Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1445897
MD5:	e154829a16292c782b579d217e0ea8bf
SHA1:	5d2fb1535930184e7212b5fb780c638f32a03cee
SHA256:	132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Snort IDS alert for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6864 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E154829A16292C782B579D217E0EA8BF)

RegAsm.exe (PID: 6032 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["5.42.65.115:40551"], "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.1755940383.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: file.exe PID: 6864	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6032	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6032	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.3e0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Snort Signatures

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 5.42.65.115

Timestamp:	05/22/24-18:20:00.737450
SID:	2046045
Source Port:	49730
Destination Port:	40551
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 5.42.65.115 - Destination IP: 192.168.2.4

Timestamp:	05/22/24-18:20:00.932379
SID:	2043234
Source Port:	40551
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.65.115

Timestamp:	05/22/24-18:20:12.066922
SID:	2043231
Source Port:	49730
Destination Port:	40551
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 5.42.65.115 - Destination IP: 192.168.2.4

Timestamp:	05/22/24-18:20:06.193796
SID:	2046056
Source Port:	40551
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 1.2.RegAsm.exe.400000.0.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["5.42.65.115:40551"], "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003F4493 FindFirstFileExW,

0_2_003F4493

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.4:49730 -> 5.42.65.115:40551
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49730 -> 5.42.65.115:40551
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 5.42.65.115:40551 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 5.42.65.115:40551 -> 192.168.2.4:49730

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 5.42.65.115:40551

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 5.42.65.115:40551

Source: Joe Sandbox View

ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU

Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.115

Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: RegAsm.exe, 00000001.00000002.1756284252.0000000000CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adp/1.0//
Source: RegAsm.exe, 00000001.00000002.1756284252.0000000000CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsofo/1.2/R
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: RegAsm.exe, 00000001.00000002.1757758189.00000000030C0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002D42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002D42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002D42000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002D42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002D42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Responsean
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002D42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002D42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002D42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002D42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002D42000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002D42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002EE6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004094000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002F65000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.1755940383.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002EE6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004094000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002F65000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002EE6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004094000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002F65000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002EE6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004094000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002F65000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002EE6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004094000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002F65000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004094000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002EE6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002F65000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002EE6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004094000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002F65000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002EE6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004094000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002F65000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RegAsm.exe, 00000001.00000002.1757758189.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002EE6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004094000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002F65000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp9897.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp98C7.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F6AF8	0_2_003F6AF8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F3560	0_2_003F3560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00E3DC74	1_2_00E3DC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_064567D8	1_2_064567D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0645A3D8	1_2_0645A3D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06453F50	1_2_06453F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06456FE8	1_2_06456FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06456FF8	1_2_06456FF8

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 003E51D0 appears 48 times

Source: file.exe, 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenameChazan.exe8 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .data ZLIB complexity 0.9890492263349514

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/5@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Mutant created: NULL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\Tmp9897.tmp

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.1.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E4964 push ecx; ret	0_2_003E4977
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0645E060 push es; ret	1_2_0645E070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0645ECF2 push eax; ret	1_2_0645ED01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06453B4F push dword ptr [esp+ecx*2-75h]; ret	1_2_06453B53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_064549AB push FFFFFF8Bh; retf	1_2_064549AD

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2900000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 861			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 5014			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6620	Thread sleep time: -16602069666338586s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3140	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003F4493 FindFirstFileExW,

0_2_003F4493

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: RegAsm.exe, 00000001.00000002.1764671889.00000000054C2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllii

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003E8F06 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_003E8F06

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003EC35D mov ecx, dword ptr fs:[00000030h]		0_2_003EC35D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F560E mov eax, dword ptr fs:[00000030h]		0_2_003F560E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003F7C0D GetProcessHeap,

0_2_003F7C0D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5102 SetUnhandledExceptionFilter,	0_2_003E5102
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5237 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_003E5237
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E8F06 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_003E8F06
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E4FA6 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_003E4FA6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BB018D CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

0_2_00BB018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 84E008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003E4CCC cpuid

0_2_003E4CCC

Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_003EF01F
Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_003F7047
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_003F78DC
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_003F79AB
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_003F72E9
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_003F7334
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_003F73CF
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_003F745A
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_003EF545
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_003F76AD
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_003F77D6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003E4EA0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_003E4EA0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1755940383.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6032, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6032, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1755940383.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6032, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	241 Security Software Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Install Root Certificate	DCSync	134 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	HEUR/AGEN.1317026
file.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23ResponseD	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	URL Reputation	safe
http://tempuri.org/Entity/Id4	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://ns.adp/1.0//	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	RegAsm.exe, 00000001.00000002.1757758189.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004094000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	RegAsm.exe, 00000001.00000002.1757758189.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002EE6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004094000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002F65000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004078000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14ResponseD	RegAsm.exe, 00000001.00000002.1757758189.0000000002D42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	RegAsm.exe, 00000001.00000002.1757758189.0000000002D42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12Response	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21Response	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8	RegAsm.exe, 00000001.00000002.1757758189.0000000002D42000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id4	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id7	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13ResponseD	RegAsm.exe, 00000001.00000002.1757758189.0000000002D42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15Response	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6Response	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	file.exe, 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.1755940383.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9Response	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegAsm.exe, 00000001.00000002.1757758189.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002EE6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004094000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002F65000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004078000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24Response	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	RegAsm.exe, 00000001.00000002.1757758189.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002EE6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004094000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002F65000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1759891500.0000000004078000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21ResponseD	RegAsm.exe, 00000001.00000002.1757758189.0000000002D42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ns.adp/1.0//	RegAsm.exe, 00000001.00000002.1756284252.0000000000CDE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16Response	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id18	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Response	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15ResponseD	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10Response	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11ResponseD	RegAsm.exe, 00000001.00000002.1757758189.00000000030C0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8Response	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17ResponseD	RegAsm.exe, 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	RegAsm.exe, 00000001.00000002.1757758189.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.42.65.115	unknown	Russian Federation		39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1445897
Start date and time:	2024-05-22 18:19:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 98 Number of non-executed functions: 55
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, 4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:20:08	API Interceptor	30x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
5.42.65.115	Pp8XG0Vz4D.exe	Get hash	malicious	GCleaner	Browse	5.42.65.115/advdlc.php
	mxsujj4FZz.exe	Get hash	malicious	GCleaner, RedLine	Browse	5.42.65.115/advdlc.php
	UzMahCzo58.exe	Get hash	malicious	LummaC, GCleaner, LummaC Stealer	Browse	5.42.65.115/advdlc.php
	hkXE3abs6j.exe	Get hash	malicious	GCleaner, RedLine	Browse	5.42.65.115/advdlc.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.115
	2T6MGxlKZT.exe	Get hash	malicious	SmokeLoader	Browse	5.42.96.170
	file.exe	Get hash	malicious	Unknown	Browse	5.42.66.10
	http://0nline.jjwconstructlon.com	Get hash	malicious	HTMLPhisher	Browse	5.42.65.53
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.85
	https://url12.mailanyone.net/scanner?m=1s9PCz-0000cD-4j&d=4%7Cmail%2F90%2F1716296400%2F1s9PCz-0000cD-4j%7Cin12g%7C57e1b682%7C11949542%7C14589158%7C664C9C811D87B03FE2E6472997A0C22E&o=%2Fphtl%3A%2Fatsnhtaageeteoilogt.rgsigc%2Faz.&s=1YKQiaLIfHH0tTbjCAvEAnTGAIU	Get hash	malicious	HTMLPhisher	Browse	5.42.65.53
	https://url12.mailanyone.net/scanner?m=1s9PCz-0000cD-4j&d=4%7Cmail%2F90%2F1716296400%2F1s9PCz-0000cD-4j%7Cin12g%7C57e1b682%7C11949542%7C14589158%7C664C9C811D87B03FE2E6472997A0C22E&o=%2Fphtl%3A%2Fatsnhtaageeteoilogt.rgsigc%2Faz.&s=1YKQiaLIfHH0tTbjCAvEAnTGAIU	Get hash	malicious	HTMLPhisher	Browse	5.42.65.53
	https://url12.mailanyone.net/scanner?m=1s9PCz-0000cD-4j&d=4%7Cmail%2F90%2F1716296400%2F1s9PCz-0000cD-4j%7Cin12g%7C57e1b682%7C11949542%7C14589158%7C664C9C811D87B03FE2E6472997A0C22E&o=%2Fphtl%3A%2Fatsnhtaageeteoilogt.rgsigc%2Faz.&s=1YKQiaLIfHH0tTbjCAvEAnTGAIU	Get hash	malicious	HTMLPhisher	Browse	5.42.65.53
	file.exe	Get hash	malicious	RisePro Stealer	Browse	5.42.96.64
	8a180cbdd2a7a7b4f60d93c574bee9248b17d5c1cb782850441a41fd6db0727a_dump.exe	Get hash	malicious	RedLine	Browse	5.42.65.85

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:28 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.4556070346954355
Encrypted:	false
SSDEEP:	48:8S0dZTBnxRYrnvPdAKRkdAGdAKRFdAKR/U:8SyK
MD5:	76EA8642EDFC0D70B8C0F0B5D9C1784A
SHA1:	C23DCA143ED074418571E27A2E99C7BAB5A3703A
SHA-256:	1B98DCB6FD1A24A0B051D6F6E1A4261ABC071096940758EAAFBA87DEA3656695
SHA-512:	D1B67DC5D7089CB11D10C1138E785E6C5EF6FAF92CF1C48C7A24713122B7856DC9C2C9B393D64C2B66B86CDAD9B5CC3A88AEB0D2DC70124B67C72EBEE3AB9771
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,....)..........q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW5`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWO`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWO`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWO`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDWH`..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlq0
MD5:	0C1110E9B7BBBCB651A0B7568D796468
SHA1:	7AEE00407EE27655FFF0ADFBC96CF7FAD9610AAA
SHA-256:	112E21404A85963FB5DF8388F97429D6A46E9D4663435CC86267C563C0951FA2
SHA-512:	46E37552764B4E61006AB99F8C542D55B2418668B097D3C6647D306604C3D7CA3FAF34F8B4121D94B0E7168295B2ABEB7C21C3B96F37208943537B887BC81590
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\Tmp9897.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp98C7.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.711295641924988
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	470'528 bytes
MD5:	e154829a16292c782b579d217e0ea8bf
SHA1:	5d2fb1535930184e7212b5fb780c638f32a03cee
SHA256:	132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf
SHA512:	d0acbc1d810f628107e095959a2c53ef6e58adcc8631f1ab16353b1294b7f51f13b1ff9936ab5e86aff2d3c4fad9c56f3df263d9f7b27de8ffa3cd508537a300
SSDEEP:	12288:mQJRsrrQqYvbeUVOyJ3GJNu0ADIJTls9tJBKM1I59rM:akkyJoNYDOsrqM259A
TLSH:	B6A4F181B0C08072EA73153609E4D6F4AE7EFD704EA69D9F77484BBE5F301819A21B67
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......jL$..-J,.-J,.-J,._I-"-J,._O-.-J,._N-;-J,._K---J,.-K,u-J,..N-<-J,..I-:-J,..O-`-J,..O-/-J,..H-/-J,Rich.-J,........PE..L.....Nf...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40490e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x664E1414 [Wed May 22 15:49:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3253afb4f76368b87a5ee602b0490ec8

Entrypoint Preview

Instruction
call 00007FDD6086DA6Fh
jmp 00007FDD6086D309h
push ebp
mov ebp, esp
jmp 00007FDD6086D49Fh
push dword ptr [ebp+08h]
call 00007FDD608767C5h
pop ecx
test eax, eax
je 00007FDD6086D4A1h
push dword ptr [ebp+08h]
call 00007FDD6087348Eh
pop ecx
test eax, eax
je 00007FDD6086D478h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007FDD6086A934h
jmp 00007FDD6086DD62h
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007FDD6086DD74h
pop ecx
pop ebp
ret
cmp ecx, dword ptr [00473500h]
jne 00007FDD6086D493h
ret
jmp 00007FDD6086DD90h
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007FDD6086D469h
jmp 00007FDD6086D472h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00473500h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00473500h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2599c	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x76000	0x1950	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x23fc8	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x23f08	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1d000	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1a59f	0x1a600	958a190d2e286e394b8f216995317189	False	0.5829939277251185	data	6.602027588555361	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.bSs	0x1c000	0x315	0x400	6e172757ba390471c9226323f78cdc03	False	0.6591796875	data	5.456564594277736	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1d000	0x90d0	0x9200	c16a9693e3f1bd814224ee07625ccb81	False	0.390089897260274	data	4.688642176445258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x27000	0x4e214	0x4d400	f82928d5af1ad00b42833e2c6bb5d9d0	False	0.9890492263349514	data	7.992045422958882	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x76000	0x1950	0x1a00	372541e493b33588efc8de3f292b1268	False	0.7569110576923077	data	6.484945587212282	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

CloseHandle, WaitForSingleObjectEx, CreateThread, VirtualAlloc, GetModuleHandleA, GetProcAddress, EncodePointer, DecodePointer, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, MultiByteToWideChar, WideCharToMultiByte, LCMapStringEx, GetStringTypeW, GetCPInfo, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetModuleHandleW, GetCurrentProcess, TerminateProcess, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetProcessHeap, HeapSize, WriteConsoleW

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/22/24-18:20:00.737450	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49730	40551	192.168.2.4	5.42.65.115
05/22/24-18:20:00.932379	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	40551	49730	5.42.65.115	192.168.2.4
05/22/24-18:20:12.066922	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49730	40551	192.168.2.4	5.42.65.115
05/22/24-18:20:06.193796	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	40551	49730	5.42.65.115	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 22, 2024 18:20:00.041604996 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:00.046922922 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:00.047151089 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:00.055115938 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:00.097771883 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:00.709685087 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:00.737449884 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:00.742768049 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:00.932379007 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:00.975501060 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:05.994251013 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:06.001460075 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.193795919 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.195012093 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.195228100 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:06.197375059 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.199944973 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.200128078 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:06.202553988 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.245553970 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.245712042 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:06.315599918 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:06.320960999 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.514353037 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.569255114 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:06.576057911 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:06.581509113 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.581584930 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:06.586414099 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.586446047 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.586473942 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.586491108 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:06.586529970 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.586560011 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.586587906 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.586616039 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.591240883 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.591270924 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.591300964 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.595953941 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.595969915 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.595982075 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.653402090 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.869519949 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:06.912880898 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:06.977698088 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:06.987680912 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.178246975 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.225464106 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.226576090 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.235788107 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.430304050 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.475471973 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.541631937 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.552222013 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.552468061 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.557775974 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.557807922 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.557840109 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.557872057 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.557877064 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.557900906 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.557902098 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.557929039 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.557949066 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.557956934 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.557977915 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.557985067 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.557997942 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.558012962 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.558029890 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.558043957 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.558059931 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.558072090 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.558093071 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.558099985 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.558128119 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.558128119 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.558139086 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.558156013 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.558178902 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.558182955 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.558193922 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.558263063 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.562515974 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.562618971 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.569880009 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.569996119 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.576176882 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.576205969 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.576232910 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.576241016 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.576261044 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.576268911 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.576289892 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.576306105 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.576318979 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.576340914 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.576348066 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.576363087 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.576375008 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.576399088 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.576406002 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.576432943 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.576435089 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.576452971 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.576459885 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.576487064 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.576515913 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.576543093 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.576569080 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.580967903 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.580996037 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.581022978 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.581049919 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.581077099 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.581105947 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.581135988 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.581162930 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.581190109 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.581217051 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.581243038 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.581269026 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.581295967 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.581321955 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.581350088 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.581376076 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.581403017 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.581429958 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.581456900 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.584811926 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.585789919 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.585819960 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.585848093 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.585850000 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.585875988 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.585877895 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.585900068 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.585906982 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.585922956 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.585936069 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.585963011 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.585964918 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.585987091 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.585992098 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.586009979 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.586019993 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.586046934 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.586077929 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.590567112 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.590595007 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.590622902 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.590622902 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.590651989 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.590655088 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.590672016 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.590681076 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.590708971 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.590732098 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.590737104 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.590764999 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.590768099 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.590792894 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.590821981 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.590831041 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.590833902 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.590859890 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.590928078 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.591963053 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.591990948 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.592015028 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.592016935 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.592045069 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.592072010 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.592098951 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.592125893 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.592153072 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.592180014 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.592205048 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.592223883 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.592231989 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.592258930 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.592259884 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.592278957 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.592288017 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.592309952 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.592317104 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.592334986 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.592344999 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.592372894 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.592380047 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.592401981 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.592405081 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.592433929 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.592437029 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.592456102 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.592461109 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.592473030 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.592488050 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.592509031 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.592514992 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.592540026 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.592556953 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.601309061 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.601341963 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.601368904 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.601372004 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.601391077 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.601397038 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.601424932 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.601432085 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.601452112 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.601458073 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.601479053 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.601479053 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.601505995 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.601509094 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.601526976 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.601536989 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.601563931 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.601564884 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.601588964 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.601608038 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.603084087 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.603135109 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.603152037 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.603166103 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.603183031 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.603194952 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.603219032 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.603224039 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.603250027 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.603252888 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.603269100 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.603281975 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.603305101 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.603310108 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.603332043 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.603338957 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.603368044 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.603372097 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.603389978 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.603395939 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.603424072 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.603427887 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.603451014 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.603452921 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.603478909 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.603487015 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.603507042 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.603526115 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.603535891 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.603558064 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.603564024 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.603583097 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.603591919 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.603612900 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.603620052 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.603637934 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.603647947 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.603674889 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604238033 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604271889 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604300022 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604326963 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604353905 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604382038 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604408979 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604437113 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604464054 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604490995 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604517937 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604546070 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604567051 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.604573965 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604607105 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604610920 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.604629040 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.604633093 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604649067 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.604660988 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604687929 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.604687929 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604711056 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.604717970 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604736090 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.604746103 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604773998 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604774952 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.604794979 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.604800940 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604820967 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.604830980 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.604861975 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.604893923 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.606188059 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.606247902 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.608931065 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.608959913 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.608985901 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.608988047 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.609004974 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.609015942 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.609034061 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.609044075 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.609071970 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.609072924 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.609092951 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.609100103 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.609126091 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.609127998 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.609148979 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.609153986 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.609179974 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.609180927 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.609205008 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.609209061 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.609225988 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.609236956 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.609263897 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.609266996 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.609292030 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.609293938 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.609313011 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.609321117 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.609335899 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.609349012 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.609375954 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.609379053 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.609399080 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.609402895 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.609421015 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.609431028 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.609450102 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.609458923 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.609489918 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.609492064 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.609512091 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.609533072 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.610980988 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611013889 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611036062 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.611042976 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611061096 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.611071110 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611097097 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611099005 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.611124992 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611154079 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611181021 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611207008 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611233950 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611262083 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611289978 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611316919 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611344099 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611371040 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611397982 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611424923 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611452103 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611479044 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611505032 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611532927 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611542940 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.611560106 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.611591101 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.611614943 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.613058090 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.613091946 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.613118887 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.613126993 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.613147020 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.613153934 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.613174915 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.613195896 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.613203049 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.613229990 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.613234043 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.613253117 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.613257885 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.613274097 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.613286972 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.613308907 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.613315105 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.613336086 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.613343000 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.613369942 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.613370895 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.613390923 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.613398075 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.613413095 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.613425970 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.613450050 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.613454103 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.613466978 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.613481998 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.613503933 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.613509893 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.613531113 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.613538027 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.613555908 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.613567114 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.613585949 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.613609076 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.618443012 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.618472099 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.618494987 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.618519068 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.618537903 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.618546963 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.618573904 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.618592024 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.618601084 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.618616104 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.618628979 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.618654966 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.618658066 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.618673086 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.618685007 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.618702888 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.618712902 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.618731976 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.618741035 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.618755102 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.618769884 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.618791103 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.618798018 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.618815899 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.618827105 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619431019 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619461060 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619487047 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619514942 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619540930 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619568110 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619595051 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619621992 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619648933 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619676113 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619703054 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619729996 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619756937 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619784117 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619812012 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619844913 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619872093 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619899988 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619927883 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619954109 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.619955063 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.619981050 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.620033026 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.621593952 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.621628046 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.621655941 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.621655941 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.621680975 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.621682882 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.621706009 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.621711016 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.621728897 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.621738911 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.621751070 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.621767044 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.621793985 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.621794939 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.621813059 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.621824026 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.621851921 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.621857882 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.621877909 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.621880054 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.621901035 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.621906996 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.621926069 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.621934891 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.621963024 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.621973991 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.621989965 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.622013092 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.622016907 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.622031927 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.622045994 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.622070074 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.622072935 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.622095108 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.622101068 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.622124910 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.622128010 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.622148037 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.622155905 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.622176886 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.622183084 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.622205973 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.622235060 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.623706102 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.623739004 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.623764038 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.623768091 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.623783112 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.623795986 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.623821020 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.623823881 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.623846054 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.623852015 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.623879910 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.623907089 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.623934031 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.623961926 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.625906944 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.625936031 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.625963926 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.625991106 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.626019001 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.626046896 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.626074076 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.626100063 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.626127958 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.626153946 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.626179934 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.626207113 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.626234055 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.626261950 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.626291037 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.626317024 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.626344919 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.626370907 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.626399040 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.626425028 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.626454115 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.626507998 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.629352093 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.629384995 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.629415035 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.629451036 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.672815084 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.673067093 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.673269987 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.673413038 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.711258888 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.711570978 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.711570978 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.711767912 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.716767073 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.763511896 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.763552904 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.763581991 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.763609886 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:07.763921976 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:07.808109045 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:08.614713907 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:08.619342089 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:08.625715017 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:08.818742037 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:08.866105080 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:09.233766079 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:09.239377975 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:09.244223118 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:09.244277000 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:09.528629065 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:09.554436922 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:09.559642076 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:09.749232054 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:09.750848055 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:09.756304026 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:09.945738077 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:09.949565887 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:09.954616070 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:10.144108057 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:10.147768021 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:10.153278112 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:10.343456984 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:10.397492886 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:10.404406071 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:10.449954033 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:10.639611006 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:10.641222000 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:10.646224022 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:10.839525938 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:10.843481064 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:10.849813938 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:11.041181087 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:11.044030905 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:11.049491882 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:11.240643024 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:11.242731094 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:11.248182058 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:11.442259073 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:11.452106953 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:11.463579893 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:11.663566113 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:11.667942047 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:11.673365116 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:11.678178072 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:11.678229094 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:11.678258896 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:11.678287029 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:11.678316116 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:11.727658033 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:11.727701902 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:11.868026972 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:11.868587971 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:11.873720884 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:12.066140890 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:12.066921949 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:12.072355986 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:12.262933016 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:12.300235033 CEST	49730	40551	192.168.2.4	5.42.65.115
May 22, 2024 18:20:12.581267118 CEST	40551	49730	5.42.65.115	192.168.2.4
May 22, 2024 18:20:12.581445932 CEST	49730	40551	192.168.2.4	5.42.65.115

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 22, 2024 18:20:22.466888905 CEST	53	60475	1.1.1.1	192.168.2.4
May 22, 2024 18:20:48.030168056 CEST	53	58739	162.159.36.2	192.168.2.4
May 22, 2024 18:20:48.572839975 CEST	53	58327	1.1.1.1	192.168.2.4

Target ID:	0
Start time:	12:19:57
Start date:	22/05/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x3e0000
File size:	470'528 bytes
MD5 hash:	E154829A16292C782B579D217E0EA8BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:19:58
Start date:	22/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x730000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000001.00000002.1755940383.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000001.00000002.1757758189.0000000002C49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	0.5%
Signature Coverage:	1.6%
Total number of Nodes:	1520
Total number of Limit Nodes:	14

Executed Functions

Function 00BB018D Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00BB02FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00BB030F
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 00BB032D
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00BB0351
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 00BB037C
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 00BB03D4
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 00BB041F
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00BB045D
Wow64SetThreadContext.KERNEL32(?,?), ref: 00BB0499
ResumeThread.KERNELBASE(?), ref: 00BB04A8

Strings

aryA, xrefs: 00BB01D3
ress, xrefs: 00BB0217
GetP, xrefs: 00BB020F
Load, xrefs: 00BB01CB

Memory Dump Source

Source File: 00000000.00000002.1622771583.0000000000BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: GetP$Load$aryA$ress
API String ID: 2687962208-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 703787a027bc7e031c0ea5087f489b5d519ee728bcd9b767fa7a999b3e18d142
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 03B1E67664024AAFDB60CF68CC80BEA77E5FF88714F158564EA0CAB341D774FA418B94

Function 003F560E Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3a586ec2da16d7fd3ee7ee03ae3402aab8ac5a3c6cbba84838bbe677f8115f
Instruction ID: 4a8786e5b9fdbf7e8fc458f9f03c35bb8d7d080b62654e6ccc57edfee49179ec
Opcode Fuzzy Hash: 6d3a586ec2da16d7fd3ee7ee03ae3402aab8ac5a3c6cbba84838bbe677f8115f
Instruction Fuzzy Hash: C7E08C32912278EBCB26DB89C904D9AF3ECEB44B00B5500AAF611D3200C2B0DE00DBD0

Function 003EC35D Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c992419eee8842309e7582ba631cfc6caef1f6ffe052a819ae54955aa5ef9da
Instruction ID: 1c5742d41ce44d51f816b6f66da8cc527e96286b5d446590ddae939047a5eb02
Opcode Fuzzy Hash: 4c992419eee8842309e7582ba631cfc6caef1f6ffe052a819ae54955aa5ef9da
Instruction Fuzzy Hash: 2DC08C380109A047CE2B891892713BE3354A3977C2F80258CC6034BAA2CA1E9C83DE00

Function 003EF1E8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,04B05F4C,?,003EF2F5,?,?,00000000,00000000), ref: 003EF2A9

Strings

ext-ms-, xrefs: 003EF253
api-ms-, xrefs: 003EF23F

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 2fb4a96eb1ce9b4c6ccd8ad87139896841ddaafeb56da497c2df5dfdbed70f65
Instruction ID: 763db451c62e50090423a505538f7092b1ce2cca6fa344304a0660861fca5b12
Opcode Fuzzy Hash: 2fb4a96eb1ce9b4c6ccd8ad87139896841ddaafeb56da497c2df5dfdbed70f65
Instruction Fuzzy Hash: 57213D3DA00271AFCB239722EC45AAA376D9F41764F260730FA05A72D1EBB0ED01C6D0

Function 003FC20E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040,ole,00000000,?,?,003FC2FD), ref: 003FC222

Part of subcall function 003FC168: _Deallocate.LIBCONCRT ref: 003FC203

CreateThread.KERNELBASE(00000000,00000000,00000188,00407018,00000000,00000000), ref: 003FC256
WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,?,?,003FC2FD), ref: 003FC262
CloseHandle.KERNEL32(00000000,?,?,003FC2FD), ref: 003FC269

Strings

ole, xrefs: 003FC211

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: AllocCloseCreateDeallocateHandleObjectSingleThreadVirtualWait
String ID: ole
API String ID: 440434604-1213916275
Opcode ID: 388cf06e6824535b4362e7df02519d3883116eddcbc4eb0dc5800b2351d9c9af
Instruction ID: d97a8070d0929c1dbb7da288e7ba6aa47fd964dac08dbab48bcd3f102d70f017
Opcode Fuzzy Hash: 388cf06e6824535b4362e7df02519d3883116eddcbc4eb0dc5800b2351d9c9af
Instruction Fuzzy Hash: B1F0A77224111C7FD1122766AC4DEBB3A1CDB877EAF410121FB05950D2CE162D0697B9

Function 003F2C21 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 003F2CA8
__alloca_probe_16.LIBCMT ref: 003F2D69
__freea.LIBCMT ref: 003F2DD0

Part of subcall function 003F2001: HeapAlloc.KERNEL32(00000000,003E21BA,?,?,003E5A1A,?,?,?,00000000,?,003E19F6,003E21BA,?,?,?,?), ref: 003F2033

__freea.LIBCMT ref: 003F2DE5
__freea.LIBCMT ref: 003F2DF5

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 8470fec4c76af44910d0860821ab33e7aaa9767f6f3b835b1daa4c03c117dde2
Instruction ID: c3f244d4a18619a65e61a419265f20eb59ed80e55e2bb043777293179444aeed
Opcode Fuzzy Hash: 8470fec4c76af44910d0860821ab33e7aaa9767f6f3b835b1daa4c03c117dde2
Instruction Fuzzy Hash: 5151B07260025EEFEF279F65CC41EBB7AA9EF48350B160129FE14DA250EB31CC5097A0

Function 003EC2E9 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,003EC2E3,00000000,003E8F02,?,?,04B05F4C,003E8F02,?), ref: 003EC2FA
TerminateProcess.KERNEL32(00000000,?,003EC2E3,00000000,003E8F02,?,?,04B05F4C,003E8F02,?), ref: 003EC301
ExitProcess.KERNEL32 ref: 003EC313

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0fc937b8146f12d6a1bcde26dabe5a7e5d5fa71e388417b5741b0c708917f839
Instruction ID: 81905b2dd1da848d905303faa98c6ac9d1d82e1b6a68659bb10502c761194405
Opcode Fuzzy Hash: 0fc937b8146f12d6a1bcde26dabe5a7e5d5fa71e388417b5741b0c708917f839
Instruction Fuzzy Hash: C6D06775010559ABCF032F61ED0D96D3F2AAA45345F049110B94989171CF36D953DA80

Function 003F4F3F Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003F4A6F: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 003F4A9A

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,003F4D86,?,00000000,?,00000000,?), ref: 003F4FA0
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,003F4D86,?,00000000,?,00000000,?), ref: 003F4FE2

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: e4b6421db404eb045acd942e92c2903c30a9fc340bd15b90c43e90aa30fa1cdf
Instruction ID: a791dc443d5c0b273b938014f471507182df7fabe6e0dc5a070ca3e146fbc5db
Opcode Fuzzy Hash: e4b6421db404eb045acd942e92c2903c30a9fc340bd15b90c43e90aa30fa1cdf
Instruction Fuzzy Hash: D3513870A0074A5EDB22CF35C841ABBFBF5EF51304F15416ED3868B252EB759945CB90

Function 003EF682 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,003F2D0F,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 003EF6B6
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,003F2D0F,?,?,00000000,?,00000000), ref: 003EF6D4

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 20d22a6f3bf9e1d8af44e557bd82e86be42acd2e0bd2a9ba7d2118e6e6a5ac7e
Instruction ID: d092157bc3e84a384dc5513b85b348d4677aac2bf88490a7c2a48298394871da
Opcode Fuzzy Hash: 20d22a6f3bf9e1d8af44e557bd82e86be42acd2e0bd2a9ba7d2118e6e6a5ac7e
Instruction Fuzzy Hash: 41F0683200016AFBCF136F91DC09DDE3E2ABF483A0F058120FA1925170CA72C831EB94

Function 003F4B43 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,003F4D92,003F4D86,00000000), ref: 003F4B75

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 80ab904d840afe9f226b18d3aac90102c8d3c2b36519366db4b7a285e62fa9ad
Instruction ID: 16275b5c5fd506d73ef08672dd00f30b32fdc6702322fa45075d32f3f4b69e8b
Opcode Fuzzy Hash: 80ab904d840afe9f226b18d3aac90102c8d3c2b36519366db4b7a285e62fa9ad
Instruction Fuzzy Hash: 815147B150425CAADB238F28CD84BF77BBCEB55304F2445A9E69AD7182D3359E46CB20

Function 003EF2B3 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95cafbff44b9013544a653d022d504debc53a8a05d5e551ae07eea4ee01ea8a8
Instruction ID: 514bf4f5724ce0ef188b6844d0a3c5e39c3ac3b4622018fb581ecd3a5b152f51
Opcode Fuzzy Hash: 95cafbff44b9013544a653d022d504debc53a8a05d5e551ae07eea4ee01ea8a8
Instruction Fuzzy Hash: 2401413B200269AF9B23CE6BEC0095A379AABC43217298230FA10CB4D5EB30D9018390

Non-executed Functions

Function 003F79AB Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003EEC90: GetLastError.KERNEL32(?,00000008,003F3196,00000000,003E9083), ref: 003EEC94
Part of subcall function 003EEC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 003EED36

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 003F7AB7
IsValidCodePage.KERNEL32(00000000), ref: 003F7B00
IsValidLocale.KERNEL32(?,00000001), ref: 003F7B0F
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 003F7B57
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 003F7B76

Strings

0@, xrefs: 003F7A64

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: 0@
API String ID: 415426439-1461294488
Opcode ID: 450aa2becccaf4794d8e8433e6ed24c69a4efcd6bf58848b17bd92b47094f5e6
Instruction ID: fd5c9fb852134c998c61249f39e7c8549351149a0dfc38e4583c51663d4bc128
Opcode Fuzzy Hash: 450aa2becccaf4794d8e8433e6ed24c69a4efcd6bf58848b17bd92b47094f5e6
Instruction Fuzzy Hash: 8E517371A0421EAFDF12DFA5CC45EBE77B9AF44700F1A4429E614EB290EB71DA00CB61

Function 003F7047 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003EEC90: GetLastError.KERNEL32(?,00000008,003F3196,00000000,003E9083), ref: 003EEC94
Part of subcall function 003EEC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 003EED36

GetACP.KERNEL32(?,?,?,?,?,?,003ECC9C,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 003F7108
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,003ECC9C,?,?,?,00000055,?,-00000050,?,?), ref: 003F7133
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 003F7296

Strings

0@, xrefs: 003F70BE
utf8, xrefs: 003F7205

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: 0@$utf8
API String ID: 607553120-1799009391
Opcode ID: b1a402e6b370926f058a016807eb69b77f5ca608ec4c2c26593321bf86fb6036
Instruction ID: 33b9ec3e553e9a13eeaaf6ee193f8368d8b548c5ff4028e947a6ad215052e69f
Opcode Fuzzy Hash: b1a402e6b370926f058a016807eb69b77f5ca608ec4c2c26593321bf86fb6036
Instruction Fuzzy Hash: 0471D671A0420EBAEB26AB75DC46B7773ACEF45710F25482AFB05DB181EB74E940C760

Function 003F77D6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,003F7AF4,00000002,00000000,?,?,?,003F7AF4,?,00000000), ref: 003F786F
GetLocaleInfoW.KERNEL32(?,20001004,003F7AF4,00000002,00000000,?,?,?,003F7AF4,?,00000000), ref: 003F7898
GetACP.KERNEL32(?,?,003F7AF4,?,00000000), ref: 003F78AD

Strings

OCP, xrefs: 003F782A
ACP, xrefs: 003F77F4

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 6e3620f37653cfa3a07fe8603e72aca4646765f94880d6834c0d686e70647940
Instruction ID: 78b81eefae434d4b6969552830d4f8ba961b94fd4a5ec868af30a6fa6bccb281
Opcode Fuzzy Hash: 6e3620f37653cfa3a07fe8603e72aca4646765f94880d6834c0d686e70647940
Instruction Fuzzy Hash: DD21BB31B08109A6E7368B54DA0EAB7776BEF54BE0B578038EB0AD7510E731DD41C390

Function 003E4FA6 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 003E4FB2
IsDebuggerPresent.KERNEL32 ref: 003E507E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 003E5097
UnhandledExceptionFilter.KERNEL32(?), ref: 003E50A1

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 71f9cf099cc2e388ea5e3d68ad1fd192eb309619660ab925a05b5b0d0e801070
Instruction ID: 42a1cc8367311572f8608bd1d24ffa8a77e8a83784a743d13264e6b49ee1c77b
Opcode Fuzzy Hash: 71f9cf099cc2e388ea5e3d68ad1fd192eb309619660ab925a05b5b0d0e801070
Instruction Fuzzy Hash: 72312975D05329DBDF21DF65D9897CDBBB8AF08304F1041AAE40CAB290EB709A85CF45

Function 003F745A Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 003EEC90: GetLastError.KERNEL32(?,00000008,003F3196,00000000,003E9083), ref: 003EEC94
Part of subcall function 003EEC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 003EED36

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003F74AE
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003F74F8
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003F75BE

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 4b6770595ce1955ddbc5125c2c29930e48405ba0f79fdb39d679535fb0ea2d41
Instruction ID: 37ca406eaa9a26f99f870286adefde81e1aacf7fa7da32eaee3721221a7e0e71
Opcode Fuzzy Hash: 4b6770595ce1955ddbc5125c2c29930e48405ba0f79fdb39d679535fb0ea2d41
Instruction Fuzzy Hash: 5561807191861B9FDB2A9F28CD82BBA77B8EF08300F114179EA19CA585E734D945CB50

Function 003E8F06 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 003E8FFE
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 003E9008
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 003E9015

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 115f1500fa36e598fc1dd2d975908756edb252ea66a10ac69d58b20cfad96934
Instruction ID: fb17317b89133a2992605e4d01cae2a56390feaebef2835f4f21aed7e0b41065
Opcode Fuzzy Hash: 115f1500fa36e598fc1dd2d975908756edb252ea66a10ac69d58b20cfad96934
Instruction Fuzzy Hash: 5331C87590122D9BCB21DF65D88979DBBB8BF08350F5042DAE41CA7291E7709F818F44

Function 003F3560 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,003F355B,?,?,?,?,?,?,00000000), ref: 003F378D

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d60cb5d6cff4e4e85e964eabfef3f1a5bb215f04de9963ca385ae57c144f989c
Instruction ID: 429883229d88c585e23de4029ef9e8e5c36fb3f5482e198d5c117ea95ee065cb
Opcode Fuzzy Hash: d60cb5d6cff4e4e85e964eabfef3f1a5bb215f04de9963ca385ae57c144f989c
Instruction Fuzzy Hash: D1B16C71210608DFDB16CF28C486B657BE0FF45364F268658E99ACF3A1C335EA85CB40

Function 003E4CCC Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 003E4CE2

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 1a967da8b9c5a08c2c67b1363a30d6496318c61f9229f1e25eea4b26254f3368
Instruction ID: daecda8054913d9f11d4e88ad15ce45ec5b076b917487ff319e4c1438cacd13c
Opcode Fuzzy Hash: 1a967da8b9c5a08c2c67b1363a30d6496318c61f9229f1e25eea4b26254f3368
Instruction Fuzzy Hash: A4518AB1A003599BDB15CF9AD8817AABBF4FB8C316F25857AD400EB392E374D940CB54

Function 003F4493 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc922789b4ca077627c6851aea2845801a19545944a171086393bd7e78a6fdc
Instruction ID: 67c1bcea64727d5b9a8d78e622de7cf9f909814b8a4a389cdf093b3ca78687db
Opcode Fuzzy Hash: 1cc922789b4ca077627c6851aea2845801a19545944a171086393bd7e78a6fdc
Instruction Fuzzy Hash: 3641A2B580421DAFDF21DF79CC89ABABBB9AF45304F1442D9E51CE7201EA359E858F10

Function 003F76AD Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 003EEC90: GetLastError.KERNEL32(?,00000008,003F3196,00000000,003E9083), ref: 003EEC94
Part of subcall function 003EEC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 003EED36

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003F7701

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 7c77fe13cf21f29eab672b889b4bac4f91e6c157667d87353b051a82627d295d
Instruction ID: bee4c665b8448f6df0ec09ea2761c5a4f2baa74eec6ea073eb2b3d613bb02e07
Opcode Fuzzy Hash: 7c77fe13cf21f29eab672b889b4bac4f91e6c157667d87353b051a82627d295d
Instruction Fuzzy Hash: 1421FC3151420A6BDF29AF15DD52A7A37ACEF44355F100079FE01CB245EB35DD04C750

Function 003F7334 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003EEC90: GetLastError.KERNEL32(?,00000008,003F3196,00000000,003E9083), ref: 003EEC94
Part of subcall function 003EEC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 003EED36

EnumSystemLocalesW.KERNEL32(003F745A,00000001,00000000,?,-00000050,?,003F7A8B,00000000,?,?,?,00000055,?), ref: 003F73A6

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8ed3dfdb86b092a6bbaf3166c334918caf48fdb4bbb9c07c7a90180fa16daeb1
Instruction ID: 36bd58e2d9cdde647b6b1d3ca2ce91fe5360fabaa2a39888494b1d70c672ae28
Opcode Fuzzy Hash: 8ed3dfdb86b092a6bbaf3166c334918caf48fdb4bbb9c07c7a90180fa16daeb1
Instruction Fuzzy Hash: 3F11E93A2047055FDB199F39C8915BABBA2FF80358B15882DEA4647B40E771B943D740

Function 003F78DC Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 003EEC90: GetLastError.KERNEL32(?,00000008,003F3196,00000000,003E9083), ref: 003EEC94
Part of subcall function 003EEC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 003EED36

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,003F7676,00000000,00000000,?), ref: 003F7908

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: ffcd40e91e410476752a7039410a48e5d327fd2193541345f32cb2174695f140
Instruction ID: 2d4bfb59f63c072c63c19592fa9f71315a455903a1f28cea135c86f635a1f723
Opcode Fuzzy Hash: ffcd40e91e410476752a7039410a48e5d327fd2193541345f32cb2174695f140
Instruction Fuzzy Hash: 1AF02D336041197BDB255B25CC05BBB775DEB40364F164468EE06A3184DFB0FD01C6D0

Function 003F73CF Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003EEC90: GetLastError.KERNEL32(?,00000008,003F3196,00000000,003E9083), ref: 003EEC94
Part of subcall function 003EEC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 003EED36

EnumSystemLocalesW.KERNEL32(003F76AD,00000001,00000000,?,-00000050,?,003F7A4F,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 003F7419

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 626e1039ce5b5913b3b75496f63477469eeecbadd2290df62c11b8e85a171d6a
Instruction ID: a000b8d97749c5e735c921bbd54a5bfaf39282bf80186090fb8ea17de2832aa3
Opcode Fuzzy Hash: 626e1039ce5b5913b3b75496f63477469eeecbadd2290df62c11b8e85a171d6a
Instruction Fuzzy Hash: C8F0F6363043095FDB265F3AD885A7A7F95FF80368F16842DFA058B690D6719C02D750

Function 003EF01F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003EA8B5: EnterCriticalSection.KERNEL32(?,?,003EE968,?,00405700,00000008,003EEB2C,?,?,?), ref: 003EA8C4

EnumSystemLocalesW.KERNEL32(003EF012,00000001,00405780,0000000C,003EF441,00000000), ref: 003EF057

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: a489375fb4ac36bd4af11b31e444891ee4746a78b8fa7b4c668670be485bea93
Instruction ID: d771446e16edc6b017aec24e355c1b000e257493343336c353a1e930251259b8
Opcode Fuzzy Hash: a489375fb4ac36bd4af11b31e444891ee4746a78b8fa7b4c668670be485bea93
Instruction Fuzzy Hash: B5F03C72A00354EFDB01EF99E842B9977B0FB44726F10413AE4119B2E1D7B599409B44

Function 003F72E9 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003EEC90: GetLastError.KERNEL32(?,00000008,003F3196,00000000,003E9083), ref: 003EEC94
Part of subcall function 003EEC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 003EED36

EnumSystemLocalesW.KERNEL32(003F7242,00000001,00000000,?,?,003F7AAD,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 003F7320

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 136b7a746430800f0d4a2617ba167cc25bdaf35eb42268c60d6dcfe18ea7134f
Instruction ID: a49191e9d54b6d8c9cfb7d7e57ce49284c50abba4af320516db9a8979f235671
Opcode Fuzzy Hash: 136b7a746430800f0d4a2617ba167cc25bdaf35eb42268c60d6dcfe18ea7134f
Instruction Fuzzy Hash: 20F0553A30020967CB069F36C805ABA7F94EFC1710F0B4459FF068B280C6329843C790

Function 003EF545 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,003ED804,?,20001004,00000000,00000002,?,?,003ECE04), ref: 003EF579

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 1a3e779a026bb4f2567e2067d9dc20a2c29209ac56d906c931c8d42de5cf6a5c
Instruction ID: d81858e01b9e1b6c8d7ea1798d04c28eb237e6ca01368ce13504623a4874ade5
Opcode Fuzzy Hash: 1a3e779a026bb4f2567e2067d9dc20a2c29209ac56d906c931c8d42de5cf6a5c
Instruction Fuzzy Hash: CEE04F3150116CBFCF136F62DC08EAE7E1AEF55750F014121FD05661A0CBB28D21AAD5

Function 003E5102 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000510E,003E477F), ref: 003E5107

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b382629eb152f63548fa5167cdb49d4193bc3edd61db702217bafac7eafc229c
Instruction ID: 49a3bcad03f9f15be93314ff118c8eb947c0367e69c87c7b1bfd906dee41384c
Opcode Fuzzy Hash: b382629eb152f63548fa5167cdb49d4193bc3edd61db702217bafac7eafc229c
Instruction Fuzzy Hash:

Function 003F7C0D Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 003F7C0D

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 851fbaeba42a3077030722f41c2b3a0b327a1e82c134d5afa346a7684481253a
Instruction ID: 35199c6b42aa9f4a172788974fdd838ff141fa0a73b6eb6aacb33a4f65589d81
Opcode Fuzzy Hash: 851fbaeba42a3077030722f41c2b3a0b327a1e82c134d5afa346a7684481253a
Instruction Fuzzy Hash: 1DA00170A12A018B97818F35AB193693FEAAA45692B05807AA405CA561EA648550AA05

Function 003F6AF8 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: cbaaabec83de36a4657d4e2579ea6f5932f932e3b3ad0a8d3ceb8f4902958bd6
Instruction ID: 49517c692fc342b87c47ac6f55e08129d477654046c97309e1b4deedebc824c2
Opcode Fuzzy Hash: cbaaabec83de36a4657d4e2579ea6f5932f932e3b3ad0a8d3ceb8f4902958bd6
Instruction Fuzzy Hash: 8CB1287560074A9BDB35AF29CC93AB7B3E9EF44308F14456DEB83CA680EA71A945C710

Function 003FC274 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 003E116F: __EH_prolog3_catch.LIBCMT ref: 003E1176
Part of subcall function 003E116F: _strlen.LIBCMT ref: 003E1188

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 003FC29C

Part of subcall function 003E1852: _strlen.LIBCMT ref: 003E186A

_strlen.LIBCMT ref: 003FC2B7
_strlen.LIBCMT ref: 003FC2CD
GetProcAddress.KERNEL32(00000000,?), ref: 003FC2EA

Part of subcall function 003FC20E: VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040,ole,00000000,?,?,003FC2FD), ref: 003FC222
Part of subcall function 003FC20E: CreateThread.KERNELBASE(00000000,00000000,00000188,00407018,00000000,00000000), ref: 003FC256
Part of subcall function 003FC20E: WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,?,?,003FC2FD), ref: 003FC262
Part of subcall function 003FC20E: CloseHandle.KERNEL32(00000000,?,?,003FC2FD), ref: 003FC269

Part of subcall function 003E1DFE: _Deallocate.LIBCONCRT ref: 003E1E0D

Strings

Cons, xrefs: 003FC2B1, 003FC2B6, 003FC2BE
ole, xrefs: 003FC2C7, 003FC2CC, 003FC2D4
kernel32.dll, xrefs: 003FC297
Free, xrefs: 003FC2A2
Madino Mino, xrefs: 003FC286

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: _strlen$Handle$AddressAllocCloseCreateDeallocateH_prolog3_catchModuleObjectProcSingleThreadVirtualWait
String ID: Cons$Free$Madino Mino$kernel32.dll$ole
API String ID: 4115190924-2348686229
Opcode ID: 86ec85611bd1f9744c081a93ad930fcd65e5cc07abfa0ce9c3aa6462245a19f7
Instruction ID: 637480126dc59b2ca47fbcb80c5300730a00286226a51dd8cff3ac0a02585bb2
Opcode Fuzzy Hash: 86ec85611bd1f9744c081a93ad930fcd65e5cc07abfa0ce9c3aa6462245a19f7
Instruction Fuzzy Hash: 2201A175E00259AA8B06FBA5EC4ACFF77B9EE84700B10012AF911AA1D2EF349941C665

Function 003E2307 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003E230E
std::_Lockit::_Lockit.LIBCPMT ref: 003E2318
int.LIBCPMT ref: 003E232F

Part of subcall function 003E2867: std::_Lockit::_Lockit.LIBCPMT ref: 003E2878
Part of subcall function 003E2867: std::_Lockit::~_Lockit.LIBCPMT ref: 003E2892

codecvt.LIBCPMT ref: 003E2352
std::_Facet_Register.LIBCPMT ref: 003E2369
std::_Lockit::~_Lockit.LIBCPMT ref: 003E2389
Concurrency::cancel_current_task.LIBCPMT ref: 003E2396

Strings

@DE, xrefs: 003E2323

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID: @DE
API String ID: 2133458128-494431180
Opcode ID: d095ab4308fb13eb951c7ecd00a0889b01133d8447d791df249de77f3f40108d
Instruction ID: 424fc042b9c0b99be741e08a316153889d5185d5d74998cb609131cd1eb9cc77
Opcode Fuzzy Hash: d095ab4308fb13eb951c7ecd00a0889b01133d8447d791df249de77f3f40108d
Instruction Fuzzy Hash: 9D01AD359002A98BCB07AB66D805ABFB769BF85314F240608E8116F2D2CF349A01CB90

Function 003E239C Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003E23A3
std::_Lockit::_Lockit.LIBCPMT ref: 003E23AD
int.LIBCPMT ref: 003E23C4

Part of subcall function 003E2867: std::_Lockit::_Lockit.LIBCPMT ref: 003E2878
Part of subcall function 003E2867: std::_Lockit::~_Lockit.LIBCPMT ref: 003E2892

ctype.LIBCPMT ref: 003E23E7
std::_Facet_Register.LIBCPMT ref: 003E23FE
std::_Lockit::~_Lockit.LIBCPMT ref: 003E241E
Concurrency::cancel_current_task.LIBCPMT ref: 003E242B

Strings

EE, xrefs: 003E23B8

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registerctype
String ID: EE
API String ID: 2958136301-1871289027
Opcode ID: 62107c48e9a74e14450bd39f879eaea0ad0ae7f85abe8ce00b4b64098eb5ad6e
Instruction ID: 5a22407f55d8a2609579d57d5bf535986dc54e9a0a60554d47795a1d86d5aeba
Opcode Fuzzy Hash: 62107c48e9a74e14450bd39f879eaea0ad0ae7f85abe8ce00b4b64098eb5ad6e
Instruction Fuzzy Hash: E401A1359002A99BCB07EBA7C805ABFB779AF84314F250619F4117F2D2CF349A05CB81

Function 003E7E18 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 003E7F37
___TypeMatch.LIBVCRUNTIME ref: 003E8045
_UnwindNestedFrames.LIBCMT ref: 003E8197
CallUnexpected.LIBVCRUNTIME ref: 003E81B2

Strings

csm, xrefs: 003E7E55
csm, xrefs: 003E7EC2
csm, xrefs: 003E7F6E

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 81963402f4fab54f33ae0eb27ce13f6f06785d362c30da0a18e35a5252e174ff
Instruction ID: 50df605bf512775b076e58128dca865a2ed4095ea62c7b2184f5e071fc4753d4
Opcode Fuzzy Hash: 81963402f4fab54f33ae0eb27ce13f6f06785d362c30da0a18e35a5252e174ff
Instruction Fuzzy Hash: A3B17E31C002A9EFCF26DFA6D84199EB7B5FF14310F154659E8086B292DB31DE52CB91

Function 003F187C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 003F1AF5

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 4071042b04620517d798ba530602c46240a32d601b22b7e47952336956ef504c
Instruction ID: 0768f032cc2ba6f2c7ff873079173e4e00360dd578dcd711463434d0da2f47f3
Opcode Fuzzy Hash: 4071042b04620517d798ba530602c46240a32d601b22b7e47952336956ef504c
Instruction Fuzzy Hash: 61B1C174A0424DDFDB13DF99E881BBEBBB6BF85304F154159E600AB292DB709D41CB60

Function 003F9AF9 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00E00520,00E00520,?,7FFFFFFF,?,003F9DC9,00E00520,00E00520,?,00E00520,?,?,?,?,00E00520,?), ref: 003F9B9F
__alloca_probe_16.LIBCMT ref: 003F9C5A
__alloca_probe_16.LIBCMT ref: 003F9CE9
__freea.LIBCMT ref: 003F9D34
__freea.LIBCMT ref: 003F9D3A
__freea.LIBCMT ref: 003F9D70
__freea.LIBCMT ref: 003F9D76
__freea.LIBCMT ref: 003F9D86

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: ff2cba1944c11ae9d04063962d96122e7b688a931fc5047c0a953668b5c19bcd
Instruction ID: 9d6cb61d4b24493a79649a9cd4f3e4801bf6557d1c9dc74b75b931f5ef820dad
Opcode Fuzzy Hash: ff2cba1944c11ae9d04063962d96122e7b688a931fc5047c0a953668b5c19bcd
Instruction Fuzzy Hash: 4C71D47290024DABDF239F649C41FBEB7A99F89310F360156FA04AB292E635DD44C7A4

Function 003E44DD Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 003E4526
__alloca_probe_16.LIBCMT ref: 003E4552
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 003E4591
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003E45AE
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 003E45ED
__alloca_probe_16.LIBCMT ref: 003E460A
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003E464C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 003E466F

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 7ed89cd3c015ae5a689cd6bfd91a0b55c679cdab6a6c1e6fc2a3a1336b42efef
Instruction ID: d3aa254b52fa7d95c0ff7e28d5104e6c9f182681ad7c0c280b7aa108a6cfe072
Opcode Fuzzy Hash: 7ed89cd3c015ae5a689cd6bfd91a0b55c679cdab6a6c1e6fc2a3a1336b42efef
Instruction Fuzzy Hash: 1251B1725002AAABEF229F62CC45FAB7BBDEB49780F164624F9059A1D0D731DC11CB60

Function 003E78B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 003E78E7
___except_validate_context_record.LIBVCRUNTIME ref: 003E78EF
_ValidateLocalCookies.LIBCMT ref: 003E7978
__IsNonwritableInCurrentImage.LIBCMT ref: 003E79A3
_ValidateLocalCookies.LIBCMT ref: 003E79F8

Strings

csm, xrefs: 003E798D

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 46a7ceb20652e8452d2a06dedaced7973380c52aa5ddc519d658994b56d2c1ac
Instruction ID: 063654be5394a66e79bcffbdbdfa4c9cd8dbbb89dff101b723a60bd31e356dfe
Opcode Fuzzy Hash: 46a7ceb20652e8452d2a06dedaced7973380c52aa5ddc519d658994b56d2c1ac
Instruction Fuzzy Hash: 5D41E730E042699BCF02DF6AC885AAEBBB5EF05314F148255F8199B3D3D731DA11CB91

Function 003E7AAA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,003E7AA1,003E6070,003E5152), ref: 003E7AB8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 003E7AC6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 003E7ADF
SetLastError.KERNEL32(00000000,003E7AA1,003E6070,003E5152), ref: 003E7B31

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 4ed96f5a1c07d3f95a4665175e4916a3f6e1c9f3a3ef4ad1f167fd2188b11837
Instruction ID: 78a1d987d39fda740813e9fc87824be07fd07298189308c05d89ea5c29bf93b3
Opcode Fuzzy Hash: 4ed96f5a1c07d3f95a4665175e4916a3f6e1c9f3a3ef4ad1f167fd2188b11837
Instruction Fuzzy Hash: 66012832A1D7B26EA6171BB67D4592F2688EF013F2730033AF014DA1E1FF518C029198

Function 003EC37F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,04B05F4C,?,?,00000000,003FB356,000000FF,?,003EC30F,?,?,003EC2E3,00000000), ref: 003EC3B4
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 003EC3C6
FreeLibrary.KERNEL32(00000000,?,00000000,003FB356,000000FF,?,003EC30F,?,?,003EC2E3,00000000), ref: 003EC3E8

Strings

mscoree.dll, xrefs: 003EC3AD
CorExitProcess, xrefs: 003EC3BE

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0aad73b5b9bf12646fe43b545bdfc8f23805eee49e024f7eebf52300a033a93c
Instruction ID: a919dd2636b8fbfe4b052044181478ba6e78f10c4f5d941696733b2ebbe3f7ae
Opcode Fuzzy Hash: 0aad73b5b9bf12646fe43b545bdfc8f23805eee49e024f7eebf52300a033a93c
Instruction Fuzzy Hash: 2D01A27595066AEFCB138F54DC49FBEBBB9FB04B15F004225E811E22E0EBB89900CA54

Function 003E8BF2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(HP@,00000000,00000800,?,003E8BA3,00000000,?,00000000,?,?,?,003E8CCD,00000002,FlsGetValue,003FEC80,FlsGetValue), ref: 003E8BFF
GetLastError.KERNEL32(?,003E8BA3,00000000,?,00000000,?,?,?,003E8CCD,00000002,FlsGetValue,003FEC80,FlsGetValue,00000000,?,003E7B5D), ref: 003E8C09
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,00405048,?,?,?,003E18ED,?,003E18ED,?), ref: 003E8C31

Strings

HP@, xrefs: 003E8BFC
api-ms-, xrefs: 003E8C16

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: HP@$api-ms-
API String ID: 3177248105-4243433177
Opcode ID: 03edf54ad62cd3f632b97a0379119d692b2731b28a7859e91970eb252e35f6c1
Instruction ID: ce174d5897d1a64d970ebe1ebea6008ed9c8319611b72558a4c3f424e306c41a
Opcode Fuzzy Hash: 03edf54ad62cd3f632b97a0379119d692b2731b28a7859e91970eb252e35f6c1
Instruction Fuzzy Hash: 24E04834640249BBEF222F61DD4AF693E5A9F11B80F210060FB0CE80E1DF66E916D595

Function 003E3E12 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003E3E19
std::_Lockit::_Lockit.LIBCPMT ref: 003E3E24
std::_Lockit::~_Lockit.LIBCPMT ref: 003E3E92

Part of subcall function 003E3F75: std::locale::_Locimp::_Locimp.LIBCPMT ref: 003E3F8D

std::locale::_Setgloballocale.LIBCPMT ref: 003E3E3F
_Yarn.LIBCPMT ref: 003E3E55

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: fa102ee6358648c60f985dc040dbb90ac137992fb0aa725272beb2f96d528e07
Instruction ID: 53ba9eb481e979d1361e89040ef7c1459de6f0b93bfb6e7431d61c7646011c50
Opcode Fuzzy Hash: fa102ee6358648c60f985dc040dbb90ac137992fb0aa725272beb2f96d528e07
Instruction Fuzzy Hash: C501B1B5A00264ABCB07AB22D80997D7775FFC5300B180118E9016B3D2DF34AB42DBC5

Function 003E8B52 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,?,?,?,003E8CCD,00000002,FlsGetValue,003FEC80,FlsGetValue,00000000,?,003E7B5D,?,003E5E92), ref: 003E8BD5
GetProcAddress.KERNEL32(00000000,?), ref: 003E8BDF

Strings

HP@, xrefs: 003E8BC0, 003E8BE9
HP@, xrefs: 003E8B57

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeLibraryProc
String ID: HP@$HP@
API String ID: 3013587201-592137227
Opcode ID: 857c515617367cd2b84c6b36daaeb4e61d5b2e77295c58df3b02eacf3ba83995
Instruction ID: d2d0105e4cffcabcb2ed38ee0010645fd00187f205a36adbb57b0058bcc5dda5
Opcode Fuzzy Hash: 857c515617367cd2b84c6b36daaeb4e61d5b2e77295c58df3b02eacf3ba83995
Instruction Fuzzy Hash: 501181B1A00266AFDF23CF5ADC809AA73A9FB453507150265E909DB290EB30DD02CB94

Function 003E25A5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003E25AC
std::_Lockit::_Lockit.LIBCPMT ref: 003E25B9
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 003E25F6

Part of subcall function 003E3F10: _Yarn.LIBCPMT ref: 003E3F2F
Part of subcall function 003E3F10: _Yarn.LIBCPMT ref: 003E3F53

Strings

bad locale name, xrefs: 003E2607

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$H_prolog3Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 482894088-1405518554
Opcode ID: 1897ebd39738e165ca4f8e94bf11b2a762f5ed952242de4e63082d3263ab19ef
Instruction ID: d2ce686a44df2cc59f70084d8ee2c8798a2f4cdec16c8442fe49cc6533426317
Opcode Fuzzy Hash: 1897ebd39738e165ca4f8e94bf11b2a762f5ed952242de4e63082d3263ab19ef
Instruction Fuzzy Hash: 6701D6715057989EC7329F6B844144BFFE0BF28310B404A6FF18D8BA42C770D604CB99

Function 003EFDCE Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(04B05F4C,00000000,00000000,00000000), ref: 003EFE31

Part of subcall function 003F3E34: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,003F2DC6,?,00000000,-00000008), ref: 003F3EE0

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 003F008C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 003F00D4
GetLastError.KERNEL32 ref: 003F0177

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: e0fe0cc5ce684a7e5853561727a2a791bdb7150acc5670e2ff44be52aa2deff8
Instruction ID: 1dee5b1d6d8cbf40677e12356c0aadd694374d7fc8cec24c149db5aafb5c2687
Opcode Fuzzy Hash: e0fe0cc5ce684a7e5853561727a2a791bdb7150acc5670e2ff44be52aa2deff8
Instruction Fuzzy Hash: 58D15CB5E002589FCF16CFA8D8809EEBBB5FF49304F18452AE955EB352D730A942CB50

Function 003E7BC1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 003E7C88
___AdjustPointer.LIBCMT ref: 003E7CAB
___AdjustPointer.LIBCMT ref: 003E7D47

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: c6d9ad4154814a40a0843c149357160cd22240b640f1207b9ee52fecfecad488
Instruction ID: 817178af394274fcfce8cdbb6fd405b8f12300f5f423c23b91d9fcb32c46fa69
Opcode Fuzzy Hash: c6d9ad4154814a40a0843c149357160cd22240b640f1207b9ee52fecfecad488
Instruction Fuzzy Hash: CE51B1715086A6DFDB2B8F16D841BBA73A9EF04304F25472DED059A5D1D731AC82CB90

Function 003F4250 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 003F3E34: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,003F2DC6,?,00000000,-00000008), ref: 003F3EE0

GetLastError.KERNEL32 ref: 003F42B4
__dosmaperr.LIBCMT ref: 003F42BB
GetLastError.KERNEL32(?,?,?,?), ref: 003F42F5
__dosmaperr.LIBCMT ref: 003F42FC

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: c41f8591c37d49e37149faf2c14b3964c3d1ab085430b6b4ee12d183e541fb3b
Instruction ID: 2580d1a66d4579bf02cd1dea1c044a8729c93350de2b015fd9fcc42b9a1916f2
Opcode Fuzzy Hash: c41f8591c37d49e37149faf2c14b3964c3d1ab085430b6b4ee12d183e541fb3b
Instruction Fuzzy Hash: BE21C231600219BFDB23AF668C8197BB7ADEF44364B018929FB25DB651DB30EC109B90

Function 003EB5A9 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab010ceaa375fec84fadab8e72518773cac52055a46c53f31a6228bd00b78b5b
Instruction ID: 4810e10d092072092fc6b6bda4caefec8580c17e09b34faaa953aa1678584ac3
Opcode Fuzzy Hash: ab010ceaa375fec84fadab8e72518773cac52055a46c53f31a6228bd00b78b5b
Instruction Fuzzy Hash: B721A4716002A9AFCB23AF639C81C6BF76DAF51364B114B15F915DB5E0DB31EC008B90

Function 003F51E6 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 003F51EE

Part of subcall function 003F3E34: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,003F2DC6,?,00000000,-00000008), ref: 003F3EE0

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 003F5226
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 003F5246

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 8121ec72228269552bbd952502b1d5514afc05e86873e4bb42711bee6618a0b4
Instruction ID: 6f31549789c995ba6f24588736d36e9a5039eee1a93a0018da184114ac755cc6
Opcode Fuzzy Hash: 8121ec72228269552bbd952502b1d5514afc05e86873e4bb42711bee6618a0b4
Instruction Fuzzy Hash: 121145B2901A2DBFBB1327B29C8DD7F7DACCEA9395B110624FB01D5140EA20DE0186B1

Function 003F9615 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,003F8411,00000000,00000001,00000000,00000000,?,003F01CB,00000000,00000000,00000000), ref: 003F962C
GetLastError.KERNEL32(?,003F8411,00000000,00000001,00000000,00000000,?,003F01CB,00000000,00000000,00000000,00000000,00000000,?,003F0752,00000000), ref: 003F9638

Part of subcall function 003F95FE: CloseHandle.KERNEL32(FFFFFFFE,003F9648,?,003F8411,00000000,00000001,00000000,00000000,?,003F01CB,00000000,00000000,00000000,00000000,00000000), ref: 003F960E

___initconout.LIBCMT ref: 003F9648

Part of subcall function 003F95C0: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,003F95EF,003F83FE,00000000,?,003F01CB,00000000,00000000,00000000,00000000), ref: 003F95D3

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,003F8411,00000000,00000001,00000000,00000000,?,003F01CB,00000000,00000000,00000000,00000000), ref: 003F965D

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 591d925a04d5b61243b13e750753ca653b5108fe8b99bc80d1fdb53e3c89c5cc
Instruction ID: d7bf100e525b7a47f7bc5c53ddc6c160f3b7b5796ec990727251390146b80113
Opcode Fuzzy Hash: 591d925a04d5b61243b13e750753ca653b5108fe8b99bc80d1fdb53e3c89c5cc
Instruction Fuzzy Hash: 44F0AC36501259BBCF231FA5DC09BAD3F2AEF493B1F054025FB1899121D632C960DB94

Function 003F59E2 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 373COMMON

Download Yara Rule

Strings

P6E, xrefs: 003F5A10
P6E, xrefs: 003F5CF5

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: P6E$P6E
API String ID: 0-818886643
Opcode ID: a97dc185cd2da926a48d796d73479e88cce993b8d985dde3fa5bfe9702d6fabd
Instruction ID: 07df9c617275eb03966b090e93ef422a741d2dff48e05d00ca9f62e2198de204
Opcode Fuzzy Hash: a97dc185cd2da926a48d796d73479e88cce993b8d985dde3fa5bfe9702d6fabd
Instruction Fuzzy Hash: F1C12372D40609EBEB21DBA8CC82FEF7BF8AB48700F154165FB05FB282D67499558760

Function 003F662E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003EEFD8: HeapFree.KERNEL32(00000000,00000000,?,003F602B,?,00000000,?,?,003F62CC,?,00000007,?,?,003F67C5,?,?), ref: 003EEFEE
Part of subcall function 003EEFD8: GetLastError.KERNEL32(?,?,003F602B,?,00000000,?,?,003F62CC,?,00000007,?,?,003F67C5,?,?), ref: 003EEFF9

___free_lconv_mon.LIBCMT ref: 003F6672

Strings

x7E, xrefs: 003F671A
P6E, xrefs: 003F6644

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast___free_lconv_mon
String ID: P6E$x7E
API String ID: 4068849827-529142250
Opcode ID: 066f80d8febb35b5f67107de870dd90c3712171670b019bb681f463ca84e7d18
Instruction ID: a8685bda2d926795a42ce6b48db44df1279b15d2a387c901e934ea14a823c01f
Opcode Fuzzy Hash: 066f80d8febb35b5f67107de870dd90c3712171670b019bb681f463ca84e7d18
Instruction Fuzzy Hash: 4C316D31604789DFEB22AE79D846B6A77E8AF40310F164529F659DB2D1DF34EC448B10

Function 003E81BD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 003E81E2

Strings

MOC, xrefs: 003E81F4
RCC, xrefs: 003E81FC

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: b0e61d713213283e3dec6c76a43508ef89508443e98531fc4f4cb7187de4f1fa
Instruction ID: 75852eb0714f25b3f48781c98c72810bf2d5d75de6c85f612d4114bc189b1fa8
Opcode Fuzzy Hash: b0e61d713213283e3dec6c76a43508ef89508443e98531fc4f4cb7187de4f1fa
Instruction Fuzzy Hash: 59418731D00659EFCF16CF99CC81AAEBBB5FF08304F158658FA086A2A1D7359950DB50

Function 003E4956 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 003E526A
___raise_securityfailure.LIBCMT ref: 003E5352

Strings

XGE, xrefs: 003E534D

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: XGE
API String ID: 3761405300-610323143
Opcode ID: 80999e536e308cac4ac3ed8543a7e536ba551503d2ad562d785664f73e79cd39
Instruction ID: 90cc8dda824f2973ca62fc849cbea19af4a7681a93841351d45c44d0afc1a057
Opcode Fuzzy Hash: 80999e536e308cac4ac3ed8543a7e536ba551503d2ad562d785664f73e79cd39
Instruction Fuzzy Hash: 2121CEB8500384ABD750EF56F9856443BE4FB9971AF11553AE6098F3A2E3B0D5C0CF08

Function 003E5365 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 003E5370
___raise_securityfailure.LIBCMT ref: 003E542D

Strings

XGE, xrefs: 003E5428

Memory Dump Source

Source File: 00000000.00000002.1622170553.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1622110422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622216576.00000000003FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622246450.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1622310917.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: XGE
API String ID: 3761405300-610323143
Opcode ID: e811ff2a4f4123e08e87dc38798ce60ff7aaf44b15e1e41df69e8860df882487
Instruction ID: 067d892eeeda7076ba7d4d2c77eb00ea85b1728718ef00b35bcc39c5da100212
Opcode Fuzzy Hash: e811ff2a4f4123e08e87dc38798ce60ff7aaf44b15e1e41df69e8860df882487
Instruction Fuzzy Hash: 5311BDB85113889BD750EF56F9816843BF4FB9A30AB01513AE8088F362E370D581CF09

Analysis Process: RegAsm.exePID: 6032, Parent PID: 6864COMMON

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	52
Total number of Limit Nodes:	9

Executed Functions

Function 06453F50 Relevance: 1.8, Strings: 1, Instructions: 522
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 064541E4

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: ad376091b9f11f0bf1997a2afec367f91ecb1d6124dd305922b2cd4dd678bace
Instruction ID: d7d21a38560552e04e603d181f4b5446ee588935355a64767bc8071837a264b0
Opcode Fuzzy Hash: ad376091b9f11f0bf1997a2afec367f91ecb1d6124dd305922b2cd4dd678bace
Instruction Fuzzy Hash: 67127234B102158FCB55DF79C584A6EBBF2BF89710B15816AE806EB365DB31DC42CBA0

Function 064567D8 Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5108e14b1412fdd198b0749a1b75a319e4d47812c6b6cc56db2aa993b2704e7
Instruction ID: f69a2ade39a819c5febe5aff3c3089b1cc903bbe6cf56a457b2b7c23dc2c07d6
Opcode Fuzzy Hash: e5108e14b1412fdd198b0749a1b75a319e4d47812c6b6cc56db2aa993b2704e7
Instruction Fuzzy Hash: 5FF1A431A002099FDB15DF68D884B9EBBF2EF84300F56856AE905DB362DB71DD45CBA0

Function 0645A3D8 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcce6137f97b30c7cfddc0e50f62aa817f134738eccfecbd5349f01d0076648b
Instruction ID: 04ea2a55f2fcdda1d07c28fd7696dbf9c2d17e4f1a7174643119dbe00a96ce56
Opcode Fuzzy Hash: fcce6137f97b30c7cfddc0e50f62aa817f134738eccfecbd5349f01d0076648b
Instruction Fuzzy Hash: C9D1D574900218CFCB18EFB4D854A9DBBB2FF8A305F1085A9D55AA7394DB31998ACF11

Function 06430D80 Relevance: 20.6, Strings: 16, Instructions: 628
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06430E78
$^q, xrefs: 06430E84
$^q, xrefs: 06431336
$^q, xrefs: 064313EB
$^q, xrefs: 064313AC
$^q, xrefs: 06431461
$^q, xrefs: 06430F86
$^q, xrefs: 06431455
$^q, xrefs: 06430FB8
$^q, xrefs: 06430E52
$^q, xrefs: 06430FAC
$^q, xrefs: 0643137B
$^q, xrefs: 06430E02
$^q, xrefs: 064313A0
$^q, xrefs: 06430F36
$^q, xrefs: 06431430

Memory Dump Source

Source File: 00000001.00000002.1765990157.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6430000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2449488485
Opcode ID: 4ffc1309b57dc4a2ea4d69befa505e37b84b71ed0587df6cebf5dbfc34bfa06d
Instruction ID: e5fc03c381b58f3ab4f7aef0d009a4f5c11705d801143b6ec172f6af0cefc6ad
Opcode Fuzzy Hash: 4ffc1309b57dc4a2ea4d69befa505e37b84b71ed0587df6cebf5dbfc34bfa06d
Instruction Fuzzy Hash: B232CE30B002149FDB959B69C944A6EBBF6FF8D700B14846AE516DB3A6CF70DC02CB91

Function 06431582 Relevance: 7.8, Strings: 6, Instructions: 336
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06431A7C
$^q, xrefs: 064318E3
$^q, xrefs: 0643182E
$^q, xrefs: 06431A88
$^q, xrefs: 06431A12
$^q, xrefs: 06431A57

Memory Dump Source

Source File: 00000001.00000002.1765990157.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6430000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 16a0de1c302d1853011085dd4bf7dccbfc3315bfb0c91928e2e55019b8e15f63
Instruction ID: 3435085782243660e4717e6c94f069b1a83db143c32efee6a3cbaf2484c6567c
Opcode Fuzzy Hash: 16a0de1c302d1853011085dd4bf7dccbfc3315bfb0c91928e2e55019b8e15f63
Instruction Fuzzy Hash: 47C1D434B006248FDB95ABA8C854A3EB7E6FF89705F14446AD602CB3A2DF75DC06C791

Function 00E3D0A8 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00E3D136
GetCurrentThread.KERNEL32 ref: 00E3D173
GetCurrentProcess.KERNEL32 ref: 00E3D1B0
GetCurrentThreadId.KERNEL32 ref: 00E3D209

Memory Dump Source

Source File: 00000001.00000002.1756689435.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e30000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 97fd21020664cdc6bb788fa9b5c19815f901254ebab0e1d6cc7a4d7af414859d
Instruction ID: 47821073768809791634b8100e974578a37d644aa49c3e3f032c3d8d6fbf3d2e
Opcode Fuzzy Hash: 97fd21020664cdc6bb788fa9b5c19815f901254ebab0e1d6cc7a4d7af414859d
Instruction Fuzzy Hash: A25157B09013498FDB14CFA9D948BAEBFF1EF88314F208459E059A7360DB749989CF65

Function 00E3D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00E3D136
GetCurrentThread.KERNEL32 ref: 00E3D173
GetCurrentProcess.KERNEL32 ref: 00E3D1B0
GetCurrentThreadId.KERNEL32 ref: 00E3D209

Memory Dump Source

Source File: 00000001.00000002.1756689435.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e30000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 2c0c2aab011d3299660b09e1e48e61f36e8693789c3a137fbbfc877a0371c4c9
Instruction ID: 36246457be505ecdce7ce3c8b61cd4ce87fb65b7bbf05dcadcc46cda185a665c
Opcode Fuzzy Hash: 2c0c2aab011d3299660b09e1e48e61f36e8693789c3a137fbbfc877a0371c4c9
Instruction Fuzzy Hash: B15147B09013498FDB14CFA9D948B9EBBF1EF88314F208459E419A7360DB749988CF65

Function 06430598 Relevance: 1.7, Strings: 1, Instructions: 462
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ilPj, xrefs: 0643059C

Memory Dump Source

Source File: 00000001.00000002.1765990157.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6430000_RegAsm.jbxd

Similarity

API ID:
String ID: ilPj
API String ID: 0-830177475
Opcode ID: b3b7443a131d003fec3871dd901cff03ec95b9275fcbe6ead63709dc450609f9
Instruction ID: adc517663230359818c1e2aec4cc84bb5c980d25936e4cba9d18041d400faaf1
Opcode Fuzzy Hash: b3b7443a131d003fec3871dd901cff03ec95b9275fcbe6ead63709dc450609f9
Instruction Fuzzy Hash: 580290307402248FDB659F68D954A2EB7E2FFC9704F004959D5029F3A2CFB6ED468B91

Function 00E3AE30 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00E3B086

Memory Dump Source

Source File: 00000001.00000002.1756689435.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e30000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c6480030789de58a04ff07010596ff4b453607228dde85773f0a5b714643e25a
Instruction ID: 8531eabef199f64f03a10121b10f09701ed7313a56268059933d0a26ba1e5331
Opcode Fuzzy Hash: c6480030789de58a04ff07010596ff4b453607228dde85773f0a5b714643e25a
Instruction Fuzzy Hash: 997127B0A00B458FD724DF2AD14975ABBF1FF88304F04892DE48AE7A50D775E989CB91

Function 00E34248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00E359F1

Memory Dump Source

Source File: 00000001.00000002.1756689435.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e30000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d989e3d453ce01c9c2df912e814f465d2b1c988a6106ec6da5cb219061f20452
Instruction ID: a45c990c4fdff3a2eb9e71f8b618da944e71809e4f8f7aad861d48b845c96483
Opcode Fuzzy Hash: d989e3d453ce01c9c2df912e814f465d2b1c988a6106ec6da5cb219061f20452
Instruction Fuzzy Hash: E541E2B1C00619CADB24DFA9C848B9DBBB5FF44314F24816AD408BB255DB756949CF90

Function 00E35935 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00E359F1

Memory Dump Source

Source File: 00000001.00000002.1756689435.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e30000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0b49fcdeee6e0af1fa5a0dca44e5aaaf3b20ace9e03e6c8c071f262074248194
Instruction ID: 7095b40669f0cd541be8de3f500f3aa74a09ecf287f9d10a242a75013b08252d
Opcode Fuzzy Hash: 0b49fcdeee6e0af1fa5a0dca44e5aaaf3b20ace9e03e6c8c071f262074248194
Instruction Fuzzy Hash: 334102B1C00759CEDB24CFA9C888B8DBBB5FF48304F24819AD408BB251DB755949CF90

Function 00E3D2F9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00E3D387

Memory Dump Source

Source File: 00000001.00000002.1756689435.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e30000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 090e9908a5e86b8cc622e7b5e71c7b460994616df3887cbf56bc38ad3e0e709b
Instruction ID: 3a3658cf61f9ecbde4bb80ee5cdbacb17eb91e2a45534fe587724243416fe003
Opcode Fuzzy Hash: 090e9908a5e86b8cc622e7b5e71c7b460994616df3887cbf56bc38ad3e0e709b
Instruction Fuzzy Hash: EB2114B59002489FDB10CFAAD985AEEBFF5FB48324F14801AE858B3310C374A955CF60

Function 00E3D300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00E3D387

Memory Dump Source

Source File: 00000001.00000002.1756689435.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e30000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: eebb56df9f124713d2fd5edeea4e15e75cdf1c2fabc963be91970a70c98d13c7
Instruction ID: dfa45a6375cec988fa351253adfd315cb680ec523f8d43abc65ada2e219cdc9c
Opcode Fuzzy Hash: eebb56df9f124713d2fd5edeea4e15e75cdf1c2fabc963be91970a70c98d13c7
Instruction Fuzzy Hash: 2C21E4B59002489FDB10CF9AD984ADEBFF4FB48324F14841AE918A3310D374A954CFA5

Function 00E3A870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00E3B101,00000800,00000000,00000000), ref: 00E3B312

Memory Dump Source

Source File: 00000001.00000002.1756689435.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e30000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 88c218dd143d00d3f9359ef1e2f6abec94b2827381e9e801b37b7c36d80c1bbc
Instruction ID: 23c785fed71eaf60356b38b9863e1d83d5409e2202497cdde7725b9492017f33
Opcode Fuzzy Hash: 88c218dd143d00d3f9359ef1e2f6abec94b2827381e9e801b37b7c36d80c1bbc
Instruction Fuzzy Hash: 291114B6D003598FCB10CF9AC448ADEFBF4EB88314F10842AD91AB7210C7B5A945CFA4

Function 00E3B2A0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00E3B101,00000800,00000000,00000000), ref: 00E3B312

Memory Dump Source

Source File: 00000001.00000002.1756689435.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e30000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 35ccdd1064303ced2ac63f02c68ccc3ffa0e5f5792cf3001cd171fa82a5bbbf4
Instruction ID: 92fac926750bd1283de49f1cd28f3cedb2ccf04332624ef4034a8c5b349f9dd2
Opcode Fuzzy Hash: 35ccdd1064303ced2ac63f02c68ccc3ffa0e5f5792cf3001cd171fa82a5bbbf4
Instruction Fuzzy Hash: 1911E4B69002598FDB20CFAAD449ADEFFF4EF88314F14842AD559B7210C3B5A945CFA4

Function 00E3B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00E3B086

Memory Dump Source

Source File: 00000001.00000002.1756689435.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e30000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2c92da4f670064f7d887e956c8a6945cbd99ac78d11acc5dd4cf41ca2238019a
Instruction ID: 6be39b67b536dbc853217993cd18c1839d11b19b216a8795fd9b11c687d30811
Opcode Fuzzy Hash: 2c92da4f670064f7d887e956c8a6945cbd99ac78d11acc5dd4cf41ca2238019a
Instruction Fuzzy Hash: A411FDB6C00749CBCB24CF9AC448A9EFBF4AB88324F10842AD569B7210C375A545CFA5

Function 06431BA0 Relevance: 1.4, Instructions: 1445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1765990157.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6430000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59f06261a6c3e59153b63c0ffa0d59e34809585e0993b5dafa0c4f767ecfd4ce
Instruction ID: 0b0dbcecf4815273ad19ba3893d073d599c3c2f39d7d968c4be66aa7b6afd905
Opcode Fuzzy Hash: 59f06261a6c3e59153b63c0ffa0d59e34809585e0993b5dafa0c4f767ecfd4ce
Instruction Fuzzy Hash: 26C23E30B402189FDB55DB68C951A9EBBB6FF88700F104099E60AAB3A1DF71DE46CF51

Function 06453DE0 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06453F25

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 36850091c43514adf391ffa7a33c19242359dbc6ada6dc35f40eb02123c500c6
Instruction ID: 3c61dc7068443ccf4db6b0e716db805d395256e97f04adbefb85f1aa889e7bd5
Opcode Fuzzy Hash: 36850091c43514adf391ffa7a33c19242359dbc6ada6dc35f40eb02123c500c6
Instruction Fuzzy Hash: CC3104327006104FC72AAB38A85466EB7E6DFCA360705447AE809CB791DE31EC0BC7A1

Function 064584D8 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

4'^q, xrefs: 064585B1

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: a76b2956dbe84a21f643ff2610e05a243a61c874e478001d1afd9bd33c1e8881
Instruction ID: 486de67a4504463c2b99720f0583b4fff5cffaacce814148e16541731e1621a2
Opcode Fuzzy Hash: a76b2956dbe84a21f643ff2610e05a243a61c874e478001d1afd9bd33c1e8881
Instruction Fuzzy Hash: 2B319A31B102188BDB09FB7CA4A456F76E3EFC8210B504439D50ACB385EE75CE0687E2

Function 064584C8 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

4'^q, xrefs: 064585B1

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: ab92dc6138651bf114280304af24d6117fa886e84c8ec2b42ae3850b1e1733e7
Instruction ID: 9236932829938a9b75dffbcc0037327798086e051d12e5a85f4b65cbb97ad2d9
Opcode Fuzzy Hash: ab92dc6138651bf114280304af24d6117fa886e84c8ec2b42ae3850b1e1733e7
Instruction Fuzzy Hash: EA218D31B102198BDB0ABB78A5A467E36E3AFC8215754083DD50BDB385EE75CD0687E2

Function 0645B358 Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0645B399

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 111da66ea064465e2c10cccebb1a2c4f8b1394e1750d375b05e5d80df496ef67
Instruction ID: 20d12c9cbc90a94399c4fa069be6ea2abb069ac4fc9759448dcd90f927f28f76
Opcode Fuzzy Hash: 111da66ea064465e2c10cccebb1a2c4f8b1394e1750d375b05e5d80df496ef67
Instruction Fuzzy Hash: BB012430906248AFCF08EFB8E9954DDBFB1FF45200B1001AAE4059B751DF300E89CBA1

Function 06453EC8 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06453F25

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: da25647af5f784f164330f76d43882b378f7c42827d4a28a2c3c567bea4dacba
Instruction ID: c8f0bca67cb86bfab7b7cf56c11a0d8d4b00cda6c371fc1f435316f902aa9d72
Opcode Fuzzy Hash: da25647af5f784f164330f76d43882b378f7c42827d4a28a2c3c567bea4dacba
Instruction Fuzzy Hash: 3DF090313406054FC218EB2DE454A6EB7E7EFC9250310492DD05A8B758EF70ED4A8BA1

Function 0645B368 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0645B399

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: bb91ca24b5dd62d4cf67dcacdbab44c8007482b9594a4e7b3d1a211e7d2e752b
Instruction ID: e21012792fbce2c5a86acc7cc81f8f0d04b510f8cd8a1386a7b5d32218c1e7d0
Opcode Fuzzy Hash: bb91ca24b5dd62d4cf67dcacdbab44c8007482b9594a4e7b3d1a211e7d2e752b
Instruction Fuzzy Hash: D2F03C30A01609EFCF18EFB8E99559CBBB2FB44204B1045A9D40A9B764EF705A48DF51

Function 064300D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1765990157.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6430000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db7cf1d743f58a3c1f04d5396e5f54a8bfb9b2f084bcbd9aa8d910188f35645c
Instruction ID: 6a5acb76fa3ca51426eb652d8536984e36294c342dd1e9c8293089f369725b51
Opcode Fuzzy Hash: db7cf1d743f58a3c1f04d5396e5f54a8bfb9b2f084bcbd9aa8d910188f35645c
Instruction Fuzzy Hash: AA428E307406288FCB69AF68D950A2EB7F2FBC9704B104A5CD5039B791CFB6ED058B95

Function 064349F1 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1765990157.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6430000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca1022db7cdc279faa51a8ab41ca797ec1048d95635a5d99eddb24c0783d427a
Instruction ID: 1734bd90aa6fbc647c07a9d093bd060617ab36e7b7f707990aaca368216e8bc7
Opcode Fuzzy Hash: ca1022db7cdc279faa51a8ab41ca797ec1048d95635a5d99eddb24c0783d427a
Instruction Fuzzy Hash: 3BE17E34B142159FCB45DB68C8549AFBBF6FF89310B15809AE616CB3A2CB71DC05CBA1

Function 06433B22 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1765990157.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6430000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 331f6cedf5deb0455ec7d6fdba2a7f1339e60de24771706f82ee4169bc524152
Instruction ID: 5520d81b10368b6cea5e1ebefca23043991653136e708eb044f9a0ef9f7176ba
Opcode Fuzzy Hash: 331f6cedf5deb0455ec7d6fdba2a7f1339e60de24771706f82ee4169bc524152
Instruction Fuzzy Hash: 88F11834B402149FCB45DF68C994EAEBBF6FF89704F108099E606DB3A2DA71ED418B50

Function 06430688 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1765990157.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6430000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b64f80eabc66bf381065d49ee2abcb8ba8f2674083b49376e64f84c6291812a4
Instruction ID: 663f91896c88ee678a193b109a741ff9b9d465c3773ad2385e5002ffa86658a1
Opcode Fuzzy Hash: b64f80eabc66bf381065d49ee2abcb8ba8f2674083b49376e64f84c6291812a4
Instruction Fuzzy Hash: 9CE19230B402149FDB559F68C954A2EB7A2FF8DB04F104559E9028F3A2CFB6DD46CB91

Function 06430700 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1765990157.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6430000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b1136cd0b99e82295bb224189663c838ab80baa76f39441da24b8ff51e2d3f
Instruction ID: 58b1ed0159d14cc4db095fa3d52d28b1c46cb71164e02cfab68057e1e9ef231c
Opcode Fuzzy Hash: 37b1136cd0b99e82295bb224189663c838ab80baa76f39441da24b8ff51e2d3f
Instruction Fuzzy Hash: 25D1A534B402149FDB559B64C964B2EB7A2FF8DB04F00455AE9028F3A2CFB6DC46CB91

Function 064300B9 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1765990157.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6430000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c12f0f6deb1fd14d5843dfc10a947501f3af3dcd4bedf49ef9cd6fa4a040303
Instruction ID: e25e80f5c9e6b9d7e485de41a38e25adcdd51165f2413a96715e471084758d1f
Opcode Fuzzy Hash: 1c12f0f6deb1fd14d5843dfc10a947501f3af3dcd4bedf49ef9cd6fa4a040303
Instruction Fuzzy Hash: 05C18434B402149FDB859B64C955B6E7BE6BF8DB04F004156E902CB3A2CFB6DC46CB91

Function 06430610 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1765990157.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6430000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b674a7adb88e305e16354eef4f8213d7c366e0aefe148c6b4f7953d2cdc1f52
Instruction ID: 60b02d505028f4c54f3d18b4e0b669d90bd989f64c629ffe26196d11832203aa
Opcode Fuzzy Hash: 7b674a7adb88e305e16354eef4f8213d7c366e0aefe148c6b4f7953d2cdc1f52
Instruction Fuzzy Hash: 9BC1B934B402149FDB449B64C955B2E77E6FF8DB05F104156EA028B3A2CF76DC46CB91

Function 06430666 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1765990157.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6430000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca7b907622c5a5a687f3270ddb0920218c599bafb8f511611fcf8fc2c9599f73
Instruction ID: cd71c2ddf61d77dce7343b21ae8681276c7bd2cbc580b83b7f6e9eed0fb2e097
Opcode Fuzzy Hash: ca7b907622c5a5a687f3270ddb0920218c599bafb8f511611fcf8fc2c9599f73
Instruction Fuzzy Hash: 64B1A734B402149FEB849B64C954B6E77E6FF8DB05F104156EA028B3A2CFB6DC46CB91

Function 06454AFF Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8185e50b29890d7f388f75f7006741e4d8f5a84273e13a6d569724d970bcf541
Instruction ID: 100071d0d9840d231d40d16bf93295c5c1b0d0624027f2b7ece6a971efc16a71
Opcode Fuzzy Hash: 8185e50b29890d7f388f75f7006741e4d8f5a84273e13a6d569724d970bcf541
Instruction Fuzzy Hash: 28C15C34B00605CFC755DF29D584AAABBF2FF88301B1581A9E946DB366DB30EC45CB60

Function 06457D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aad67606bebec50683a3ffe37cbdcea2591d4af60503ba6d5e607e05385326e
Instruction ID: 5c848f8202724b05d763630e310b1303397289f0ce074a2cd3c6164d9ec0a544
Opcode Fuzzy Hash: 0aad67606bebec50683a3ffe37cbdcea2591d4af60503ba6d5e607e05385326e
Instruction Fuzzy Hash: 885134B1E00358CFDB55CFA9C985BDEBBF6AF48314F14842AE815AB245DB749846CF80

Function 064334D8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1765990157.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6430000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c10bcb8c8f2a293a65bcb22fb00a67b2c9efd0333778b16af3467ea7d593287f
Instruction ID: 80106d278af2a2337034fbd476372f5f097111641e699c5ba64d2efd804a0a28
Opcode Fuzzy Hash: c10bcb8c8f2a293a65bcb22fb00a67b2c9efd0333778b16af3467ea7d593287f
Instruction Fuzzy Hash: 7D516635B102189FCB44DF68C88499ABBF2FF8D314B15806AE905EB361DB31EC45CB50

Function 06457D4C Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea40dbd0a086bf42859f41fbac97964f9aa3ee6bbb9a2d6832f35dda38001ec5
Instruction ID: c20874b181757867d796280cfbbf3ea3a98e346d10a06ce9da8761e680e4b49c
Opcode Fuzzy Hash: ea40dbd0a086bf42859f41fbac97964f9aa3ee6bbb9a2d6832f35dda38001ec5
Instruction Fuzzy Hash: 665136B1E00358CFDB55CFA9C985BDEBBF5AF48304F14852AE815AB245DB749846CF80

Function 064559C8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2da6e384641574fc49158aaa77bee3407c1018d3f3d7b8a1b5ac9f2c4ddae0a
Instruction ID: ecf43c53af9e03da4cc4ec14c7778ba2c0925fa36d56c359aefbfb372f297b98
Opcode Fuzzy Hash: c2da6e384641574fc49158aaa77bee3407c1018d3f3d7b8a1b5ac9f2c4ddae0a
Instruction Fuzzy Hash: CF414A35A00606CFCB15CF59C98496ABBF2FF89310B5AC95AE9599B362D730F801CF94

Function 064334B9 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1765990157.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6430000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b49cdf031c4724af59f9082c3758a155e3c83a0ca9ada91a29e7014ef41803f5
Instruction ID: b59c87dd10e5104c38bb54180267ccc4c92ccd3e6f700bdf5e1e2ceb0246b2ad
Opcode Fuzzy Hash: b49cdf031c4724af59f9082c3758a155e3c83a0ca9ada91a29e7014ef41803f5
Instruction Fuzzy Hash: DC416A35E112559FCB46CF68C88489EBBB2FF89314B1581AAE915EB362DB30EC05CB50

Function 06455579 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdbd99b2f4d748fa104deb5727667fdbc69b28a27134617ef3cbcb50ba6a9c9b
Instruction ID: ff2d854041d4bc0d24f12b0dbcca8f1a592b1b9aa31f4d9c92c83b0591cdfcfa
Opcode Fuzzy Hash: bdbd99b2f4d748fa104deb5727667fdbc69b28a27134617ef3cbcb50ba6a9c9b
Instruction Fuzzy Hash: 5E314A357112149FCB05DF34E888A6EBBB2BF89201B518469E905CB365DB71ED45CB90

Function 06455588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 530a60bba05e8b292eed791c459796cd5751eb7f99fc81f55e3f51586746a760
Instruction ID: c49aa024d42f6b5d18d9c4200b6fc365cccb19be1e83c7e54685b9d9fbae2150
Opcode Fuzzy Hash: 530a60bba05e8b292eed791c459796cd5751eb7f99fc81f55e3f51586746a760
Instruction Fuzzy Hash: 06316B35B112109FCB06DF38E88896EBBB2FF89301B118469E905CB3A5DB31ED45CB90

Function 064587A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96fcccc5e73fc7a10826de0f5b90551a2e20203fd1f470894663bede70604a39
Instruction ID: 2563ebc0ee707d243fe619a40f1ab8dc40a701fb0db8c0daa488ff746e4585d4
Opcode Fuzzy Hash: 96fcccc5e73fc7a10826de0f5b90551a2e20203fd1f470894663bede70604a39
Instruction Fuzzy Hash: 6841F2B1D01258DFDB54DFAAD940ADEBBF6EF88314F10802AE815B7251DB30A945CF91

Function 06458796 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea0a8cd54aec3cd11e8709c2fada2656825cfee96a2b01af2241281dd8867eeb
Instruction ID: 7fc1acb63726808e8bea5b3203f6036dde19b8bd780847d95f66a7266eb1f40d
Opcode Fuzzy Hash: ea0a8cd54aec3cd11e8709c2fada2656825cfee96a2b01af2241281dd8867eeb
Instruction Fuzzy Hash: 4A3111B1D002589FDB14CFAAC985BDEBFF6AF88304F24802AD415BB250DB309945CF91

Function 064330FB Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1765990157.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6430000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e71fac479546a1bf2260e87bcb1252e3e0ed84edc4da3999a241da9651858960
Instruction ID: 67a10b897753d4bdcd2e4f8c9452afda8450d0e662d199714594ce0f7a1d80be
Opcode Fuzzy Hash: e71fac479546a1bf2260e87bcb1252e3e0ed84edc4da3999a241da9651858960
Instruction Fuzzy Hash: 02215E35B50004AFCB54DF69D984EAABBB2FF88714F1180A9E9059B3A6CB31EC05CB50

Function 06458A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cb7fa377dff89256d7f088877272f1cada27f4c68009e14024f0b1c1cead51b
Instruction ID: 0460417e821aeb92fd132db8742411ed8767b8a4a6a8da7044ca98ab9c5e363c
Opcode Fuzzy Hash: 2cb7fa377dff89256d7f088877272f1cada27f4c68009e14024f0b1c1cead51b
Instruction Fuzzy Hash: 993114B1D01258DFCB14DFAAD894BDEBBF9EF48310F24842AE805B7240DB74A845CB90

Function 00D4D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1756399693.0000000000D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d4d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702cc2fcb148f9fcc1f91c8d31a50c6aa383858b1f44181ed9e6a9e610564568
Instruction ID: ccf1846235e6d653a759cc8656275589bbfbe821257f6c7b42f484bf80296733
Opcode Fuzzy Hash: 702cc2fcb148f9fcc1f91c8d31a50c6aa383858b1f44181ed9e6a9e610564568
Instruction Fuzzy Hash: 4C212571500204DFDB05DF14D9C4B26BF66FB94324F28C569E94D4B25AC33AE856CAB2

Function 00D4D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1756399693.0000000000D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d4d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b43cd5afa1ddc8169cbe8372ce9ad3031bdeca3225dacd44328de703cbe5a28b
Instruction ID: 904bd74e8685ad1fe15ad147c02f093e770a059eb51e8056d2ca9dc7f4819f88
Opcode Fuzzy Hash: b43cd5afa1ddc8169cbe8372ce9ad3031bdeca3225dacd44328de703cbe5a28b
Instruction Fuzzy Hash: 92213471604240DFCB05DF14D9C0B2BBF66FB98318F28C669E9494B256C736D856CBB2

Function 00D5D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1756454435.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d5d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d4ef6a9dfd19a1d0d25de0454a4eed53b6ddd0c93100b922a8d53e1cc3c8d51
Instruction ID: e565b34d1282a997be3625e775cf5d4112bce0d9c8653dce40ebbfcd71e2ec76
Opcode Fuzzy Hash: 0d4ef6a9dfd19a1d0d25de0454a4eed53b6ddd0c93100b922a8d53e1cc3c8d51
Instruction Fuzzy Hash: 5221F271604240DFDF24DF18D9C4B26BBA6EB84315F24C569DC494B296C33AD84BCA71

Function 06458A8C Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd344c26e8d6173b62bd66949d9a6c3dcf97423f607db85d8a3741321121bbd9
Instruction ID: 5936acb23ecafa78340b7f445da644b27910f5534ac1d35bde498a1123d63800
Opcode Fuzzy Hash: bd344c26e8d6173b62bd66949d9a6c3dcf97423f607db85d8a3741321121bbd9
Instruction Fuzzy Hash: 6621F0B1D00258DFDB14DFA9C995B9EBFB9AF08310F24842AE405BB241DB74A946CB94

Function 00D5D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1756454435.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d5d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9634930f929aa4eb5f5a096405298c1cedbb5c55724a8decdd17d74061ab6c32
Instruction ID: 3b28b27965e9f91ebf492971c81f7ba7e6adc9a38a64897e834c1e7b812eee4a
Opcode Fuzzy Hash: 9634930f929aa4eb5f5a096405298c1cedbb5c55724a8decdd17d74061ab6c32
Instruction Fuzzy Hash: 71217C755093808FDB12CF24D994715BF72EB46214F28C5EADC498B6A7C33A980ACB72

Function 0645BC5F Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 899f642de33d802066f4538ca9b4f809380cf69ddd4ce251841bb6b894f2d3e4
Instruction ID: fab659b61b22411106c929c4b65d9305e4e3bbd710b54846bdf1f20a585d0113
Opcode Fuzzy Hash: 899f642de33d802066f4538ca9b4f809380cf69ddd4ce251841bb6b894f2d3e4
Instruction Fuzzy Hash: A211E5312002045FCA9D6778E8549BEBBA7FEC22503440529E1078BAD0CDA0AD4A8BB5

Function 00D4D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1756399693.0000000000D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d4d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction ID: 872f06c3340c8e1ad6502cdae91aa4de8cb9db53146e3f80692ac2611994591a
Opcode Fuzzy Hash: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction Fuzzy Hash: 6F110376404280CFCB02CF10D9C4B16BF72FB94324F28C6A9D8090B616C33AE85ACBA1

Function 00D4D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1756399693.0000000000D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d4d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction ID: da55735c1e24fa54b24fa401f6ebd62a525e2a7aa8942d0194d4e986a7d03052
Opcode Fuzzy Hash: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction Fuzzy Hash: 5811D376504280CFCB16CF14D9C4B16BF72FB94318F28C6A9D8494B656C336D85ACBA1

Function 0645C499 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecef6606a40b5009d241eef178b2f17b246a9c973e0a0441121a225f2b035a14
Instruction ID: 3a857286a15c58068e92f1deb141cd1ebb378ec02846c72af514e042a4857201
Opcode Fuzzy Hash: ecef6606a40b5009d241eef178b2f17b246a9c973e0a0441121a225f2b035a14
Instruction Fuzzy Hash: F9010C302047054FD329AF35E5045AE7BE3EFC5311B108629D04A87745CFB4D90D8BE1

Function 06458350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaefb2ac60ef8df75e708020a87048d55bacb5af573ee898d4184df86347d29e
Instruction ID: 36318f04f7f501109dd3d99be2b5a6a28032b5a38219bcb548f023757930a86e
Opcode Fuzzy Hash: eaefb2ac60ef8df75e708020a87048d55bacb5af573ee898d4184df86347d29e
Instruction Fuzzy Hash: A3017C32B1021D9FDF10EAA9AC45ABFBBAAEB84251F14403AE614D3240EF31991587A1

Function 0645BC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c352c21e3836449e7d5eb48c211971d825618be58d7ea7f7cf3d447e32f767a
Instruction ID: 5b645159b5b749a346eedbc892f1133c8355bccf3d6db146bf6f116329de4f7b
Opcode Fuzzy Hash: 0c352c21e3836449e7d5eb48c211971d825618be58d7ea7f7cf3d447e32f767a
Instruction Fuzzy Hash: D101B1312001054F8A9CAB7CE55852EBBE3FEC02503444928E1078B7D4DDF0BD9E9BA5

Function 0645E8B0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 755bb3b45add12397bcdcd65493608f3bb27fc567b88747f833a8f25550cd1cd
Instruction ID: 4b2069adf4367321a37e9b94ce79e1fdb764caa55ffa062e0b496409942b994f
Opcode Fuzzy Hash: 755bb3b45add12397bcdcd65493608f3bb27fc567b88747f833a8f25550cd1cd
Instruction Fuzzy Hash: E9012634604348AFCB06DF74DC148AA3FBEEF86200B0084E9E400CB362DA32DD05D792

Function 00D4DA4D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1756399693.0000000000D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d4d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da78aa1b8ae0d7737a011ff26db1df508343bf22768de03fd5d30a5efd327a2c
Instruction ID: ab8af1663ef947be7f6b35d829957f32b736bfaf91b678496a9717b2f1ffa5fb
Opcode Fuzzy Hash: da78aa1b8ae0d7737a011ff26db1df508343bf22768de03fd5d30a5efd327a2c
Instruction Fuzzy Hash: 0A01D67100C7409BEB108E2ACD85767FF99EF61324F1CC96AED494A256C778DC84C6B1

Function 06456E90 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d216cdec01a5c758f6fc9300f774cdccf431e0ad704a1a7fe76a1b6c6594ee
Instruction ID: 6ebc1f1acf2a501991fd06d5ba655147b2f40a05f4d5ebe6bc5b763d7829ac2a
Opcode Fuzzy Hash: 28d216cdec01a5c758f6fc9300f774cdccf431e0ad704a1a7fe76a1b6c6594ee
Instruction Fuzzy Hash: 01F022672040D87FCB224EAE9C10AFB3EECCB8E221B890016FE98D5281C478CD1197B0

Function 0645C4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e0c9bfee4765734813d0d0a30ccd5184a44fd32c24c3f57a10e51e5159d6855
Instruction ID: c01137028c08f5d42f05a1704462187a37ec5ad2dd6628db7856fa245254a608
Opcode Fuzzy Hash: 1e0c9bfee4765734813d0d0a30ccd5184a44fd32c24c3f57a10e51e5159d6855
Instruction Fuzzy Hash: 4201B1306006058FD328AF78D50866E7BE3FFC8315B108A29D14B8B744CFB4E90E9BA5

Function 06455508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6982ca0ecda7ac0f33e53cbf7be844bf4ac4b41b9ed5e8a4223a185920b86987
Instruction ID: d69cac94a75b85b5819bed1b3360e94e79aaf1eca34fb8dedfe469ee7c48c39b
Opcode Fuzzy Hash: 6982ca0ecda7ac0f33e53cbf7be844bf4ac4b41b9ed5e8a4223a185920b86987
Instruction Fuzzy Hash: 9701D630A11305CFCBAE9E35E504537B7F3BF84205755883EE8028265EDA71E481CBD0

Function 0645C170 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e86d5efcc72c9de59f7fe1d1b8a51b41258e742701dab3bed44edbead7db7e2
Instruction ID: 99b01439376e0d38a5223ce5e99129ef63a1747b218173972977e51c01133e1c
Opcode Fuzzy Hash: 0e86d5efcc72c9de59f7fe1d1b8a51b41258e742701dab3bed44edbead7db7e2
Instruction Fuzzy Hash: 6101D131505B04AFD725EF26E8084A2BFFAFB49350700861AE48A87A14DFB0A54ECFD5

Function 06458F42 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cc57d6e7909492c38596412cde3eb511af3be613b16689c9caa9eb68d298a29
Instruction ID: e4f7d4181a8b105580f369a26f6af546c0cd1deccae7296a1cd742b7a88ca450
Opcode Fuzzy Hash: 0cc57d6e7909492c38596412cde3eb511af3be613b16689c9caa9eb68d298a29
Instruction Fuzzy Hash: 830156B5C0421AEFDB40CFA4D8057AEBBF1BB48301F2040AAE814A3341EB304A41CF90

Function 06458F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b616428d6835e63154733017a3b42cfc38d0703a7ae53c1916aaadb9e14e66c4
Instruction ID: fcf284ff9b863daeb09668158dfaefdfaaa43961509485a424ecfab0a1d88b9f
Opcode Fuzzy Hash: b616428d6835e63154733017a3b42cfc38d0703a7ae53c1916aaadb9e14e66c4
Instruction Fuzzy Hash: 640116B4D0421AEFCB44DFA8D9446AEFBF2BB48305F1084AAE814A3351EB344A41CF91

Function 0645ADE9 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa8e8cf33254a936a2b1418b98b110f04dcbff650042f92f9548f8ad6a52631c
Instruction ID: aa5bffca0ac7c0fe9e9e5eb33343a4b82e97024d91f6655bded72bf89411bd43
Opcode Fuzzy Hash: fa8e8cf33254a936a2b1418b98b110f04dcbff650042f92f9548f8ad6a52631c
Instruction Fuzzy Hash: 29F02E312051507FC324276DAC59EEFBFDEEFC6760B040169F14AC3283CA61184887B5

Function 0645ACB8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed2c50a3c11cf439e83198b6b9f5db18228f8995f1b4ed147c7d03dea5d3149c
Instruction ID: 59c9af2e507577696a1fa4dec3a916d3f177606efb47aaf99384eac068ceec10
Opcode Fuzzy Hash: ed2c50a3c11cf439e83198b6b9f5db18228f8995f1b4ed147c7d03dea5d3149c
Instruction Fuzzy Hash: 21F052B22092B01FC32717386C184AE7FAAE8C2A91304009BE182CB392DB44890AC3F5

Function 00D4DA4C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1756399693.0000000000D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d4d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8341e4d5c4c20443696cbb78e1b4990ef7b19f8ce96deea68d5f744ad01503b2
Instruction ID: 88e2c7697af2a4d44c0e0049593f660cb0fe37bd4666aaafe8ac43908d9fec34
Opcode Fuzzy Hash: 8341e4d5c4c20443696cbb78e1b4990ef7b19f8ce96deea68d5f744ad01503b2
Instruction Fuzzy Hash: 9EF062714087449FE7108A1ACD84B62FFA8EB61739F18C55AED485A286C3799845CAB1

Function 0645C110 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff33b30106cc01b861051b4437c9fb724e05c4b11579174640b3b0643226e25
Instruction ID: 7bb131df3f9cd81fdb7d2fbb2a3c365807113cc82354f37e4b3bf5907825b7bf
Opcode Fuzzy Hash: 6ff33b30106cc01b861051b4437c9fb724e05c4b11579174640b3b0643226e25
Instruction Fuzzy Hash: 83F08B312097E00FC326A33DE8086DB3FE6CF82214B04005AF142CB652CBA19908CBE1

Function 06456EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 908f96313e3011056c73602f91dcdfbb154e2143cf8116654b23ea366fef7851
Instruction ID: 76605529953266cc876911d3b263a120c8578779d2f5482d6f99b5a5a525ec8a
Opcode Fuzzy Hash: 908f96313e3011056c73602f91dcdfbb154e2143cf8116654b23ea366fef7851
Instruction Fuzzy Hash: 7FF012662041E87F8B554E9A5C14CFB7FEDDA8E1617084156FE98D2181C429CD21ABB0

Function 064567C8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46f0216151cc361f298dbf4691c1b344a29cd18270e4c3698072516134afbebf
Instruction ID: b0a8ce201783b0d1f309899611879e4813d6e55f7336888b3bde122a09720b63
Opcode Fuzzy Hash: 46f0216151cc361f298dbf4691c1b344a29cd18270e4c3698072516134afbebf
Instruction Fuzzy Hash: CBF0F031B00300AFC7218A28AC05F567FE49F42725F068166FA50CB2F2D6B1E8049340

Function 06458FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6197cc3b2289b003b5d480d43fc3f65b435dbf9a7a1f326a00ef528c7471b8c2
Instruction ID: 16e94547c424bfce1d5a25609ee7c3c14749ec74bbaa7ad71e38fab55231d6f6
Opcode Fuzzy Hash: 6197cc3b2289b003b5d480d43fc3f65b435dbf9a7a1f326a00ef528c7471b8c2
Instruction Fuzzy Hash: A5F0AFB5C08169DFDB00CBA0C4141ADBFB1EB5A301F0041D7E846E7352EA358A02DB40

Function 06458341 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c0eee0f8920b16d9b1a42636808dd1147abe924a1b0797d78daf2efebaf3ad
Instruction ID: 4fa6459a2a1576255a5a0bed3458e485eb6695542e72d74a94ff767e1d42ee89
Opcode Fuzzy Hash: 14c0eee0f8920b16d9b1a42636808dd1147abe924a1b0797d78daf2efebaf3ad
Instruction Fuzzy Hash: 6FF0A032F101295F8B11EA69AC499BFBBB9EF95261B08002BE914D3240FF30890587A1

Function 064554F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49114e00524b675dbe2c072107c7b462b7354494a2792693f96cbe835d3c92be
Instruction ID: 37b80ff87c06656411f41d5000d91e77fc9a2e388e809081df52bf0b1165511f
Opcode Fuzzy Hash: 49114e00524b675dbe2c072107c7b462b7354494a2792693f96cbe835d3c92be
Instruction Fuzzy Hash: C5F024315007058FDBAACE61E50077BBBF2AF80315F4A896ED84642A2AC674E485CB40

Function 0645ADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb316127502ba64f7d05adc11abe71be17cf8c3720ccfd0234857d415f5b92e7
Instruction ID: 04dc5919f73a04188984b4ce09db8b4598cf4ad695e401ef8822a4c21a47b507
Opcode Fuzzy Hash: fb316127502ba64f7d05adc11abe71be17cf8c3720ccfd0234857d415f5b92e7
Instruction Fuzzy Hash: BBE048313001116FD7146B9EE449A9FBBDAEBC9B61B40453DF20FC3382DEA5580947B9

Function 0645C180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794e8e5ce6d8949202b5f5a35035f6a3b195e8129d4a879ad31f756fd80ac677
Instruction ID: 7920a4e738a158f435917f03f479a8d3c70077c35e146a957cd8b52ba2a7f57c
Opcode Fuzzy Hash: 794e8e5ce6d8949202b5f5a35035f6a3b195e8129d4a879ad31f756fd80ac677
Instruction Fuzzy Hash: 29F06D35500B058FDB29DF26E408516BBF6FB88304B00C62EE48B87A14DFB0A50ACF84

Function 0645CC38 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a68bfa4a1d7c7f6319426dbe96d4de4f948e8f3fc911f959cc883f1c5baead9d
Instruction ID: 0eae693bdcf6b58e5b4d5c158052cd2a2bf3ca02b08cc44e552a13c7a4ac18d0
Opcode Fuzzy Hash: a68bfa4a1d7c7f6319426dbe96d4de4f948e8f3fc911f959cc883f1c5baead9d
Instruction Fuzzy Hash: BAE0D832602A506FCB02AA25FD025FA3B71D782626B004166E140C7E46C630094E8BF2

Function 0645B500 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a14ea8d1397261fd060dc5143b6c8e3fddb6eb6b29fca107cbf208bba429cadd
Instruction ID: 0cd12f822954d0156976144626a15a359c5febcb7a4c5a128b74ea21d88b0144
Opcode Fuzzy Hash: a14ea8d1397261fd060dc5143b6c8e3fddb6eb6b29fca107cbf208bba429cadd
Instruction Fuzzy Hash: 6DF03975D0120CBFCF11EFB4E9488CEBFB9EB44240F1042A6E809E7240EA305B89DB91

Function 0645C120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ce19891e1a83fef167bb374e900471d2d0d4e90728021bb5bc7da2c5496c513
Instruction ID: 8b388295037ce6f8d76200f5ab6997f5c207bddbefeabb7d1b642994ae8d55d7
Opcode Fuzzy Hash: 7ce19891e1a83fef167bb374e900471d2d0d4e90728021bb5bc7da2c5496c513
Instruction Fuzzy Hash: 96E0E531200B504FC724A72DE5087AF7BE6DF81304F04052DE246CB741CBB1A8098B95

Function 0645CE88 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62fc52edda1a3c8cbd9f2f6dad38b3215c6a91b5fe512a2a612c53b24bc3254e
Instruction ID: c4395e9b9bc6c3b6275a3e58c6c9410fd7ff521880ff683f19f8b95d97b908cb
Opcode Fuzzy Hash: 62fc52edda1a3c8cbd9f2f6dad38b3215c6a91b5fe512a2a612c53b24bc3254e
Instruction Fuzzy Hash: 72E0D870405B90BFC766A624FD069F63F74DB022257010156E8418BE46C6344985C7E1

Function 06455698 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba22ce3208b7572185fb30dbb8073193c1d7e509e395d2641054e0bec963caff
Instruction ID: 21ba3a8bc7bdf8a883bd639be26a5b21ae1a914471149d6a10fe13742cceaa5d
Opcode Fuzzy Hash: ba22ce3208b7572185fb30dbb8073193c1d7e509e395d2641054e0bec963caff
Instruction Fuzzy Hash: 42E0DFB211D3804FE3058660B80A9C72B98EF22320F528CBEE040CA092EA39E443C655

Function 0645E8F8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93826366fff7be42d3958680d23538f75e2d49d0d9fda96991d9584a5c72117c
Instruction ID: 1ca7d2606ff58c7f46b1f16a673ef8786bd7f9b737b1121e0fa08eddaacffde5
Opcode Fuzzy Hash: 93826366fff7be42d3958680d23538f75e2d49d0d9fda96991d9584a5c72117c
Instruction Fuzzy Hash: BAE0EC3A116244BFC7029A55DC41CE63F7DEF4A6603044086F5418F972C6229D21DBB1

Function 0645E1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b2449d26072be791189ed3161f163189268cebd3c738fb808992cab74547bef
Instruction ID: cc3234ae83abd7f661793404ffa64a61c599b81d6abc952ff5231c3757bfee39
Opcode Fuzzy Hash: 6b2449d26072be791189ed3161f163189268cebd3c738fb808992cab74547bef
Instruction Fuzzy Hash: BBE02071A45304FFCF05DF68ED419EE7BF1DB81200B1041D6D405D7291D5704F148791

Function 0645E280 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d06d424729777612e1bf950e9c9344a5e127e052d410d1c2f09065452bcbf43
Instruction ID: 46094cdd1fa5288cb42deaf45c69ae4fd2a516904a5fe740fa7a6fec8e407c69
Opcode Fuzzy Hash: 6d06d424729777612e1bf950e9c9344a5e127e052d410d1c2f09065452bcbf43
Instruction Fuzzy Hash: 26E0D830400F118FC736FB24FE47AF57BF5E745718B014119D8410BAA9C7B41A498BE5

Function 0645AC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dfde384aa249b5109a36a6847be3773b4dd2e884ee4a8edd15b47ad7070f91f
Instruction ID: 1bfed02b96fdbf3f119147d21064429db029e88e38965de9ed10e0fa76fc67ed
Opcode Fuzzy Hash: 2dfde384aa249b5109a36a6847be3773b4dd2e884ee4a8edd15b47ad7070f91f
Instruction Fuzzy Hash: 89D05B71300135578615276DF4184AE779BEAC5AA13000529E607C3340DF655D0957E5

Function 0645B510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 793fcb04f3ffedd591ccd132eea2512667c58cbc197b6d434ca448f5ba37a8d6
Instruction ID: fa668146812b47af3233c2353d25088f7d0ffbcbc0adf01573b4d3b87b02971b
Opcode Fuzzy Hash: 793fcb04f3ffedd591ccd132eea2512667c58cbc197b6d434ca448f5ba37a8d6
Instruction Fuzzy Hash: 6DE09A75D0020CEFCF54DFE4D5448DDBBB9EB48200F1082A6D905A3200EB705B55DF80

Function 0645E210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8255d317aba7167f9eca3478bb8462aab5ad90870c9047558d8a43c4b156ed5
Instruction ID: ffdc6fe1b65c3b2b075c6eb16cbfc6f24c680ec2e22dac7113aba7ecf2d4a2d1
Opcode Fuzzy Hash: c8255d317aba7167f9eca3478bb8462aab5ad90870c9047558d8a43c4b156ed5
Instruction Fuzzy Hash: 35D05BB1A0020CFFCF44DFACEA015ADB7F5EB44204B1041E9D409D7300DA715F149B90

Function 0645F8EA Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcae5bb8f2e6e9be2c8c7080935ff6e3343cbd83c788ae1a757361c87b9ce73e
Instruction ID: 9d0e01a9133cc6776ca537ec236323514bac94eeb9d3e3077aca12b6859c2a2a
Opcode Fuzzy Hash: dcae5bb8f2e6e9be2c8c7080935ff6e3343cbd83c788ae1a757361c87b9ce73e
Instruction Fuzzy Hash: 63C012327001201B0A98AA6CB0200AD7AD7D2C86E7389412BF60EC3388EDA28C4657A5

Function 06453721 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e958abc784deaad6cb94dc54d21a3a98bd0bb5ea3bc0aeeb8a19d6fa28bc9e5
Instruction ID: 39777cdcbc6a798abb641348e5fce965e093570427709ea866819b5b7d7bbd69
Opcode Fuzzy Hash: 2e958abc784deaad6cb94dc54d21a3a98bd0bb5ea3bc0aeeb8a19d6fa28bc9e5
Instruction Fuzzy Hash: 97B012F3A2500043D31911009CD2FE212169BB51A8F9F522055A0D2383E578D0030068

Function 0645DFD1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d825437ba68b30db26e01977aaf42e00e7eaea76dd4284980b5392c322778a3f
Instruction ID: 79680abde4bd039325379431e4c96e417c9d9ea964ac769d6178ec0140165cbd
Opcode Fuzzy Hash: d825437ba68b30db26e01977aaf42e00e7eaea76dd4284980b5392c322778a3f
Instruction Fuzzy Hash: C3C09B7155B7D05EDF0617749C0D8C53F169F5277171640C7E3458E063D5614049CFD1

Non-executed Functions

Function 0645E2C7 Relevance: 46.6, Strings: 37, Instructions: 390COMMON

Download Yara Rule

Strings

DGj, xrefs: 0645E608
DGj, xrefs: 0645E593
DGj, xrefs: 0645E658
DGj, xrefs: 0645E6A8
DGj, xrefs: 0645E4CB
DGj, xrefs: 0645E2E4
DGj, xrefs: 0645E748
DGj, xrefs: 0645E6D0
DGj, xrefs: 0645E456
DGj, xrefs: 0645E32E
DGj, xrefs: 0645E309
DGj, xrefs: 0645E819
DGj, xrefs: 0645E47B
DGj, xrefs: 0645E844
DGj, xrefs: 0645E56B
DGj, xrefs: 0645E680
DGj, xrefs: 0645E7C3
DGj, xrefs: 0645E5E3
DGj, xrefs: 0645E39D
DGj, xrefs: 0645E4F3
DGj, xrefs: 0645E7EE
DGj, xrefs: 0645E378
DGj, xrefs: 0645E770
DGj, xrefs: 0645E4A3
DGj, xrefs: 0645E40C
DGj, xrefs: 0645E720
DGj, xrefs: 0645E431
DGj, xrefs: 0645E3C2
DGj, xrefs: 0645E630
DGj, xrefs: 0645E798
DGj, xrefs: 0645E86F
DGj, xrefs: 0645E51B
DGj, xrefs: 0645E6F8
DGj, xrefs: 0645E5BB
DGj, xrefs: 0645E543
DGj, xrefs: 0645E3E7
DGj, xrefs: 0645E353

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-3760891704
Opcode ID: 426df6a6552e967da3f8ddd53aa257960890cebe988d57a2d817caf306b0d032
Instruction ID: 4cd224b7ca9972fbf1051ce911bdcebb0d78631509f177448d66f021ed199d6c
Opcode Fuzzy Hash: 426df6a6552e967da3f8ddd53aa257960890cebe988d57a2d817caf306b0d032
Instruction Fuzzy Hash: 03D1A3303006006BD6196AAD9D93EBDA753FB86304B40453CD12A4FB9AEFB1AD1947E7

Function 0645E2D8 Relevance: 46.6, Strings: 37, Instructions: 383COMMON

Download Yara Rule

Strings

DGj, xrefs: 0645E608
DGj, xrefs: 0645E593
DGj, xrefs: 0645E658
DGj, xrefs: 0645E6A8
DGj, xrefs: 0645E4CB
DGj, xrefs: 0645E2E4
DGj, xrefs: 0645E748
DGj, xrefs: 0645E6D0
DGj, xrefs: 0645E456
DGj, xrefs: 0645E32E
DGj, xrefs: 0645E309
DGj, xrefs: 0645E819
DGj, xrefs: 0645E47B
DGj, xrefs: 0645E844
DGj, xrefs: 0645E56B
DGj, xrefs: 0645E680
DGj, xrefs: 0645E7C3
DGj, xrefs: 0645E5E3
DGj, xrefs: 0645E39D
DGj, xrefs: 0645E4F3
DGj, xrefs: 0645E7EE
DGj, xrefs: 0645E378
DGj, xrefs: 0645E770
DGj, xrefs: 0645E4A3
DGj, xrefs: 0645E40C
DGj, xrefs: 0645E720
DGj, xrefs: 0645E431
DGj, xrefs: 0645E3C2
DGj, xrefs: 0645E630
DGj, xrefs: 0645E798
DGj, xrefs: 0645E86F
DGj, xrefs: 0645E51B
DGj, xrefs: 0645E6F8
DGj, xrefs: 0645E5BB
DGj, xrefs: 0645E543
DGj, xrefs: 0645E3E7
DGj, xrefs: 0645E353

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-3760891704
Opcode ID: 2d372b44639bac796184dcdd6414ffa3e7f05c5ef8ccdd0102dcbb05e42ac5c5
Instruction ID: 3d9f8322306ddc2c7b6d21305db2558fcad07fd83520badc85c5eff39ff1548d
Opcode Fuzzy Hash: 2d372b44639bac796184dcdd6414ffa3e7f05c5ef8ccdd0102dcbb05e42ac5c5
Instruction Fuzzy Hash: C9D1A3303006006BD6196AAD9D93EBDA753FB87304B40453CD12A4FB9AEFB1AD1947E7

Function 0645CC7F Relevance: 16.4, Strings: 13, Instructions: 152COMMON

Download Yara Rule

Strings

DGj, xrefs: 0645CCC1
DGj, xrefs: 0645CE33
DGj, xrefs: 0645CCE6
DGj, xrefs: 0645CD9F
DGj, xrefs: 0645CE58
DGj, xrefs: 0645CDE9
DGj, xrefs: 0645CD7A
DGj, xrefs: 0645CE0E
DGj, xrefs: 0645CD30
DGj, xrefs: 0645CC9C
DGj, xrefs: 0645CD0B
DGj, xrefs: 0645CD55
DGj, xrefs: 0645CDC4

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-2950335420
Opcode ID: 9352dbdc9b96c505adbcc8c61ff0b740f7270bceed600ebb663aacaccf0bb6d6
Instruction ID: 27a9a2f7168c8bf52b72e63e8c1b4cce71fd90f01c99dd51151c71a804e8fc8e
Opcode Fuzzy Hash: 9352dbdc9b96c505adbcc8c61ff0b740f7270bceed600ebb663aacaccf0bb6d6
Instruction Fuzzy Hash: 7641BC303006007FD6156AAD9D93EADA753FB87300B404638D12A4FB96EFB5AD4947E7

Function 0645CC90 Relevance: 16.4, Strings: 13, Instructions: 143COMMON

Download Yara Rule

Strings

DGj, xrefs: 0645CCC1
DGj, xrefs: 0645CE33
DGj, xrefs: 0645CCE6
DGj, xrefs: 0645CD9F
DGj, xrefs: 0645CE58
DGj, xrefs: 0645CDE9
DGj, xrefs: 0645CD7A
DGj, xrefs: 0645CE0E
DGj, xrefs: 0645CD30
DGj, xrefs: 0645CC9C
DGj, xrefs: 0645CD0B
DGj, xrefs: 0645CD55
DGj, xrefs: 0645CDC4

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-2950335420
Opcode ID: 17ccc35c70d3bab75dea729cbc58bf917f41d17af9f436d46a0a575bd88db3bc
Instruction ID: e64d26f7a4d2cf8e14ce176995b15d12dba4db9e6927d7b9f8ce799c532eb6b2
Opcode Fuzzy Hash: 17ccc35c70d3bab75dea729cbc58bf917f41d17af9f436d46a0a575bd88db3bc
Instruction Fuzzy Hash: 3B418A303006106BD6156AAD9D93E6DA753FB87300B40463CD22A4FB9AEFB5AD0947E7

Function 0645CED1 Relevance: 10.1, Strings: 8, Instructions: 106COMMON

Download Yara Rule

Strings

DGj, xrefs: 0645CFCA
DGj, xrefs: 0645CF80
DGj, xrefs: 0645CF11
DGj, xrefs: 0645CF36
DGj, xrefs: 0645CEEC
DGj, xrefs: 0645CF5B
DGj, xrefs: 0645CFA5
DGj, xrefs: 0645CFEF

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-4266538241
Opcode ID: 6eb2e70da1a9fb7bbd7d0a4550f4bfa798e04d4e7fa2c84dd9165c97588ce056
Instruction ID: d28e8f0f2e66e1cf9a2c108fa7afef6eae952d57594a148f127ba945dd7c18df
Opcode Fuzzy Hash: 6eb2e70da1a9fb7bbd7d0a4550f4bfa798e04d4e7fa2c84dd9165c97588ce056
Instruction Fuzzy Hash: BC31C4303002117FD6156AAD9C93EBDA756EB87300B404638E1294FB9AEFB1AD4847E7

Function 0645CEE0 Relevance: 10.1, Strings: 8, Instructions: 93COMMON

Download Yara Rule

Strings

DGj, xrefs: 0645CFCA
DGj, xrefs: 0645CF80
DGj, xrefs: 0645CF11
DGj, xrefs: 0645CF36
DGj, xrefs: 0645CEEC
DGj, xrefs: 0645CF5B
DGj, xrefs: 0645CFA5
DGj, xrefs: 0645CFEF

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-4266538241
Opcode ID: 880b04df42c72299304d2eb0e7d75c836d191549e9091a138ff68def5a006750
Instruction ID: fc0b90e5245c8427f02c48bd80310f6c20b98548fa1a341f89b5ba378b13275f
Opcode Fuzzy Hash: 880b04df42c72299304d2eb0e7d75c836d191549e9091a138ff68def5a006750
Instruction Fuzzy Hash: 2721CB303002016BD6056AAD9D93E7DA753FB86304B40463CD1294FB9ADFB17D4547E7

Function 0645C968 Relevance: 8.8, Strings: 7, Instructions: 89COMMON

Download Yara Rule

Strings

DGj, xrefs: 0645C9AD
DGj, xrefs: 0645CA51
DGj, xrefs: 0645CA28
DGj, xrefs: 0645CA7A
DGj, xrefs: 0645C9D6
DGj, xrefs: 0645C9FF
DGj, xrefs: 0645C984

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-3215742008
Opcode ID: be10abb1de256257b6afc0fd70e30a76694087873951f3999c925946bd2ad6a7
Instruction ID: caba7bfad9c5623755a050d26bca940ba29da1cfbe35a0a5d5269513685bf105
Opcode Fuzzy Hash: be10abb1de256257b6afc0fd70e30a76694087873951f3999c925946bd2ad6a7
Instruction Fuzzy Hash: 0E31D8303006826FDB152BADDD52DAD7B53FB877047004238E1169FAE5DEB19E8A8B91

Function 0645C978 Relevance: 8.8, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

DGj, xrefs: 0645C9AD
DGj, xrefs: 0645CA51
DGj, xrefs: 0645CA28
DGj, xrefs: 0645CA7A
DGj, xrefs: 0645C9D6
DGj, xrefs: 0645C9FF
DGj, xrefs: 0645C984

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-3215742008
Opcode ID: a67ee98f5102adee94c287dd777fc8e26e465d16178aed77d36ec7f0c357ffa4
Instruction ID: 35ef98f42a27273592cc2d7498af98d214bc0c533241775255c0db2a7dc9b58d
Opcode Fuzzy Hash: a67ee98f5102adee94c287dd777fc8e26e465d16178aed77d36ec7f0c357ffa4
Instruction Fuzzy Hash: C521A7303005826FDB053FADDD52CAD7753F7867007004238E1169FB99DEB09E8A8B91

Function 0645D538 Relevance: 7.6, Strings: 6, Instructions: 84COMMON

Download Yara Rule

Strings

DGj, xrefs: 0645D579
DGj, xrefs: 0645D60D
DGj, xrefs: 0645D554
DGj, xrefs: 0645D59E
DGj, xrefs: 0645D5C3
DGj, xrefs: 0645D5E8

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-1101258311
Opcode ID: 10a1b2da390fd9b690e2806c7b28f4296b3355f819a57983b05c02531be3dbc6
Instruction ID: ebcc176a72aa88ee091d738882a12c961d33257b84fcd7d4f735b37d2df8b353
Opcode Fuzzy Hash: 10a1b2da390fd9b690e2806c7b28f4296b3355f819a57983b05c02531be3dbc6
Instruction Fuzzy Hash: 9C21E5303002007FD6056AAD9C93EADAB57EB87704B404638E1294FB96DFB26D0943F3

Function 0645D548 Relevance: 7.6, Strings: 6, Instructions: 73COMMON

Download Yara Rule

Strings

DGj, xrefs: 0645D579
DGj, xrefs: 0645D60D
DGj, xrefs: 0645D554
DGj, xrefs: 0645D59E
DGj, xrefs: 0645D5C3
DGj, xrefs: 0645D5E8

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID: DGj$DGj$DGj$DGj$DGj$DGj
API String ID: 0-1101258311
Opcode ID: 9c20b1db4438e2c56c97a9488f7bab8ed35394d616510ac5cb6aad88e9602ccf
Instruction ID: 38126d3b98afdabd07e21b8c5f7d55b610e9c25f19776a5e2e7388db1838cb8e
Opcode Fuzzy Hash: 9c20b1db4438e2c56c97a9488f7bab8ed35394d616510ac5cb6aad88e9602ccf
Instruction Fuzzy Hash: 3311F9303002007FD6056AAD9D93EADA757EB87704B40463CD1294FB9AEFB2AD1947E3

Function 0645ED10 Relevance: 5.2, Strings: 4, Instructions: 243COMMON

Download Yara Rule

Strings

(_^q, xrefs: 0645EF79
(_^q, xrefs: 0645EDF9
(_^q, xrefs: 0645EEFA
(_^q, xrefs: 0645ED7A

Memory Dump Source

Source File: 00000001.00000002.1766034424.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6450000_RegAsm.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: 452a980f471e296e31bac33facd36305815f870e88857de6952a4779ec94d0f1
Instruction ID: e7bd54ff8bff0b1f0b624dab1d26778b653e5f56fe674ce54e665410f54ad8ab
Opcode Fuzzy Hash: 452a980f471e296e31bac33facd36305815f870e88857de6952a4779ec94d0f1
Instruction Fuzzy Hash: EC91CE35B042049FDB09AF78C4145AE7BB6FFC5340F2485AAEC069B382DA75DE06CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Users\user\AppData\Local\Temp\Tmp9897.tmp

C:\Users\user\AppData\Local\Temp\Tmp98C7.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Windows Analysis Report
file.exe

Function 00BB018D Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Function 003EF1E8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 003FC20E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42
memorythreadCOMMON

Function 003F2C21 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Function 003EC2E9 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 003F4F3F Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 003EF682 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Function 003F4B43 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Function 003EF2B3 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre