0a8463c974c796100e37f120e9650
Instruction ID: 306c32ad26fa48f8b380cfd1dd091020d3b938ef246175e373fdebd9ef0f5d16
Opcode Fuzzy Hash: b66eb2aeb17d185f2b859ea100a10d70a3e0a8463c974c796100e37f120e9650
Instruction Fuzzy Hash: 81D05EB23001299B8A1537A9B4184FE7BAFEAC6662301002EE70BCB240CFA51D0687D6

Function 06B0CC38 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ddef9b8abc13aa51e04b151f75b5dd744ac6ab3d53e9a2214803f9e07f3d9f
Instruction ID: 91e710cc6e54a4e019ac86e5f5b61e66bad8ddbee0f7c8166f115939069ec1b9
Opcode Fuzzy Hash: 35ddef9b8abc13aa51e04b151f75b5dd744ac6ab3d53e9a2214803f9e07f3d9f
Instruction Fuzzy Hash: A6E04672B001418BCB61AF1DF8087C9BBE1EB85211F128229D88987A42C7780C52CBA1

Function 06B0B510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10ef9dd880480e12d1dc0fd7cfee8243c46eb0dc078670330968b63c266cb029
Instruction ID: 1b23e276b2949434dba30b209d2e27f3b4206ec11c6703a65c9e6f03e7626811
Opcode Fuzzy Hash: 10ef9dd880480e12d1dc0fd7cfee8243c46eb0dc078670330968b63c266cb029
Instruction Fuzzy Hash: 05E09275D0020DEFCB40DFE4E9499DDBBB9EB48200F1482AAD909E3200EB306B55DF90

Function 06B0E210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 728cea998b7ebd4f6f5d2b414c88cc51bb2ba0001f9a0ce4262ed1fbbd18da0f
Instruction ID: bf0a8baa2d9e3bdc4c475bc50ecfb4a2829fc38c0ad4e34c0f9847cc90e0965f
Opcode Fuzzy Hash: 728cea998b7ebd4f6f5d2b414c88cc51bb2ba0001f9a0ce4262ed1fbbd18da0f
Instruction Fuzzy Hash: 96D017B2A0020DFBCB40DFA8F914A9DB7B9EB45204B1041A99909E3200EA312F109BA1

Function 06B0E8F8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fa999b035274bb64fb6d6c0d99674edb43678d7c80daac45157c651ad21993f
Instruction ID: 85302ee1115cc9592f030a11dd856d1923002dc21e33d1b99c0381226c22ad8f
Opcode Fuzzy Hash: 4fa999b035274bb64fb6d6c0d99674edb43678d7c80daac45157c651ad21993f
Instruction Fuzzy Hash: 7CD0523A210208EFC740AF48C880A407BF9BF48B00F508098F6804B320CB32E860EF50

Function 06B0F8E0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59449d5fb06ba3ea798fdf2154e4fcaa53a9c39a698cddb480c341d8a7c8a37e
Instruction ID: 63b7a8765c4d9708f2a59d14ef1d8d99ac0df76ed1987b133c1fbb21bc8345ec
Opcode Fuzzy Hash: 59449d5fb06ba3ea798fdf2154e4fcaa53a9c39a698cddb480c341d8a7c8a37e
Instruction Fuzzy Hash: BAD0129BF8406117D79616ACB42826C5A83E7D96E7BCA016AEA07D3384C9125C720792

Function 06B03721 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad454e363e74c55f608244d01206c4c9a4e27fb334741075ae6dbb0d6860373c
Instruction ID: c05c2ca8fd9063e5125c41fee3eb71578058eaadec24388163a2787384d94686
Opcode Fuzzy Hash: ad454e363e74c55f608244d01206c4c9a4e27fb334741075ae6dbb0d6860373c
Instruction Fuzzy Hash: 58C080201193C09FD302A3142C06DA23F214F97640F050083F1518A083C3450534C272

Function 06B0DFD1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3322414064.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65dcc91ed607218f6869f19ac1cd146c7c18282948f68cc27e892af555e94c27
Instruction ID: ca62b56cab18bcb2f4214a0d55b3e2734922eae15b9e8a1a495d11b285d531f6
Opcode Fuzzy Hash: 65dcc91ed607218f6869f19ac1cd146c7c18282948f68cc27e892af555e94c27
Instruction Fuzzy Hash: 69C09B3154F7D09FDF0257308C0D9853F16DF5271875501C6A3468F072DB224015CBA1

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Temp\Tmp59F0.tmp

C:\Users\user\AppData\Local\Temp\Tmp5A01.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Network Port Distribution

Windows Analysis Report
file.exe

Function 007F018D Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Function 004FF1E8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00502C21 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Function 0050C20E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38
memorysynchronizationthreadCOMMON

Function 004FC2E9 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00504F3F Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 004FF682 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Function 00504B43 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Function 004FF2B3 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE