Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1466011
MD5:	75a2d212a591a83a4d0c88a92b390b88
SHA1:	8f69b79a0d6bc6b4def35b38ec46d15e6eb1c1d9
SHA256:	cf47a943ec0eb86c16a8d7e6e0ad8c4bfb6063af089e1b3809ed44ac45347e71
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6760 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 75A2D212A591A83A4D0C88A92B390B88)

RegAsm.exe (PID: 4832 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 5780 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 2408 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 304 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "77.105.135.107:3445", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.2193423222.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: file.exe PID: 6760	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5780	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5780	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.bbab00.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.bbab00.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.b20000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Snort Signatures

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.135.107

Timestamp:	07/02/24-12:24:00.932845
SID:	2046045
Source Port:	49704
Destination Port:	3445
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 77.105.135.107 - Destination IP: 192.168.2.5

Timestamp:	07/02/24-12:24:06.375739
SID:	2046056
Source Port:	3445
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 77.105.135.107 - Destination IP: 192.168.2.5

Timestamp:	07/02/24-12:24:01.127422
SID:	2043234
Source Port:	3445
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.5 - Destination IP: 77.105.135.107

Timestamp:	07/02/24-12:24:13.135257
SID:	2043231
Source Port:	49704
Destination Port:	3445
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "77.105.135.107:3445", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\p1cdefvh41vy\output.pdb source: file.exe
Source:	Binary string: C:\p1cdefvh41vy\output.pdb' source: file.exe

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B92DA6 FindFirstFileExW,		0_2_00B92DA6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B93193 FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_00B93193

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.5:49704 -> 77.105.135.107:3445
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.5:49704 -> 77.105.135.107:3445
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 77.105.135.107:3445 -> 192.168.2.5:49704
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 77.105.135.107:3445 -> 192.168.2.5:49704

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 77.105.135.107:3445

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 77.105.135.107:3445

Source: Joe Sandbox View

ASN Name: PLUSTELECOM-ASRU PLUSTELECOM-ASRU

Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.135.107

Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: RegAsm.exe, 00000002.00000002.2194057425.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adob
Source: RegAsm.exe, 00000002.00000002.2194057425.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purl.oen
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: RegAsm.exe, 00000002.00000002.2194705356.000000000304D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: RegAsm.exe, 00000002.00000002.2194705356.000000000304D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000003097000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegAsm.exe, 00000002.00000002.2194705356.000000000304D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000003097000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000003097000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003097000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000003097000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000002DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: RegAsm.exe, 00000002.00000002.2194705356.000000000315E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2197364899.0000000003D5B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003274000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003164000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000002.00000002.2193423222.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: RegAsm.exe, 00000002.00000002.2194705356.000000000315E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2197364899.0000000003D5B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003274000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003164000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegAsm.exe, 00000002.00000002.2194705356.000000000315E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2197364899.0000000003D5B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003274000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003164000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegAsm.exe, 00000002.00000002.2194705356.000000000315E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2197364899.0000000003D5B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003274000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003164000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000002.00000002.2194705356.000000000315E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2197364899.0000000003D5B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003274000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003164000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000003D5B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003164000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegAsm.exe, 00000002.00000002.2194705356.000000000315E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: RegAsm.exe, 00000002.00000002.2194705356.000000000315E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2197364899.0000000003D5B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003274000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003164000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 00000002.00000002.2194705356.000000000315E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2197364899.0000000003D5B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003274000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003164000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RegAsm.exe, 00000002.00000002.2194705356.000000000315E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2197364899.0000000003D5B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003274000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003164000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B9A02C	0_2_00B9A02C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6E1A4	0_2_00B6E1A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6C2C6	0_2_00B6C2C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B8C310	0_2_00B8C310
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B825A5	0_2_00B825A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6E5C5	0_2_00B6E5C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6C60E	0_2_00B6C60E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7C99E	0_2_00B7C99E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6E9F5	0_2_00B6E9F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B8A9F5	0_2_00B8A9F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6C965	0_2_00B6C965
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6CCAD	0_2_00B6CCAD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B98CF7	0_2_00B98CF7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B4EC30	0_2_00B4EC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6D03B	0_2_00B6D03B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6D3D8	0_2_00B6D3D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7F4F0	0_2_00B7F4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7D471	0_2_00B7D471
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B31560	0_2_00B31560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B23780	0_2_00B23780
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6D766	0_2_00B6D766
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA78B0	0_2_00BA78B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6DACB	0_2_00B6DACB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7FA20	0_2_00B7FA20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6DE3F	0_2_00B6DE3F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7FE60	0_2_00B7FE60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B53FF4	0_2_00B53FF4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02BADC74	2_2_02BADC74

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00B76D38 appears 32 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00B4C7AF appears 117 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00B88C84 appears 33 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00B4D160 appears 67 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00B4C7E2 appears 76 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 304

Source: file.exe, 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenamePunningly.exe8 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/6@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6760

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\51becbbe-f53c-4af6-8535-c80a7a5c29ae

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 304
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32

Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\p1cdefvh41vy\output.pdb source: file.exe
Source:	Binary string: C:\p1cdefvh41vy\output.pdb' source: file.exe

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B4C77D push ecx; ret		0_2_00B4C790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B4D1B0 push ecx; ret		0_2_00B4D1C3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2B40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2D20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4D20000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 450			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 3062			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 7.4 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7408	Thread sleep time: -11990383647911201s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4368	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B92DA6 FindFirstFileExW,		0_2_00B92DA6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B93193 FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_00B93193

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CAHNNTHTJYHYJSYCEYHNZYLYPZZRKQCBEKCIJOMVDKLIMUKHNBXCTWEOWAPIZLIROXKDWVWPAJXRXLLBZPLBODFKBOAAIGTICFSLICMIRMFQVAOXHGTZBMVNEYHPFMVMCIZMYUKDQAJPPKRYFMFYBBZZUDRZUAXHAETNILYTWGZWXKMVYVQPTHACYZNPNUTFPXHLZGFMCFPKGKXZBEMNDEMMSUCIJVEEZVVTNLALWSOOIQWNDNBYFXIMXSYSGIHDKBLTQNHGZBSABJNNCDWHLHGGLULQOHIPDWXBOSOZDGSJICPXZOMIEHQNITIKIXBHUHPYBVDEESQCONQTQTGDIDHFZLNHGHGBNMCJMHPFYAEFORSGPQVZXVNVTODPAYYBGVVJXOQSOXDEYRXFEQHHZXPIKKKAYEDXYKYANMXDXCYRRYSRYIHJTRQILRXNGCFCDERRCTAPDWXXOUTNWBDGRIXGZFWOPASEDDSDMQOIHQDMFZFHVAKVPOTYYQXENYUVBZWKYSVATRNDKTBQJKCBIUQOGVVRSKQRXEZOQAFWIQOTGVRLVGJCXQRXZRDCAHGTXVJAEUKUYANEGPRLWIUCPMSVVQZZMIBQKJKZRROZREPQAHYLRVAFUIGNUGSAQAMAZEHHGHFNSBQQBZOSFYEVJOWSCRJNDOYFYNDGPN
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RegAsm.exe, 00000002.00000002.2194255199.0000000001221000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: IVHSHTCODIPNTGBCHMNVKPUAILXVVKFKXVQUNCFXTBCMTEBSWXPFTMDSDGZKIAUVKOEHSXZJBPMNMGEXTJPAOEMDPTHXRQCVOULRHOXNLLEVOYSUUHJKHUBLKPVUBOWNNNYIVERGXUJXWHARSIBRHIALJWVNJGCJFSWTYNFAKHFKMWIXKIPPQTBKLVLJABTXJJAUPFFIWTLSIBHYUFUKBTZFKZOHSTUPFMPQIOKLVDQRVIJQOGXFVCXVTHXYBRKEFKTAYEVEEJSDTODNKYUKIFEJTGSCOFEGJFXUFFTUDUGNPSDSFNCYGRUOKLHTZSRYLVFROHKDEBPBTMLYGSXGAHMMJCCAHNNTHTJYHYJSYCEYHNZYLYPZZRKQCBEKCIJOMVDKLIMUKHNBXCTWEOWAPIZLIROXKDWVWPAJXRXLLBZPLBODFKBOAAIGTICFSLICMIRMFQVAOXHGTZBMVNEYHPFMVMCIZMYUKDQAJPPKRYFMFYBBZZUDRZUAXHAETNILYTWGZWXKMVYVQPTHACYZNPNUTFPXHLZGFMCFPKGKXZBEMNDEMMSUCIJVEEZVVTNLALWSOOIQWNDNBYFXIMXSYSGIHDKBLTQNHGZBSABJNNCDWHLHGGLULQOHIPDWXBOSOZDGSJICPXZOMIEHQNITIKIXBHUHPYBVDEESQCONQTQTGDIDHFZLNHGHGBNMCJMHPFYAEFORSGPQVZXVNVTODPAYYBGVVJXOQSOXDEYRXFEQHHZXPIKKKAYEDXYKYANMXDXCYRRYSRYIHJTRQILRXNGCFCDERRCTAPDWXXOUTNWBDGRIXGZFWOPASEDDSDMQOIHQDMFZFHVAKVPOTYYQXENYUVBZWKYSVATRNDKTBQJKCBIUQOGVVRSKQRXEZOQAFWIQOTGVRLVGJCXQRXZRDCAHGTXVJAEUKUYANEGPRLWIUCPMSVVQZZMIBQKJKZRROZREPQAHYLRVAFUIGNUGSAQAMAZEHHGHFNSBQQBZOSFYEVJOWSCRJNDOYFYNDGPN
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: RegAsm.exe, 00000002.00000002.2197364899.0000000004121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: RegAsm.exe, 00000002.00000002.2194705356.0000000002FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B927AA IsDebuggerPresent,

0_2_00B927AA

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B8A697 mov eax, dword ptr fs:[00000030h]	0_2_00B8A697
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B8A4F0 mov eax, dword ptr fs:[00000030h]	0_2_00B8A4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B8A5D1 mov eax, dword ptr fs:[00000030h]	0_2_00B8A5D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B8A533 mov eax, dword ptr fs:[00000030h]	0_2_00B8A533
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B8A576 mov eax, dword ptr fs:[00000030h]	0_2_00B8A576
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B8A6DB mov eax, dword ptr fs:[00000030h]	0_2_00B8A6DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B8A71F mov eax, dword ptr fs:[00000030h]	0_2_00B8A71F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B8A750 mov eax, dword ptr fs:[00000030h]	0_2_00B8A750
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B857E9 mov ecx, dword ptr fs:[00000030h]	0_2_00B857E9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B769E1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B769E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B4CEFF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B4CEFF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B4D08F SetUnhandledExceptionFilter,	0_2_00B4D08F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B4D1C4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00B4D1C4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007E018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_007E018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: DFF008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B4CBC5 cpuid

0_2_00B4CBC5

Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00B88682
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00B88813
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_00B2E9BF
Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00B96F68
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00B8913F
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00B97163
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00B9720A
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00B97273
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00B97399
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00B9730E
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00B975EC
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00B97715
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00B978EA
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoEx,	0_2_00B4B82A
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00B9781B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B4CDD4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00B4CDD4

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B92078 GetTimeZoneInformation,

0_2_00B92078

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.bbab00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.bbab00.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.b20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2193423222.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5780, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5780, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.bbab00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.bbab00.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.b20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2193423222.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5780, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	1 Masquerading	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	241 Security Software Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	134 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	61%	ReversingLabs	Win32.Trojan.LummaC
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://tempuri.org/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	Virustotal		Browse
http://tempuri.org/Entity/Id14ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id23ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	Virustotal		Browse
77.105.135.107:3445	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Avira URL Cloud	safe
77.105.135.107:3445	3%	Virustotal		Browse
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Virustotal		Browse
http://tempuri.org/Entity/Id21Response	4%	Virustotal		Browse
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	Virustotal		Browse
http://tempuri.org/Entity/Id9	3%	Virustotal		Browse
http://tempuri.org/Entity/Id2Response	2%	Virustotal		Browse
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	Virustotal		Browse
http://tempuri.org/Entity/Id12Response	2%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	Virustotal		Browse
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	Avira URL Cloud	safe
http://ns.adob	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://purl.oen	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	1%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	Virustotal		Browse
http://tempuri.org/Entity/Id6ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	1%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	1%	Virustotal		Browse
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	1%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	Virustotal		Browse
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	Virustotal		Browse
http://tempuri.org/Entity/Id6	1%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	2%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	Virustotal		Browse
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	2%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	Virustotal		Browse
http://tempuri.org/Entity/Id6Response	2%	Virustotal		Browse
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
77.105.135.107:3445	true	3%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	RegAsm.exe, 00000002.00000002.2197364899.0000000003D5B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003164000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	RegAsm.exe, 00000002.00000002.2194705356.000000000315E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2197364899.0000000003D5B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003274000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003164000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14ResponseD	RegAsm.exe, 00000002.00000002.2194705356.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	RegAsm.exe, 00000002.00000002.2194705356.0000000003097000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21Response	RegAsm.exe, 00000002.00000002.2194705356.000000000304D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000002DF5000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ns.adob	RegAsm.exe, 00000002.00000002.2194057425.000000000103E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id4	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://purl.oen	RegAsm.exe, 00000002.00000002.2194057425.000000000103E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19Response	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13ResponseD	RegAsm.exe, 00000002.00000002.2194705356.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15Response	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	RegAsm.exe, 00000002.00000002.2194705356.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000002.00000002.2194705356.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6Response	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	file.exe, 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000002.00000002.2193423222.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9Response	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegAsm.exe, 00000002.00000002.2194705356.000000000315E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2197364899.0000000003D5B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003274000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003164000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id20	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003097000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id24Response	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	RegAsm.exe, 00000002.00000002.2194705356.000000000315E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2197364899.0000000003D5B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003274000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000003164000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21ResponseD	RegAsm.exe, 00000002.00000002.2194705356.0000000003097000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	RegAsm.exe, 00000002.00000002.2194705356.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id17	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15ResponseD	RegAsm.exe, 00000002.00000002.2194705356.0000000002DFD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11ResponseD	RegAsm.exe, 00000002.00000002.2194705356.000000000304D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	RegAsm.exe, 00000002.00000002.2194705356.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	RegAsm.exe, 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
77.105.135.107	unknown	Russian Federation		42031	PLUSTELECOM-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466011
Start date and time:	2024-07-02 12:23:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/6@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 26 Number of non-executed functions: 157
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:24:09	API Interceptor	19x Sleep call for process: RegAsm.exe modified
06:24:19	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
77.105.135.107	setup.exe	Get hash	malicious	RedLine	Browse
77.105.135.107	1719859269.0326595_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, Xmrig	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PLUSTELECOM-ASRU	file.exe	Get hash	malicious	Unknown	Browse	77.105.133.27
	setup.exe	Get hash	malicious	RedLine	Browse	77.105.135.107
	1719859269.0326595_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, Xmrig	Browse	77.105.135.107
	zyJWi2vy29.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer, Vidar, zgRAT	Browse	77.105.132.27
	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse	77.105.132.27
	1Cvd8TyYPm.exe	Get hash	malicious	LummaC, Mars Stealer, PureLog Stealer, Stealc, Vidar, Xmrig, zgRAT	Browse	77.105.133.27
	HXUYIDwIMY.exe	Get hash	malicious	Meduza Stealer	Browse	77.105.147.172
	lhZOo8vhuI.elf	Get hash	malicious	Unknown	Browse	77.105.138.202
	file.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse	77.105.147.130
	yqeO67O9gY.elf	Get hash	malicious	Mirai	Browse	77.105.140.109

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_bcb8debaf6c6e3eea7b81188b2bf0e7b56e59ac_910c98a4_d3d94960-ed1e-43ed-9c25-2307c05e8a8c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7035913923344724
Encrypted:	false
SSDEEP:	192:l80sL80hvDPlYt10c2i0E3jGGzuiFoZ24IO8ThB:EoYDNuWc2iHjHzuiFoY4IO8r
MD5:	908D91EAE7667EDEBC4EB1AA3E324706
SHA1:	8EDFAF356741BFC08B12D201553E100CB4DDE455
SHA-256:	EFA94F07F7E13B9269EA2F423F9C88E43394DEBC276842CEB144041E476A0FC9
SHA-512:	57D0D29B27D603E110BDF79DAB6F45A687C80DE97B1C252BD47B73A78BE10ABBDD9638854883C7CCB261B3A13E57F92E09A23E302342EC6259D65BD02C116728
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.4.3.8.9.4.3.7.5.3.3.4.8.6.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.4.3.8.9.4.3.8.0.1.7.8.6.1.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.3.d.9.4.9.6.0.-.e.d.1.e.-.4.3.e.d.-.9.c.2.5.-.2.3.0.7.c.0.5.e.8.a.8.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.4.d.2.3.2.6.3.-.d.4.c.f.-.4.f.9.0.-.b.9.9.b.-.f.8.1.7.4.0.d.b.a.9.f.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.6.8.-.0.0.0.1.-.0.0.1.4.-.6.2.d.1.-.3.d.f.2.6.9.c.c.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.8.f.6.9.b.7.9.a.0.d.6.b.c.6.b.4.d.e.f.3.5.b.3.8.e.c.4.6.d.1.5.e.6.e.b.1.c.1.d.9.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.7.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D23.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Jul 2 10:23:57 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	53610
Entropy (8bit):	1.750063043524919
Encrypted:	false
SSDEEP:	192:d7uuxOrtONWclRDScvUTC7hEAIDSgKUrmMk:tOcNdlbumEhDSghu
MD5:	76B6791DBE9E8A6ACD9F78F7752AF7B5
SHA1:	ABFEA324F5112634C5670CD19EC3C6D9B54FA25E
SHA-256:	B2B9BF7959FECBE863737E55FB655E1A5A976A171CC93BD6AB03181A57FAEF51
SHA-512:	7561B74C39D91F300F7D233288BA61E00E7BD9041E4F44C539F2255F3F36B144538BAD633818C5353D6328EFA4BFFC10848E32C3BDF7184721B71363686D98F4
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......=.f........................0...............b$..........T.......8...........T...........@...*...........,...........................................................................................eJ..............GenuineIntel............T.......h...<.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7DE0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8260
Entropy (8bit):	3.6893410183633355
Encrypted:	false
SSDEEP:	192:R6l7wVeJ9Cw6gu6YEIQSUuFegmfByXIupDT89bB3sflRrm:R6lXJ/6R6YE/SUQegmfwiB8f2
MD5:	F5E798B681E4C628181B800FC9704E6D
SHA1:	BD6571FEDB63ABF72A011E6C7AD0C6A54885DB63
SHA-256:	1F69C11C9E2778D88DAE207EE7AA245E0DB89D7340CE213704CD2EDB3C5E5F9C
SHA-512:	3E99B146DDB80BE64167FFD1F55BD1B12C53027D6ED26379ED9C93DFF7E8679CA027FE0E20BD55FF76FEFDEBFA6E214DEF75F7CFE99477FB21AEC6D4EC915A6E
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E1F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	4.428220343552774
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9w7WpW8VY/Ym8M4J94FI+q8K5+S8iEd:uIjfHI7eK7VrJvJ+SBEd
MD5:	567AA4A24C8E70FABCEA5A0CF8DDFF6D
SHA1:	1622F4F031A90E1D9E733FD8CF51DE53E8A883B5
SHA-256:	9F44FEC3ED221F218C31988E5DCFD416B8578DF0C4EDD6638E9D4B965C26F78C
SHA-512:	6BD2FDF10FEA45E9FF6DC69649E2997DC50433F70F947723C76D2DB184C747B675CA89B184C12FA6476208745C8784E13A6F4BDC965C0B7D2C7AB930FE99C5F3
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="393206" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421337681964193
Encrypted:	false
SSDEEP:	6144:cSvfpi6ceLP/9skLmb0OTSWSPHaJG8nAgeMZMMhA2fX4WABlEnN20uhiTw:HvloTSW+EZMM6DFy403w
MD5:	9095D7BE8EE38E60A3035D1230F8E7ED
SHA1:	1002CA5F350D708E58F79C2CF94A554B59CB0A71
SHA-256:	114F972DC86C3370526EC29284AE50B7A9AEAA76C59867CB3CC603E60433A1C4
SHA-512:	48A9F8CD5C561A3FDB0A9577182F1E61D0C7065648F9F3BD4521B1916DE199C4845B38CEB4697E1FBAF66CE863C0B40D13E5FAAE1B36616DBBC7F8A1B2D24535
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmN`..i................................................................................................................................................................................................................................................................................................................................................f..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.29740036425901
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	957'440 bytes
MD5:	75a2d212a591a83a4d0c88a92b390b88
SHA1:	8f69b79a0d6bc6b4def35b38ec46d15e6eb1c1d9
SHA256:	cf47a943ec0eb86c16a8d7e6e0ad8c4bfb6063af089e1b3809ed44ac45347e71
SHA512:	e7242ef4042f96743a6f999bee1a5ee93a88a6aa83385a28d2b868bd2c2f6734c0bc9192059e5a7862cff747a4dee8a16e9ac10cb659cbd2f05a4a040dd05a47
SSDEEP:	24576:j+qodQCtw8QEZWBiMUp736I5Zqi7P2XZtXtW/Di:iw8QEZWBTXSZqiz2XvXQm
TLSH:	D715CE1135C08036D67320320AA9FAB99AFEF4341B2966CF17D85A7E9F346C15B3526F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x...+...+...+z.....+z.....+z.....+k\....+k\....+z.....+...+)..+k\....+Z_....+Z_....+Z_....+Rich...+...............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x42c381
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66826F1E [Mon Jul 1 08:55:58 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	56baef533a2c1ed14f3f4ef31918aea1

Entrypoint Preview

Instruction
call 00007F05A4B2DA00h
jmp 00007F05A4B2CD7Ch
cmp ecx, dword ptr [0049A040h]
jne 00007F05A4B2CF63h
ret
jmp 00007F05A4B2DDB8h
jmp 00007F05A4B2E09Dh
push ebp
mov ebp, esp
jmp 00007F05A4B2CF6Fh
push dword ptr [ebp+08h]
call 00007F05A4B6879Eh
pop ecx
test eax, eax
je 00007F05A4B2CF71h
push dword ptr [ebp+08h]
call 00007F05A4B5948Eh
pop ecx
test eax, eax
je 00007F05A4B2CF48h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007F05A4B2E095h
jmp 00007F05A4B2E072h
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F05A4B2E062h
pop ecx
pop ebp
ret
mov dword ptr [ecx], 0048A520h
ret
push ebp
mov ebp, esp
test byte ptr [ebp+08h], 00000001h
push esi
mov esi, ecx
mov dword ptr [esi], 0048A520h
je 00007F05A4B2CF6Ch
push 0000000Ch
push esi
call 00007F05A4B2CF36h
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F05A4B2CF7Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F05A4B2CF6Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F05A4B2CF6Eh
add edx, 28h
cmp edx, esi
jne 00007F05A4B2CF4Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x98d80	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x98dc8	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe9000	0x4ac8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x929a0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x928e0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x88000	0x20c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x85607	0x85800	d4a3e4e2547dac4975d39086e7139986	False	0.4124166081460674	data	6.668988034436214	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.bss	0x87000	0xf7d	0x1000	878c09940a226a834c3659a4a01175c6	False	0.63134765625	data	6.367281353368697	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x88000	0x11a34	0x11c00	8d317fc0445d9e97e892000dec205388	False	0.375426386443662	data	4.84980486267065	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9a000	0x4e080	0x4c800	0e891f069ac6bc33dc2180dbb40af6b5	False	0.9814006331699346	data	7.987547215279856	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0xe9000	0x4ac8	0x4c00	25fdceee7c26fa23b595325521337834	False	0.7338096217105263	data	6.612335437064259	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
GDI32.dll	SetPixel
USER32.dll	OffsetRect, ReleaseDC, GetDC
KERNEL32.dll	CreateFileW, HeapSize, GetProcessHeap, SetStdHandle, VirtualAlloc, WaitForSingleObject, GetModuleHandleA, CreateThread, GetProcAddress, FormatMessageA, WideCharToMultiByte, GetCurrentThreadId, CloseHandle, WaitForSingleObjectEx, Sleep, SwitchToThread, GetExitCodeThread, GetNativeSystemInfo, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LocalFree, GetLocaleInfoEx, MultiByteToWideChar, LCMapStringEx, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, WakeConditionVariable, WakeAllConditionVariable, SleepConditionVariableSRW, QueryPerformanceCounter, QueryPerformanceFrequency, SetFileInformationByHandle, GetTempPathW, InitOnceExecuteOnce, CreateEventExW, CreateSemaphoreExW, FlushProcessWriteBuffers, GetCurrentProcessorNumber, GetSystemTimeAsFileTime, GetTickCount64, FreeLibraryWhenCallbackReturns, CreateThreadpoolTimer, SetThreadpoolTimer, WaitForThreadpoolTimerCallbacks, CloseThreadpoolTimer, CreateThreadpoolWait, SetThreadpoolWait, CloseThreadpoolWait, GetModuleHandleW, GetFileInformationByHandleEx, CreateSymbolicLinkW, GetStringTypeW, CompareStringEx, GetCPInfo, IsProcessorFeaturePresent, GetCurrentProcessId, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetCurrentProcess, TerminateProcess, SetEnvironmentVariableW, RaiseException, RtlUnwind, InterlockedPushEntrySList, InterlockedFlushSList, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetModuleHandleExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, GetCurrentThread, SetConsoleCtrlHandler, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, GetTimeZoneInformation, OutputDebugStringW, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW

Exports

Name	Ordinal	Address
AwakeSound	1	0x487d10

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/02/24-12:24:00.932845	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49704	3445	192.168.2.5	77.105.135.107
07/02/24-12:24:06.375739	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	3445	49704	77.105.135.107	192.168.2.5
07/02/24-12:24:01.127422	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	3445	49704	77.105.135.107	192.168.2.5
07/02/24-12:24:13.135257	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49704	3445	192.168.2.5	77.105.135.107

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 2, 2024 12:24:00.230401039 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:00.235276937 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:00.235403061 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:00.255548954 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:00.260399103 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:00.894330978 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:00.932845116 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:00.938674927 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:01.127422094 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:01.171791077 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:06.175950050 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:06.180783033 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:06.375739098 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:06.375751972 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:06.375766039 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:06.375832081 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:06.375852108 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:06.375860929 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:06.375907898 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:06.421789885 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:06.510586023 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:06.515475988 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:06.940747023 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:06.941606998 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:06.941693068 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:07.050059080 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:07.055459023 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.243783951 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.296848059 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:07.338819981 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:07.343744040 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.343756914 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.343820095 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.343830109 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.343859911 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:07.343900919 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:07.343924999 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:07.343933105 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.343944073 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.343972921 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.343982935 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.343991995 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.344090939 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.344099998 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.348745108 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.348792076 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.350586891 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.350596905 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.350605965 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.350615025 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.638511896 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.648298025 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:07.653187990 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.841630936 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:07.890568972 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:07.979860067 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:07.984679937 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:08.174869061 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:08.207503080 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:08.216063023 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:08.409914970 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:08.415105104 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:08.422775984 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:08.611979008 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:08.619383097 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:08.624397993 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:08.624409914 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:08.624417067 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:08.624497890 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:08.624501944 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:08.624536991 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:08.911303043 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:08.913100958 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:08.918390989 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:09.107553005 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:09.110565901 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:09.116857052 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:09.307045937 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:09.308224916 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:09.313081026 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:09.506139040 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:09.516491890 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:09.521431923 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:09.930443048 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:09.931735039 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:09.932106018 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:09.934547901 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:09.939281940 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.128108978 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.171808958 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.217324018 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.222785950 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.222795963 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.222820997 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.222825050 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.222836018 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.222839117 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.222923040 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.222928047 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.222968102 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.222971916 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.223073959 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.227544069 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.227586031 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.227685928 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.227760077 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.227767944 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.227822065 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.227824926 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.227857113 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.227941990 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.227950096 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.228024960 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.228029013 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.228091955 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.228142977 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.228245974 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.228288889 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.228293896 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.228302956 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.228307009 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.228365898 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.232022047 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232064962 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232069969 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232074022 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232135057 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.232227087 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232346058 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232355118 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232362032 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232399940 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.232400894 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232404947 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232441902 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.232455969 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232460022 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232516050 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232521057 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232593060 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232598066 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232703924 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232707977 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232724905 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232728958 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232759953 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232764006 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232811928 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232815981 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232855082 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232858896 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232914925 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232918978 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232928991 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232933044 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232986927 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232990980 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.232997894 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.233045101 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.233050108 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.233072042 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.233102083 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.233107090 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.233114004 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.233155966 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.233160019 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.233164072 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.233197927 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.233222008 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.233258009 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.233262062 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237812042 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237818003 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237827063 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237831116 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237834930 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237852097 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237855911 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237864971 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237869024 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237878084 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237881899 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237890005 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237894058 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237901926 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237905979 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237914085 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237917900 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237926960 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237930059 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237934113 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237936974 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237941027 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237951040 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237955093 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237962961 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237977028 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237981081 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237989902 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.237993956 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238002062 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238055944 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238059998 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238069057 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238101959 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238143921 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238207102 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238210917 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238357067 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.238418102 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238423109 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238434076 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238439083 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238444090 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.238456964 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238461018 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238465071 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238468885 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238477945 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238497972 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238576889 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238580942 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238641977 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238646984 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238722086 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238725901 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238761902 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238765955 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238800049 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.238802910 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.239357948 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.239362001 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.239483118 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.239622116 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.239625931 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.239634991 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.239639044 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.239751101 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.239754915 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.239758968 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.239763021 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.239773035 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.239892960 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.239897013 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.239906073 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.239908934 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.239917994 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.240020037 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.240029097 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.240032911 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.240041018 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.240045071 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.240143061 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.240147114 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.240155935 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.240159988 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.240164042 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.242957115 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.242961884 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.243181944 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.243251085 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.244580984 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.244930983 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.244935989 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.244945049 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245064020 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245073080 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245076895 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245079994 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245084047 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245208025 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245213032 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245223999 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245354891 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245363951 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245368004 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245493889 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245497942 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245507002 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245511055 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245670080 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245673895 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245682001 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245687008 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245790005 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245794058 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245803118 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245806932 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245939970 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.245943069 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246078014 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246082067 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246089935 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246093988 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246129036 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246133089 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246141911 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246145964 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246160984 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246165037 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246228933 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246232986 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246522903 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246527910 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246675968 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246680021 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246687889 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246834040 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246838093 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246983051 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246987104 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246990919 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.246994019 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.247148037 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.247152090 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.247348070 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.247419119 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.248188019 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.248286963 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.248291016 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.248295069 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.248439074 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.248444080 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.248451948 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.248563051 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.248567104 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.248575926 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.248725891 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.248729944 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.248883963 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.248888016 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.248927116 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.248930931 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.248939991 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249316931 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249320984 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249330044 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249439955 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249444008 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249452114 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249455929 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249464035 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249593019 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249597073 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249605894 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249732971 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249737024 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249747038 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249749899 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249869108 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249874115 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249882936 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249886990 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249969959 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249974012 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249983072 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249986887 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.249994993 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.250004053 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.250006914 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.250019073 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.250022888 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.250030994 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.250072956 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.250076056 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.250117064 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.250121117 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.250226974 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.250231028 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.250262022 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.251317024 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.251605988 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.251682043 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.252346039 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252351046 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252471924 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252476931 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252490044 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252495050 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252572060 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252576113 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252588034 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252592087 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252731085 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252734900 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252818108 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252821922 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252830982 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252835035 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252839088 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252850056 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252859116 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252861977 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252866030 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252873898 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252906084 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.252908945 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.253006935 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.253010988 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.253087997 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.253092051 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.253370047 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.253374100 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.253448963 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.253453016 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.253462076 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.253465891 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.253736973 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.253741026 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.253748894 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.253894091 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.253897905 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.254066944 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.254070997 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.254192114 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.254195929 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.254204035 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.254208088 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.254216909 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.254324913 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.254328966 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.254337072 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.254340887 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.254481077 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.254484892 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.254492998 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.254497051 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.254697084 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.254786968 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.256694078 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.256697893 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.256823063 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.256975889 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257112026 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257117033 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257126093 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257128954 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257232904 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257236958 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257350922 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257354975 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257364988 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257368088 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257376909 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257381916 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257446051 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257450104 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257453918 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257457018 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257466078 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257469893 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257477999 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257482052 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257492065 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257496119 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257577896 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257616043 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257687092 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257692099 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257826090 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.257868052 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.258363962 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.258649111 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.258773088 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.258776903 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.258785963 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.258789062 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.258793116 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.258796930 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.258894920 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.258899927 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.258908987 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.258912086 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.258915901 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.258924007 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.259048939 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.259052992 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.259057045 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.259191990 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.259196043 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.259203911 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.259207964 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.259959936 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260122061 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260126114 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260247946 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260256052 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260260105 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260262966 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260267019 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260376930 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.260382891 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260394096 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260397911 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260401011 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260405064 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260447025 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.260490894 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260500908 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260504961 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260602951 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260607958 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260616064 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260620117 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260623932 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260627985 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260636091 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260639906 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260648966 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260652065 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260656118 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260658979 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260669947 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260679007 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260683060 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260687113 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260694981 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260698080 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260708094 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260760069 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260762930 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.260970116 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.261040926 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.261044025 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.261053085 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.261199951 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.261204004 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.261212111 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.261363029 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.261367083 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.261375904 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.261507034 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.261511087 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.261646986 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.261651039 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.261660099 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.261662960 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.261811972 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.261815071 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.262017965 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.262093067 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.265429974 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.265588045 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.265732050 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.265873909 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.265878916 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.265882969 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266026020 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266030073 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266181946 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266185999 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266304016 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266308069 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266393900 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266397953 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266407013 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266411066 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266415119 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266427994 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266432047 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266436100 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266438961 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266448021 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266499996 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266503096 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266954899 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266958952 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266968012 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.266972065 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.267102003 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.267106056 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.267195940 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.267199993 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.267208099 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.267211914 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.267345905 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.267349958 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.267473936 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.267477989 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.267487049 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.267616987 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.267620087 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.267752886 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.267756939 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.267765999 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.267770052 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.267779112 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.267894030 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.267898083 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.268034935 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.268039942 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.268043041 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.268047094 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.268203974 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.268213987 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.268362999 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.268364906 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.268369913 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.268369913 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.268395901 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.268496990 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.268501043 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.312429905 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:10.315623999 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:10.317266941 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:11.046212912 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:11.093744040 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:11.686405897 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:11.766676903 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:11.955912113 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:11.958069086 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:11.962913036 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:12.151259899 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:12.203001022 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:12.254447937 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:12.259414911 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:12.741806030 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:12.742546082 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:12.742749929 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:12.744905949 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:12.751638889 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:12.940397024 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:12.940872908 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:12.945643902 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:13.134162903 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:13.135257006 CEST	49704	3445	192.168.2.5	77.105.135.107
Jul 2, 2024 12:24:13.140166044 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:13.343828917 CEST	3445	49704	77.105.135.107	192.168.2.5
Jul 2, 2024 12:24:13.376147032 CEST	49704	3445	192.168.2.5	77.105.135.107

Target ID:	0
Start time:	06:23:56
Start date:	02/07/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb20000
File size:	957'440 bytes
MD5 hash:	75A2D212A591A83A4D0C88A92B390B88
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:23:57
Start date:	02/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x280000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:23:57
Start date:	02/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xa00000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.2193423222.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.2194705356.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:23:57
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 304
Imagebase:	0x340000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	2.5%
Signature Coverage:	17.5%
Total number of Nodes:	325
Total number of Limit Nodes:	6

Executed Functions

Function 007E018D Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,007E00FF,007E00EF), ref: 007E02FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 007E030F
Wow64GetThreadContext.KERNEL32(00000120,00000000), ref: 007E032D
ReadProcessMemory.KERNELBASE(0000011C,?,007E0143,00000004,00000000), ref: 007E0351
VirtualAllocEx.KERNELBASE(0000011C,?,?,00003000,00000040), ref: 007E037C
TerminateProcess.KERNELBASE(0000011C,00000000), ref: 007E039B
WriteProcessMemory.KERNELBASE(0000011C,00000000,?,?,00000000,?), ref: 007E03D4
WriteProcessMemory.KERNELBASE(0000011C,00400000,?,?,00000000,?,00000028), ref: 007E041F
WriteProcessMemory.KERNELBASE(0000011C,00AFFFC0,?,00000004,00000000), ref: 007E045D
Wow64SetThreadContext.KERNEL32(00000120,00B00000), ref: 007E0499
ResumeThread.KERNELBASE(00000120), ref: 007E04A8

Strings

WriteProcessMemory, xrefs: 007E02A0
ResumeThread, xrefs: 007E02C9
TerminateProcess, xrefs: 007E038B
SetThreadContext, xrefs: 007E02B3
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 007E02FB
VirtualAllocEx, xrefs: 007E028D
ress, xrefs: 007E0217
VirtualAlloc, xrefs: 007E0254
aryA, xrefs: 007E01D3
GetThreadContext, xrefs: 007E0267
GetP, xrefs: 007E020F
CreateProcessA, xrefs: 007E0241
Load, xrefs: 007E01CB
ReadProcessMemory, xrefs: 007E027A

Memory Dump Source

Source File: 00000000.00000002.2271322291.00000000007E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: 67ccb405d9e6cee09489deb7a8c381f4a2b8c98a811e5a879affbc6bdd16b8eb
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: 7FB1E57260128AAFDB60CF69CC80BDA77A5FF8C714F158524EA0CAB341D774FA418B94

Function 00BA78B0 Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 311
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B21520: ___std_exception_copy.LIBVCRUNTIME ref: 00B2155C

VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040,?), ref: 00BA7B88

Strings

Own head, xrefs: 00BA79E7
Earth, xrefs: 00BA7A0F

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual___std_exception_copy
String ID: Earth$Own head
API String ID: 1139562770-4036566267
Opcode ID: 4646957b3992167b509b26e55a370befc9c30be056d59d49aa243ba52d129c61
Instruction ID: 89e5002f29c13e168d1d0b3e4224e0a776fd745db2ff91c2258d3de724c37bd9
Opcode Fuzzy Hash: 4646957b3992167b509b26e55a370befc9c30be056d59d49aa243ba52d129c61
Instruction Fuzzy Hash: 36A17A7290D3006BC714EF38EC85AAFB7E4EF86300F5446A9F84997242EF74AA44C795

Function 00B8A697 Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b648215b642596574fba81a53f3868e904589de32089efc76a2176381690929
Instruction ID: 9eab911155aaff7adad389f23ac98c81ced73f7bdf1b26a7620588c06dacb8a6
Opcode Fuzzy Hash: 9b648215b642596574fba81a53f3868e904589de32089efc76a2176381690929
Instruction Fuzzy Hash: 0EF01C31A15324DFDB26EA48C805A59B2ECEB45B55F154096E5019B160D6B0AD00C7D1

Function 00BA7E40 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShowWindow,5838D13B), ref: 00BA7E7B
GetProcAddress.KERNEL32(00000000), ref: 00BA7E84
GetModuleHandleA.KERNEL32(kernel32.dll,GetConsoleWindow), ref: 00BA7E93
GetProcAddress.KERNEL32(00000000), ref: 00BA7E96
GetModuleHandleA.KERNEL32(kernel32.dll,FreeConsole), ref: 00BA7EB4
GetProcAddress.KERNEL32(00000000), ref: 00BA7EB7

Part of subcall function 00BA7D20: GetCurrentThreadId.KERNEL32 ref: 00BA7D7D

Strings

ShowWindow, xrefs: 00BA7E6B
GetConsoleWindow, xrefs: 00BA7E89
user32.dll, xrefs: 00BA7E70
FreeConsole, xrefs: 00BA7EAA
kernel32.dll, xrefs: 00BA7E8E, 00BA7EAF

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc$CurrentThread
String ID: FreeConsole$GetConsoleWindow$ShowWindow$kernel32.dll$user32.dll
API String ID: 4239977575-3695373866
Opcode ID: d59bfc33d11def52d640c550a224fb8beb9a69ad05157f48ef12e159e808b038
Instruction ID: 63821a72b743e178ea0f1e47048d61913b154691a85f264b8cf4f1d021700a94
Opcode Fuzzy Hash: d59bfc33d11def52d640c550a224fb8beb9a69ad05157f48ef12e159e808b038
Instruction Fuzzy Hash: 8C116671E442486FCB10EBB9DC06FAFBBF8EB85710F104976F504E3290EAB459008AD0

Function 00B88BB9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,5838D13B,?,00B88CC6,?,?,?,00000000), ref: 00B88C7A

Strings

api-ms-, xrefs: 00B88C10
ext-ms-, xrefs: 00B88C24

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 5515c2e6ee4b5b2de4dfb925113c0eff8307c4c704256723adacff6e131f5369
Instruction ID: 82295e0369562674d54f4bb35acded495d53fdf0e12474dfb78a5f20c928e05b
Opcode Fuzzy Hash: 5515c2e6ee4b5b2de4dfb925113c0eff8307c4c704256723adacff6e131f5369
Instruction Fuzzy Hash: A821E071A02111ABDB21BB64DC85B5A37D8DB46760F5502A4E916B72B4EF30ED01CBE0

Function 00B4C198 Relevance: 7.6, APIs: 5, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___security_init_cookie.LIBCMT ref: 00B4C198

Part of subcall function 00B4CE21: ___get_entropy.LIBCMT ref: 00B4CE3B

___scrt_release_startup_lock.LIBCMT ref: 00B4C234
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 00B4C248
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 00B4C26E
___scrt_uninitialize_crt.LIBCMT ref: 00B4C2B7

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: ___scrt_is_nonwritable_in_current_image$___get_entropy___scrt_release_startup_lock___scrt_uninitialize_crt___security_init_cookie
String ID:
API String ID: 2539496024-0
Opcode ID: fbe6ff3190bedd2031cbc52042ac689eb9a88d814f66a4bb83548f812fc82eb8
Instruction ID: 86dda4906bf06772f9bf4973dd62b44e0c1e181a02337189e3d735b24d8fabb9
Opcode Fuzzy Hash: fbe6ff3190bedd2031cbc52042ac689eb9a88d814f66a4bb83548f812fc82eb8
Instruction Fuzzy Hash: BA31E9316867519ADBA47BB4980376D7BE19F42F20F2000E9F4807B1E2DEA55B00F769

Function 00BA7D20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00BA7D7D

Part of subcall function 00B2C052: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000), ref: 00B2C05E
Part of subcall function 00B2C052: GetExitCodeThread.KERNEL32(?,?), ref: 00B2C077
Part of subcall function 00B2C052: CloseHandle.KERNEL32(?), ref: 00B2C089

Strings

jjj, xrefs: 00BA7D64
Success destroyed., xrefs: 00BA7DE0, 00BA7DEF
Success created., xrefs: 00BA7D23, 00BA7D34

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Thread$CloseCodeCurrentExitHandleObjectSingleWait
String ID: Success created.$Success destroyed.$jjj
API String ID: 3356992203-3362827742
Opcode ID: 1f358fddd03b0ed414c2dbc411b45a212c44c83e695923150b46af1314b75b94
Instruction ID: b948bc6c9695074c5bed1542c6ed85d6f396b7ad9b576cd1bb601c0744feaeef
Opcode Fuzzy Hash: 1f358fddd03b0ed414c2dbc411b45a212c44c83e695923150b46af1314b75b94
Instruction Fuzzy Hash: 3911E2B1689711ABE7203BB46C1BF6B36D4DF50B41FA048F4F58CAA0C2EEB195008379

Function 00B5AEDA Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,00000001,Function_0003AC21,00000000,?,?), ref: 00B5AF23
GetLastError.KERNEL32(?,?,?,00B2C127,00000000,00000000,00000001,?,00000000,?,?,?,00B2BFBD,00000000,Function_0000BF0E,?), ref: 00B5AF2F
__dosmaperr.LIBCMT ref: 00B5AF36

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: bdfd8afeffadbf64e4a3b363fa278fa2ca683e0aebbd26c65e30e94e10bc7d6b
Instruction ID: c139e03785f6ad1daf9b08c7f308daa3ada6e11b27c8d593c5f57267ccfd1629
Opcode Fuzzy Hash: bdfd8afeffadbf64e4a3b363fa278fa2ca683e0aebbd26c65e30e94e10bc7d6b
Instruction Fuzzy Hash: 97018072500209AFDF15AFA0DC46A9E7BE4EF04312F1041D4BD01A6190EB71DE54EB91

Function 00B5AC21 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00BB8130,0000000C), ref: 00B5AC34
ExitThread.KERNEL32 ref: 00B5AC3B

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 282cb1146cd045c1ad2d4a4be6416cc674fb3a7b3ca5e2acf43d64cada178302
Instruction ID: 1d4a16b222b65575b385f17dd2cbf7571b40dd27444baa4e3eec5a1bc9217627
Opcode Fuzzy Hash: 282cb1146cd045c1ad2d4a4be6416cc674fb3a7b3ca5e2acf43d64cada178302
Instruction Fuzzy Hash: 92F08CB0A00204AFEB15BFB0C84AA6E3BA4EF49711F1441C9F501AB262CF305902DB92

Function 00B88C84 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3377cc1d8cfd693c52ade984e0789822f4f9640cc4ae11490757cc94f93ea2e0
Instruction ID: a7f7210f49178a6335b1ea75442f9d8b7b5f875d15c44071a8025dedf7f71ff7
Opcode Fuzzy Hash: 3377cc1d8cfd693c52ade984e0789822f4f9640cc4ae11490757cc94f93ea2e0
Instruction Fuzzy Hash: 7E01D837B01215AF9B16AF69EC41A5A33EAFBC53307948164F904DB1B8DE35DC41CB91

Function 00BA7AF0 Relevance: 1.3, APIs: 1, Instructions: 89
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040,?), ref: 00BA7B88

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: dce4b957ed22ca4d6565f963895222c0f6ff5ec4e619e6854e03972561cbe6bb
Instruction ID: 88c48d564003a4f183a187a1961d74ebea05c9046ec5974b63c4fb4423db9b71
Opcode Fuzzy Hash: dce4b957ed22ca4d6565f963895222c0f6ff5ec4e619e6854e03972561cbe6bb
Instruction Fuzzy Hash: 6E31F871D09208ABD705EF68EC92BADB7F1FF45310F504269F80567382EF70AA458795

Non-executed Functions

Function 00B53FF4 Relevance: 46.7, APIs: 25, Strings: 1, Instructions: 1201COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00B54042
operator+.LIBVCRUNTIME ref: 00B5405C
DName::operator+.LIBCMT ref: 00B5418A
DName::operator+.LIBCMT ref: 00B541A7

Part of subcall function 00B553C0: DName::DName.LIBVCRUNTIME ref: 00B55403

DName::operator+.LIBCMT ref: 00B5425B
DName::operator+.LIBCMT ref: 00B5426A

Part of subcall function 00B59B40: DName::operator+.LIBCMT ref: 00B59B84
Part of subcall function 00B59B40: DName::operator+.LIBCMT ref: 00B59B90
Part of subcall function 00B59B40: DName::operator+.LIBCMT ref: 00B59C0B
Part of subcall function 00B59B40: DName::operator+=.LIBCMT ref: 00B59C4E

DName::operator+.LIBCMT ref: 00B541F6

Part of subcall function 00B53DB2: DName::operator=.LIBVCRUNTIME ref: 00B53DD3

Part of subcall function 00B53D5A: shared_ptr.LIBCMT ref: 00B53D76

Part of subcall function 00B55ABC: shared_ptr.LIBCMT ref: 00B55B62

DName::operator+.LIBCMT ref: 00B547D4
DName::operator+.LIBCMT ref: 00B547F0
DName::operator+.LIBCMT ref: 00B54A8F

Part of subcall function 00B53C49: DName::operator+.LIBCMT ref: 00B53C6A

Strings

/, xrefs: 00B54938

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::shared_ptr$Name::operator+=Name::operator=operator+
String ID: /
API String ID: 848932493-2043925204
Opcode ID: b1689662b24f9223c70c93d01434e623e9c5cd0c6e5d9e5d20f09866a3f1a97e
Instruction ID: 916c9bc44a4a44587ea85d5a3fa951c64a9ab3836f499be19c684e64425f0fe2
Opcode Fuzzy Hash: b1689662b24f9223c70c93d01434e623e9c5cd0c6e5d9e5d20f09866a3f1a97e
Instruction Fuzzy Hash: 5D926F72E146199ADB18DFA8CC95BEE77F4EB18346F0401F9E912E7280DB68D94CCB50

Function 00B9A02C Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00B9A210

Strings

1#IND, xrefs: 00B9A131
1#INF, xrefs: 00B9A162
1#QNAN, xrefs: 00B9A13F
1#SNAN, xrefs: 00B9A138

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 6da79cb4448a04d0e64c0b22ca9e46e64e33d95065d2590c73d61e180b10ea1a
Instruction ID: d455b891f10e63e2e0611d924230f29c3b1be37d026d55efb3adb150927dcd1d
Opcode Fuzzy Hash: 6da79cb4448a04d0e64c0b22ca9e46e64e33d95065d2590c73d61e180b10ea1a
Instruction Fuzzy Hash: 1DD2F771E082288BDF65CE28DD85BEAB7F5EB55304F1541EAD40DE7240E778AE818F81

Function 00B97715 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00B97A33,00000002,00000000,?,?,?,00B97A33,?,00000000), ref: 00B977AE
GetLocaleInfoW.KERNEL32(?,20001004,00B97A33,00000002,00000000,?,?,?,00B97A33,?,00000000), ref: 00B977D7
GetACP.KERNEL32(?,?,00B97A33,?,00000000), ref: 00B977EC

Strings

OCP, xrefs: 00B97769
ACP, xrefs: 00B97733

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 319448f2f1b8599fabed033fda1efc0ffba2d32541585bf8ceb5bbfd637f7340
Instruction ID: f43a2ccea35c2cea515366f120b13f93ddca85cd4d600f496502f5330b2ab05c
Opcode Fuzzy Hash: 319448f2f1b8599fabed033fda1efc0ffba2d32541585bf8ceb5bbfd637f7340
Instruction Fuzzy Hash: 5F21C4327A8101AAEF208BA4CA45A9B73E6EB54B10B5684F4E90AD7201FF36DD40C390

Function 00B978EA Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B8A1F9: GetLastError.KERNEL32(?,?,00B5AC46,00BB8130,0000000C), ref: 00B8A1FD
Part of subcall function 00B8A1F9: SetLastError.KERNEL32(00000000), ref: 00B8A29F

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00B979F6
IsValidCodePage.KERNEL32(00000000), ref: 00B97A3F
IsValidLocale.KERNEL32(?,00000001), ref: 00B97A4E
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00B97A96
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00B97AB5

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: cc030555668e414aa57a371717e0ed06f412b389a38e53f8ded08adcc1ef4b7e
Instruction ID: 7c39e268114d0933def55e55207b77144835accc90b904c5bdff5d7ca37ded7b
Opcode Fuzzy Hash: cc030555668e414aa57a371717e0ed06f412b389a38e53f8ded08adcc1ef4b7e
Instruction Fuzzy Hash: CC514F71A64205AEEF11EFA5CC85ABE77F8FF0A700F1444B5E915E7190EF709A408B61

Function 00B96F68 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B8A1F9: GetLastError.KERNEL32(?,?,00B5AC46,00BB8130,0000000C), ref: 00B8A1FD
Part of subcall function 00B8A1F9: SetLastError.KERNEL32(00000000), ref: 00B8A29F

GetACP.KERNEL32(?,?,?,?,?,?,00B868DB,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00B97029
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00B868DB,?,?,?,00000055,?,-00000050,?,?), ref: 00B97054
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00B971B7

Strings

utf8, xrefs: 00B97126

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 324657d6fd307fd6dedab7efbeef5ccbf1591f184f5f10a6427976d9e80492dc
Instruction ID: c97dab212199ef1075503d1e54e1addcf40856dc98dfad22dcbfa47592246c75
Opcode Fuzzy Hash: 324657d6fd307fd6dedab7efbeef5ccbf1591f184f5f10a6427976d9e80492dc
Instruction Fuzzy Hash: 9971F371658612ABEF24BB74CC86BAA77E8EF05710F1440BAF505E7181EE74ED4087A0

Function 00B8A9F5 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B8AA82

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 59a49a276b1fdaf459c1fac0e65c6a6e2ad76d512d72c795e1df6e05635919b3
Instruction ID: 02164772ff847f34c3bbe7e8bd0415abbdf0b9aa4c289f3fa50fe7c7e037f8d6
Opcode Fuzzy Hash: 59a49a276b1fdaf459c1fac0e65c6a6e2ad76d512d72c795e1df6e05635919b3
Instruction Fuzzy Hash: C7B117329042469FEB15AF68C8917EEBBE5EF55310F1481EBE805AB251D235DD01CBA2

Function 00B93193 Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,00000000,?,00000000), ref: 00B9322E
FindNextFileW.KERNEL32(00000000,?), ref: 00B932A9
FindClose.KERNEL32(00000000), ref: 00B932CB
FindClose.KERNEL32(00000000), ref: 00B932EE

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 821a19e92e726fed42b872932b15fb18f690998215f04ab94f681fa2bb70f937
Instruction ID: 47257cf918004085793d91199414007b14263539a7fb247b5233257bd5f1e3a3
Opcode Fuzzy Hash: 821a19e92e726fed42b872932b15fb18f690998215f04ab94f681fa2bb70f937
Instruction Fuzzy Hash: A541A471A00129AFDF20DF68CC89AAAB7F9EB85715F1441E5E405E7184EA309F84CB64

Function 00B4CEFF Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00B4CF0B
IsDebuggerPresent.KERNEL32 ref: 00B4CFD7
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B4CFF0
UnhandledExceptionFilter.KERNEL32(?), ref: 00B4CFFA

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: c7764d65c01426f58a34342d0ce4832a88e1078a45239e02f84426e1f2cbcaea
Instruction ID: 94d32f129ea5212a24d8bf77514a5b4b0d2f13229f0289784d4bd9d8882ce3dd
Opcode Fuzzy Hash: c7764d65c01426f58a34342d0ce4832a88e1078a45239e02f84426e1f2cbcaea
Instruction Fuzzy Hash: 8E31E375D052189ADB20DFA4DD8ABCDBBF8BF08300F1041EAE50DAB250EB719B859F45

Function 00B2E9BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,?,00000002), ref: 00B2E9D3
FormatMessageA.KERNEL32(00001300,00000000,?,?,?,00000000,00000000), ref: 00B2E9FA

Strings

!x-sys-default-locale, xrefs: 00B2E9CE

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: fb6641130c55f3cd7fce179d11b1d9188bb1cddcd37b4785681747069bc7dcd7
Instruction ID: 6226e40fee9aa303852e0928466658fc87d1a86ae1e8d850318981d64a6bfa3d
Opcode Fuzzy Hash: fb6641130c55f3cd7fce179d11b1d9188bb1cddcd37b4785681747069bc7dcd7
Instruction Fuzzy Hash: F3F03075514114FFEB149B95DC0BDAA7BECEB09750F004056B605D6050E6B0AE40D770

Function 00B97399 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00B8A1F9: GetLastError.KERNEL32(?,?,00B5AC46,00BB8130,0000000C), ref: 00B8A1FD
Part of subcall function 00B8A1F9: SetLastError.KERNEL32(00000000), ref: 00B8A29F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B973ED
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B97437
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B974FD

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: f66b479fc9dcc70500b740ce1e5019f17d736b77bbf2208d64b604ebdadecc0a
Instruction ID: 648f723298d9ed18aea3790a19df8341b10678e5d9a132ab103eac7803a5298a
Opcode Fuzzy Hash: f66b479fc9dcc70500b740ce1e5019f17d736b77bbf2208d64b604ebdadecc0a
Instruction Fuzzy Hash: E6617C719A41079BEF68AF28CC86BAA7BE8EF14300F1441F9E905C6695FF34D981DB50

Function 00B769E1 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000010), ref: 00B76AD9
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000010), ref: 00B76AE3
UnhandledExceptionFilter.KERNEL32(00BB7F08,?,?,?,?,?,00000010), ref: 00B76AF0

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: bc4d4f3582e277b52250e753ff45d34ed6e2643be28cdbf59521a901bce6f678
Instruction ID: d54e93778f466f731ac0e549098ca1e58b3e62d7d120437e65198e7b1b58d9e8
Opcode Fuzzy Hash: bc4d4f3582e277b52250e753ff45d34ed6e2643be28cdbf59521a901bce6f678
Instruction Fuzzy Hash: 5F319274901218ABCB21DF68DD89B8DBBF8BF18310F5041EAE41DA7291EB749B858F45

Function 00B7F4F0 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84c59fd22c50fec11d713d5ba0d7b4fe03e09ca87038cfd7edf77aaf576bae43
Instruction ID: 0edd2696fd9c74ae9c809d1dbec6353ec8fac3b7f59ab87b0542f9b6a19721c6
Opcode Fuzzy Hash: 84c59fd22c50fec11d713d5ba0d7b4fe03e09ca87038cfd7edf77aaf576bae43
Instruction Fuzzy Hash: 2DF14171E0121A9FDF14CFA8D8806ADB7F1FF88324F1582A9E929A7394D7309D45CB94

Function 00B23780 Relevance: 3.0, Strings: 2, Instructions: 463COMMON

Download Yara Rule

Strings

+, xrefs: 00B23C30
%, xrefs: 00B23C21

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %$+
API String ID: 0-2626897407
Opcode ID: 8f770cd50f74966f152b013a75875b2c74fc1b2f2f937f17ffbe6b7532f331e1
Instruction ID: 1bea21ebc3e451edb789a9fa172123c5f719006cf5b0d61c970e1d6378b093df
Opcode Fuzzy Hash: 8f770cd50f74966f152b013a75875b2c74fc1b2f2f937f17ffbe6b7532f331e1
Instruction Fuzzy Hash: 43F115729083509FC715DF28DC41A6FBBE5FF89B00F044A6DF989AB251D738DA448792

Function 00B98CF7 Relevance: 2.8, APIs: 1, Instructions: 1260COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00B98D74

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 1c835cc6bf41a3fb4e2e1dcdf5afe7973190037c91319aff8e54f1d0c0000c69
Instruction ID: b4205cc4d1d9c72d20287539cada205447b35b2f2dec08bdd23bd1fa5a923fb7
Opcode Fuzzy Hash: 1c835cc6bf41a3fb4e2e1dcdf5afe7973190037c91319aff8e54f1d0c0000c69
Instruction Fuzzy Hash: 07B21671E086298BDFA5CE28DD807AAB7F5EB49305F1541EAD80DE7240E735AE818F41

Function 00B92078 Relevance: 1.9, APIs: 1, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00B924BD,00000000,00000000,00000000), ref: 00B9237C

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: 08e2254feef82545d1b3c25de29c3e175cb1c7e97d0486a2ba7490b6c46b100d
Instruction ID: 0b475b2d4dab81ebf33318b9d234fec8792a0d260e5042e64f9c0bb3d877e902
Opcode Fuzzy Hash: 08e2254feef82545d1b3c25de29c3e175cb1c7e97d0486a2ba7490b6c46b100d
Instruction Fuzzy Hash: 84C10572D00126BBDF14ABA8DC42ABE7BF9EF04750F1540B6F911A7291EB309E41D794

Function 00B8C310 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000000), ref: 00B8C53D

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 79a0fdfa2b49a5994a881e53bfa1ac7014197b61fb52a5f42594431f9585d5e9
Instruction ID: 04ff045a2f720ceb66d01d7220b6662b0d4f5278b4421bc67d465748b79d531d
Opcode Fuzzy Hash: 79a0fdfa2b49a5994a881e53bfa1ac7014197b61fb52a5f42594431f9585d5e9
Instruction Fuzzy Hash: A1B14C71210608CFDB15DF28C496AA57FE0FF45364F298699E89ACF2B1C735E982CB50

Function 00B92DA6 Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96447b736052a82d38e8bf9c4e95c5385b76195f84cae98045c66ebaee88ca6f
Instruction ID: c68ea9f006dbe9c7e39432cd1a17a0ee7e629a18416fdb8b0d14a0b8edda4df1
Opcode Fuzzy Hash: 96447b736052a82d38e8bf9c4e95c5385b76195f84cae98045c66ebaee88ca6f
Instruction Fuzzy Hash: 1951C4B5C04219AFDF24DFB8CC85AAABBF9EF45300F1445E9E819D3201EA359E458B50

Function 00B4CBC5 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00B4CBDB

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 7fcd3d48abc32012ffc47faa4e3ef1b0f71bebbbf45c58dddba12dba7f18608d
Instruction ID: d358db806e1318d6a357f1fe8bf5544a3171a40718477c569b91daabf5b7495e
Opcode Fuzzy Hash: 7fcd3d48abc32012ffc47faa4e3ef1b0f71bebbbf45c58dddba12dba7f18608d
Instruction Fuzzy Hash: 3C518BB1E022059FEB55CF68D8C27AEBFF0FB48710F2585AAD409EB251D7749A40DB90

Function 00B6E5C5 Relevance: 1.6, Strings: 1, Instructions: 392COMMON

Download Yara Rule

Strings

0, xrefs: 00B6E769

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: b459bf15404a0ecd74235168e707963e6d124d6dda87fbc759c3353832982863
Instruction ID: 2101abb22c4963b707e62461bc6e0d01fa3464ceb4d5be6f8f8f909fef9821d0
Opcode Fuzzy Hash: b459bf15404a0ecd74235168e707963e6d124d6dda87fbc759c3353832982863
Instruction Fuzzy Hash: 9FE1BD78A006058FCB24CF68C580ABEB7F1FF59314F248A9DE4669B291D738ED46CB51

Function 00B6E1A4 Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

0, xrefs: 00B6E339

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: bdfb6e6506f9cef5be2d23da1f925be1f39285e349fb543958e9ecb3f847647d
Instruction ID: 764ffdc5188315bd3b54b4cd152afc79dc49350458777ed39d8c88d479e28128
Opcode Fuzzy Hash: bdfb6e6506f9cef5be2d23da1f925be1f39285e349fb543958e9ecb3f847647d
Instruction Fuzzy Hash: 7BE1DD786006058FCB24CF68C494AAEB7F2FF55314B244A9DE4769B390E738ED46CB51

Function 00B6E9F5 Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

0, xrefs: 00B6EB8A

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9a808d0e291209b75ffb30f8295a97a92b4f7cb04bb406ff8a51ce22d9495500
Instruction ID: 2267b303db6bc2bd2657630a121eb728a243ec6affd8ae713a5ad23f7ac80f17
Opcode Fuzzy Hash: 9a808d0e291209b75ffb30f8295a97a92b4f7cb04bb406ff8a51ce22d9495500
Instruction Fuzzy Hash: AAE19E786006058FCB24CF68C5C0AAEB7F1FF49314B2486ADD47A9B291D739ED46CB61

Function 00B6D03B Relevance: 1.6, Strings: 1, Instructions: 348COMMON

Download Yara Rule

Strings

0, xrefs: 00B6D1D8

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: f1e1d709ca5c98b61822bfbec9f9ec010798e8b5152ebdef49621f9d33aa0176
Instruction ID: 4e7e79aaf2221096f726a77ed9658068f11bbcd8aa16fdecf09857f218962599
Opcode Fuzzy Hash: f1e1d709ca5c98b61822bfbec9f9ec010798e8b5152ebdef49621f9d33aa0176
Instruction Fuzzy Hash: D2C19C70F006468FCB24CF68C4A0A7ABBF1EF46304F644A99D456AB391C779ED46CB91

Function 00B6CCAD Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00B6CE3B

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 0f7beeca2686a97c6b62efb7c9992ad35cf3a01aa1fd21e5ef74d0205c40bd38
Instruction ID: 44eaad1b7118ff5135f532844eee9da24641f747d07fa10b16d64a5bc1b499bd
Opcode Fuzzy Hash: 0f7beeca2686a97c6b62efb7c9992ad35cf3a01aa1fd21e5ef74d0205c40bd38
Instruction Fuzzy Hash: ADC1AF70A0064A8FCB24CF68C494A7EBFF2FF05314F2446AAD5D697291C739AD46CB91

Function 00B6D3D8 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00B6D566

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 320c7ddaa484a9d933c376214f4ad1b1c42928c7f966c9f1655dfe830a101e72
Instruction ID: 68aa4ee2b3ab47f6f754f56979e6bcc20394a638216502b2f4280b9df579f401
Opcode Fuzzy Hash: 320c7ddaa484a9d933c376214f4ad1b1c42928c7f966c9f1655dfe830a101e72
Instruction Fuzzy Hash: CAC1BB70F006068FCB28CF28C494A7ABBF1EF55314F644699D46A9B791CB38ED45CB91

Function 00B975EC Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00B8A1F9: GetLastError.KERNEL32(?,?,00B5AC46,00BB8130,0000000C), ref: 00B8A1FD
Part of subcall function 00B8A1F9: SetLastError.KERNEL32(00000000), ref: 00B8A29F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B97640

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: c104d5cee1e07a11eb407f3379dbd3c22b9e8d8159aa9d5f05365ec8f4746453
Instruction ID: 3a116b779ec4ef52afe8e78719afc2e513e630bdd509cf16b5ad5c36a1cc72ac
Opcode Fuzzy Hash: c104d5cee1e07a11eb407f3379dbd3c22b9e8d8159aa9d5f05365ec8f4746453
Instruction Fuzzy Hash: 03218072668606ABDF28AE69DC86EBA77E8EF45310F1040BAF901D6141EF34ED419B50

Function 00B6DACB Relevance: 1.6, Strings: 1, Instructions: 326COMMON

Download Yara Rule

Strings

0, xrefs: 00B6DC72

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 672925174d0e2811ded76a8af114a4ad619fab9ed659ba1bd9145827dbc884b3
Instruction ID: 03df09087336aea3ec6cc98dd9045a4f7d4d3a54619f963855b203eaef5c9794
Opcode Fuzzy Hash: 672925174d0e2811ded76a8af114a4ad619fab9ed659ba1bd9145827dbc884b3
Instruction Fuzzy Hash: BFB1BD70F0060A8BCB24DF68C580ABEB7F1FF49700F1949ADD456AB294DB39AD46CB51

Function 00B6D766 Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

0, xrefs: 00B6D8FE

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 731ba233ed7e9dd2fa03d51d949f887ff47102b7c7d5d9b487b873f095eac097
Instruction ID: 1e5d65a7b13a5abf2b62d9cc6b3824803a1b58bb77adf46d75c4f2e4352a923a
Opcode Fuzzy Hash: 731ba233ed7e9dd2fa03d51d949f887ff47102b7c7d5d9b487b873f095eac097
Instruction Fuzzy Hash: 86B1AC70F0060A8FCB24DFA8C595ABEB7F1EF44700B548A9DE45AE7290D738AD46CB51

Function 00B6DE3F Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

0, xrefs: 00B6DFD7

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 1cb93c83c28df15f078a9467681606cccfdc3c4b0a315268c6aea0e4b7e328df
Instruction ID: 864e237565d5c59901a0c73cc02804fd6f328ab58f02ec242e2c02b481b0fc41
Opcode Fuzzy Hash: 1cb93c83c28df15f078a9467681606cccfdc3c4b0a315268c6aea0e4b7e328df
Instruction Fuzzy Hash: A6B1CF74E0060A8BCF24DF68C981ABEB7F1EF45300F14499DE56AAB290D739ED46CB51

Function 00B6C60E Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 00B6C7A7

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: fbc8cb572a693741c73c0c34d34bf905a05ccc77ae38e44e8671429eb1c54094
Instruction ID: 5c7ad4813159f912876d5b7bfab54b32c38477f22351e0b0d1ad0749ba3a4200
Opcode Fuzzy Hash: fbc8cb572a693741c73c0c34d34bf905a05ccc77ae38e44e8671429eb1c54094
Instruction Fuzzy Hash: 2EB1D23090060A8BCB34CE68C895ABEBFE5EB05700F14069AD5E6D7291DB38EE41CF95

Function 00B6C2C6 Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

0, xrefs: 00B6C450

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: d1242401bcfe4f16a8a5ee75cd98f7302be97461983d9a285fc17fd23d6f0803
Instruction ID: 7f6dc51425d43d254fb8849797c323cfb8e7e195a34501ea5c824d5c71372279
Opcode Fuzzy Hash: d1242401bcfe4f16a8a5ee75cd98f7302be97461983d9a285fc17fd23d6f0803
Instruction Fuzzy Hash: DAB1C37090064A8BCB24CF68C9A56BEBFF1EF04300F14869AD4D7E7791DB39A941CB95

Function 00B6C965 Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

0, xrefs: 00B6CAEF

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: bb1f00442f35c872477f9f82fa85b40d3506aef4f499233daec496ee425de096
Instruction ID: c437e0aa717c4e368b9613a55711ba18141e32819cb685341cdf2c69a880c5a7
Opcode Fuzzy Hash: bb1f00442f35c872477f9f82fa85b40d3506aef4f499233daec496ee425de096
Instruction Fuzzy Hash: 3CB1B37090060E8BCB25CFA8C4956BEBFF1EF05300F14469AD5E6D7291D738AD41DB91

Function 00B97273 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B8A1F9: GetLastError.KERNEL32(?,?,00B5AC46,00BB8130,0000000C), ref: 00B8A1FD
Part of subcall function 00B8A1F9: SetLastError.KERNEL32(00000000), ref: 00B8A29F

EnumSystemLocalesW.KERNEL32(00B97399,00000001,00000000,?,-00000050,?,00B979CA,00000000,?,?,?,00000055,?), ref: 00B972E5

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 67dc2250007b884c3e366eb7baf2063bafb671514b6fc6b23f8ac7083d69c149
Instruction ID: 6efc0c28d217833d94de8aa11f4c12ddc0e37be71671d5a5d5d442efec788b0e
Opcode Fuzzy Hash: 67dc2250007b884c3e366eb7baf2063bafb671514b6fc6b23f8ac7083d69c149
Instruction Fuzzy Hash: 6A1129362287019FDF18AF39D8915BAB7D1FF85318B14447DE98687B40DB71A843C740

Function 00B927AA Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00B927B1

Part of subcall function 00B9EAAB: OutputDebugStringW.KERNEL32(00000000,?,?,?,?), ref: 00B9EB01

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: DebugDebuggerOutputPresentString
String ID:
API String ID: 4086329628-0
Opcode ID: d21cb160f9a6e98a8df3ae7247c96638d166b5a803e5968c081a0b79572ca9eb
Instruction ID: db85d43272cbc83520a6327614e1650060492999baba8f973a208e8bb80dd18c
Opcode Fuzzy Hash: d21cb160f9a6e98a8df3ae7247c96638d166b5a803e5968c081a0b79572ca9eb
Instruction Fuzzy Hash: 3BF0AF31801215BAEE213BA05C82BBB37D9EF013A4F1844E1FD18A6562CB21CC01E6B2

Function 00B9781B Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00B8A1F9: GetLastError.KERNEL32(?,?,00B5AC46,00BB8130,0000000C), ref: 00B8A1FD
Part of subcall function 00B8A1F9: SetLastError.KERNEL32(00000000), ref: 00B8A29F

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00B975B5,00000000,00000000,?), ref: 00B97847

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 871d387724f882bbbeeaefe67432b0fde36f841b3b07a84c0a0028cca6573539
Instruction ID: c95291b4856c188a4de2c11eccd13a2672a12c9670bd158afe50d16c37e8f2fe
Opcode Fuzzy Hash: 871d387724f882bbbeeaefe67432b0fde36f841b3b07a84c0a0028cca6573539
Instruction Fuzzy Hash: 52F0F932AA4111BBDF2867A6CC4ABFA77E4EB40754F1444B5ED16A3540DE30FD41C6D0

Function 00B97163 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00B8A1F9: GetLastError.KERNEL32(?,?,00B5AC46,00BB8130,0000000C), ref: 00B8A1FD
Part of subcall function 00B8A1F9: SetLastError.KERNEL32(00000000), ref: 00B8A29F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00B971B7

Strings

utf8, xrefs: 00B97126

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 9b6766a83c4258dd111c32580f64876af1b82ffca3886630109d4b923f74be11
Instruction ID: b0221e896d22be9d5310e5900ab7326dbc88a8a21051a2283b9eb8b1bb760b27
Opcode Fuzzy Hash: 9b6766a83c4258dd111c32580f64876af1b82ffca3886630109d4b923f74be11
Instruction Fuzzy Hash: 59F0CD32654155A7DB14BF78DC49EBA33ECEB45314F1401BAF602E7141DE749D058754

Function 00B9730E Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B8A1F9: GetLastError.KERNEL32(?,?,00B5AC46,00BB8130,0000000C), ref: 00B8A1FD
Part of subcall function 00B8A1F9: SetLastError.KERNEL32(00000000), ref: 00B8A29F

EnumSystemLocalesW.KERNEL32(00B975EC,00000001,?,?,-00000050,?,00B9798E,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00B97358

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9e6840d94b914ce31137126fb4635fe7a194594c08d6008f16a7980d46c8e89a
Instruction ID: 68088fe6ae67d6219fd8e634408ea875110f2ec0d9e21d3e47c6378ce5f83486
Opcode Fuzzy Hash: 9e6840d94b914ce31137126fb4635fe7a194594c08d6008f16a7980d46c8e89a
Instruction Fuzzy Hash: 1AF022322583045FDF14AF399C82A6A7BD1FF81728F1540BDFA458B690CA719C02DB44

Function 00B88682 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B76CF0: EnterCriticalSection.KERNEL32(?,?,00B89A3D,?,00BB8710,00000008,00B89E30,?,?,?), ref: 00B76CFF

EnumSystemLocalesW.KERNEL32(00B8866F,00000001,00BB86B0,0000000C,00B88FAF,00000000), ref: 00B886BA

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 1fce3370edce5c07c8ef45632b8746029c34108bb3eb0930ccf0cab2cca28e72
Instruction ID: deb5a85313eacaed51b220cc3afc1adbaccae00b0af5ae463791a5a6f4c9fb47
Opcode Fuzzy Hash: 1fce3370edce5c07c8ef45632b8746029c34108bb3eb0930ccf0cab2cca28e72
Instruction Fuzzy Hash: D4F03C32A00204DFD700EF98E842B9D77F0FB05720F10416AE414A72A0DFB55900CF40

Function 00B4B82A Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,00000022,00000000,00000002,?,?,00B4900C,00000000,?,00000004,00B479FB,?,00000004,00B48002,00000000,00000000), ref: 00B4B843

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 4df77730d3504737be0d001a94c1e46c63e8eecffaa85566aaf7aa320c1d84e4
Instruction ID: dd147824d908a2a0257ffb301842911b4ad626f6483430a1affc9428e87e50cc
Opcode Fuzzy Hash: 4df77730d3504737be0d001a94c1e46c63e8eecffaa85566aaf7aa320c1d84e4
Instruction Fuzzy Hash: D9E0D832650204B6D7198BBD9E0FF6A77DCDB01709F0042C5F202E50E2DBB0CB00E251

Function 00B9720A Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B8A1F9: GetLastError.KERNEL32(?,?,00B5AC46,00BB8130,0000000C), ref: 00B8A1FD
Part of subcall function 00B8A1F9: SetLastError.KERNEL32(00000000), ref: 00B8A29F

EnumSystemLocalesW.KERNEL32(00B97163,00000001,?,?,?,00B979EC,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00B97241

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 5518e20649acbd44dab99951c9303c43cedd93ddc95eca2f87be86be117a505b
Instruction ID: 39193c6bb8689452553faad7330f7c898c5157f6839cc1ceacb30c314c5b5157
Opcode Fuzzy Hash: 5518e20649acbd44dab99951c9303c43cedd93ddc95eca2f87be86be117a505b
Instruction Fuzzy Hash: 03F0203635020457CB04AB39DC4966ABBD4EBC2750B0640A9EE098B250CA719842C790

Function 00B8913F Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00B876CB,?,20001004,00000000,00000002,?,?,00B86A43), ref: 00B89173

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b3b04c3b702b4ac7f9bc48704953f6a1ac22e9363669738aabae15bf52029e9f
Instruction ID: 74e97b594979776ae65533056731d876c7a125aa2c85738499cb7e3ef3c3e053
Opcode Fuzzy Hash: b3b04c3b702b4ac7f9bc48704953f6a1ac22e9363669738aabae15bf52029e9f
Instruction Fuzzy Hash: DDE01A31500219BBCF123F61DC09AAE3A6AEB45750F084050F915661718F328D21EBD5

Function 00B88813 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(Function_0006866F,00000001), ref: 00B8882D

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 3cc7b7f5c0d1ebf3ccd280869dca88227ce66f96d6f148c8d09ac2ae75095eeb
Instruction ID: 61204cffddef0d50fd046d96028688d8223feb20a9e0049ec69c714790eac0d6
Opcode Fuzzy Hash: 3cc7b7f5c0d1ebf3ccd280869dca88227ce66f96d6f148c8d09ac2ae75095eeb
Instruction Fuzzy Hash: 92D0C735944304AFD704BF51EC46B183B65F745750F610255F50857270DFF56851C784

Function 00B4D08F Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002D09E,00B4C18B), ref: 00B4D094

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5a3a116e51f9103fb117cbe7a4ab6aea3ca3b2d4bdaf64227805d8e1eb78a842
Instruction ID: 2bff36f4e61bb9fd7843e601aea3ba33d27e915250f9112edaa179d5e565a3a7
Opcode Fuzzy Hash: 5a3a116e51f9103fb117cbe7a4ab6aea3ca3b2d4bdaf64227805d8e1eb78a842
Instruction Fuzzy Hash:

Function 00B825A5 Relevance: .7, Instructions: 655COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: e2c3cd4ec104fe45a7497e434827adf0bb42497d402952af367d7912bdf07121
Instruction ID: bfb1dc29ad84e3601eff9c27d5078a776074d858136ec07595b7674157673276
Opcode Fuzzy Hash: e2c3cd4ec104fe45a7497e434827adf0bb42497d402952af367d7912bdf07121
Instruction Fuzzy Hash: 15328C74A0021ADFCF28DF98C981ABEB7F5EF45304F2445A8DC45A7365D632AE46CB90

Function 00B7C99E Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d7808b414df47d490fb91bcc2d12300d2cb92d85c574c9be3af2e2893a6b1f5
Instruction ID: 663809e89c118b96e5cbf972eed3a2a489eb9c09f7c71249f401c0979aa271a3
Opcode Fuzzy Hash: 9d7808b414df47d490fb91bcc2d12300d2cb92d85c574c9be3af2e2893a6b1f5
Instruction Fuzzy Hash: 93122F71A002299FDB25CF18C8807AABBF9FB45301F5481EED95DEB245E7709E858F81

Function 00B7FE60 Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4d9caf02bc87c38edef879cef37559086af3cbbfab73cc247b1b794f6a33cc2
Instruction ID: 171ad684a4834e0cf98380988be6dc7b6216d9154dc30a9e88142b38ea2e5d79
Opcode Fuzzy Hash: c4d9caf02bc87c38edef879cef37559086af3cbbfab73cc247b1b794f6a33cc2
Instruction Fuzzy Hash: 10E18271A102299FDB65EF18CC80BAAB7F9FF46344F1441EAD849A7251D7709E84CF41

Function 00B31560 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c21c2bc6b46b4716385ef8c57e636fae7336e4a122daa0505a6f758dec1037
Instruction ID: e5eae8cd066aa244b05f183d1810707a0a34ef929c018f1bd2fe4af9724c7657
Opcode Fuzzy Hash: d5c21c2bc6b46b4716385ef8c57e636fae7336e4a122daa0505a6f758dec1037
Instruction Fuzzy Hash: C5B17C71D112198ADB11CFBCC8912DDF7F5EFAA310F29C79AD824B7250E731A9818B54

Function 00B7FA20 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0fe014724f46a4fdf71df1785f04c793b8600df146020ac055adbf297819a0
Instruction ID: 3da89b42fec10c832b3b3525ee692f662f5e68def4749965e6f87a4c338499f9
Opcode Fuzzy Hash: 5f0fe014724f46a4fdf71df1785f04c793b8600df146020ac055adbf297819a0
Instruction Fuzzy Hash: 91A12D71A001299BCB25DF18D891BEDB7F5FB89304F1581FAD81DAB241E7719E818F84

Function 00B7D471 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe929d91a9f0e64f20453904c9813c4125ae80857842bde4f6557e49449952d1
Instruction ID: 03395b3f651362e768c1ee350f406b760f53bc95188003c036687364207332b9
Opcode Fuzzy Hash: fe929d91a9f0e64f20453904c9813c4125ae80857842bde4f6557e49449952d1
Instruction Fuzzy Hash: 31516371D00219AFDF04CF99C981AEEBBF1EF84354F19C099E819AB241D734AE50CB91

Function 00B4EC30 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 1826196041e0a70c182d5ce47b875fc4125cc664647da7e3c3a7ff43aeb16151
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: D3113D7724009283DA148A3DD9F86B7A7D6FBC5322B2C43FAD1728B756D222DB45F604

Function 00B8A750 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b5fba63f53d19527fc7a8df6216b17823e8423280ca3664fab53575dd68de03
Instruction ID: 729436cd201b1e01d03a0c80144296d64141d7bc5a2a8431dbc52a848dd96fa3
Opcode Fuzzy Hash: 5b5fba63f53d19527fc7a8df6216b17823e8423280ca3664fab53575dd68de03
Instruction Fuzzy Hash: 51F09636A942609BE717EA5CC989B5573F8EB45B11F1501D3E201DB6A0C6A4DE00D7D1

Function 00B8A576 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944dd0397f84d6fac56f40ee474188b5ea1f29462e9c26bbd030b6a775e0e63a
Instruction ID: bd983afc627be6f8689cfd6f54c58cee04dd3c9a735aec7f156bc02c76f7c673
Opcode Fuzzy Hash: 944dd0397f84d6fac56f40ee474188b5ea1f29462e9c26bbd030b6a775e0e63a
Instruction Fuzzy Hash: B1F09031684245EFEB15EE6CC948B9573E4EB25700F2040E2E105D7AA4D370EE80C702

Function 00B8A6DB Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39cad7066b96d67aa45a461a754e8bf1bfa98c3c8bea480aa690be5e78c388a2
Instruction ID: d035d3e6ca387d55a4b5027fe9d4b1ff974e21e2575fdf6e8f9cca1771c3b47b
Opcode Fuzzy Hash: 39cad7066b96d67aa45a461a754e8bf1bfa98c3c8bea480aa690be5e78c388a2
Instruction Fuzzy Hash: 06F01572A51224AFDB2AAA4CC845A8973F8EB48B54F1140D6E501EB6A1D6B0EE00D7C1

Function 00B8A4F0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0838929bd9fb429a0a1637d5a7a3d48d2e56fd9b69cef30005072a05cf9426d
Instruction ID: 2c9232b62e43f30a6d9f26912fdacd521c047be1bf61ab78f86134319edbaacc
Opcode Fuzzy Hash: b0838929bd9fb429a0a1637d5a7a3d48d2e56fd9b69cef30005072a05cf9426d
Instruction Fuzzy Hash: 4AE06535A01304EFDB09DF68C944B49B7E8EB48748F2084A9E819C7660E734EE80CB10

Function 00B8A533 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be2caa3698abf477bc768ee28205dd3e26a7e687ae3bc470bd5e7bd6ced4444b
Instruction ID: e548a7e94584e28ccbb095d7e17ef0daa31d43e4dfc7cda7702154dbdfa77aab
Opcode Fuzzy Hash: be2caa3698abf477bc768ee28205dd3e26a7e687ae3bc470bd5e7bd6ced4444b
Instruction Fuzzy Hash: D3E06531A01244EFDB19DBA8C544B49B3F9FB48784F2040A8E419D7AA1E734EE80CB40

Function 00B8A71F Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1180572ebc423d528d6d2b2aa93c3161b85fd8ca66b3f8678dd1786479aba326
Instruction ID: 4dff1b4ab402781d0660310fc2b23050dd698586ffa0093298c5212b7637c577
Opcode Fuzzy Hash: 1180572ebc423d528d6d2b2aa93c3161b85fd8ca66b3f8678dd1786479aba326
Instruction Fuzzy Hash: 24E08C32912228EBCB14EB8CC904D8AF3FCEB45B00B1104ABB601D3121C270DE00D7D0

Function 00B8A5D1 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f1f9998198fe091ba8346b06ba6bb319a3cc15cfdbdd13e1c646f71437b3e48
Instruction ID: a90a5e3ab8734a098b178e977981d69a85d739ae784b0f669ae7f525ad4e0e22
Opcode Fuzzy Hash: 1f1f9998198fe091ba8346b06ba6bb319a3cc15cfdbdd13e1c646f71437b3e48
Instruction Fuzzy Hash: 8DE0E235501248EFCB04EBA8C549A8AB7F9FB48754F5148A5E405D7261D634EE80DB00

Function 00B857E9 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37bda6c8782477086c2f554060ec6b9e85648076b406dd39fdadbdaddbab4169
Instruction ID: dc8898375e22d57a069afbbfa1883cb1e6b084c8bfca7f101d23dc00dfc06479
Opcode Fuzzy Hash: 37bda6c8782477086c2f554060ec6b9e85648076b406dd39fdadbdaddbab4169
Instruction Fuzzy Hash: C2C08C38410D404ACE39AA1082713A837E4F392782FC004CEC5020B662C92E9CC2EB21

Function 00B56DDC Relevance: 19.8, APIs: 13, Instructions: 332
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DName::operator+.LIBCMT ref: 00B56EA5
DName::operator+.LIBCMT ref: 00B56EE2
DName::DName.LIBVCRUNTIME ref: 00B56EF6
DName::operator+.LIBCMT ref: 00B56F05
DName::operator+.LIBCMT ref: 00B56F93
DName::DName.LIBVCRUNTIME ref: 00B56FBB
DName::operator+.LIBCMT ref: 00B56FC9
DName::operator+.LIBCMT ref: 00B57003
DName::operator+.LIBCMT ref: 00B57044
UnDecorator::getReturnType.LIBCMT ref: 00B57074
operator+.LIBVCRUNTIME ref: 00B57176

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::$Decorator::getReturnTypeoperator+
String ID:
API String ID: 2932655852-0
Opcode ID: 52b987f456a3b4be9028f002f0d07d357b695b2360208e9ec8a02c052755df3e
Instruction ID: 5646a5d181282c0d25c2e145e28791d0d75a505a311cf8871b971031e052fc4a
Opcode Fuzzy Hash: 52b987f456a3b4be9028f002f0d07d357b695b2360208e9ec8a02c052755df3e
Instruction Fuzzy Hash: 4EC15075D04208AFDB18EBA4D892BEE77F4EB04712F5401D9F906A7391DB70AA4DCB60

Function 00B583D4 Relevance: 19.8, APIs: 13, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00B5843F
DName::operator+.LIBCMT ref: 00B58582

Part of subcall function 00B53D5A: shared_ptr.LIBCMT ref: 00B53D76

DName::operator+.LIBCMT ref: 00B5852D
DName::operator+.LIBCMT ref: 00B585CE
DName::operator+.LIBCMT ref: 00B585DD
DName::operator+.LIBCMT ref: 00B58709
DName::operator=.LIBVCRUNTIME ref: 00B58749
DName::DName.LIBVCRUNTIME ref: 00B58753
DName::operator+.LIBCMT ref: 00B58770
DName::operator+.LIBCMT ref: 00B5877C

Part of subcall function 00B59C94: Replicator::operator[].LIBCMT ref: 00B59CD1

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]shared_ptr
String ID:
API String ID: 1043660730-0
Opcode ID: 41dbe3805d9ec3dbe02dc3f9f6f87dad197269f117f69a7fb735a6c0cdd66d54
Instruction ID: d6a3e859d40e7afb3757af2d813c18fdf0decfe44cbd2607bee8b9ba7d8de6ca
Opcode Fuzzy Hash: 41dbe3805d9ec3dbe02dc3f9f6f87dad197269f117f69a7fb735a6c0cdd66d54
Instruction Fuzzy Hash: 1FC1ADB1D042049FDB15DFA4D895BEEBBF4EB09306F1440D9E949B7281EB74AA48CF50

Function 00B259F0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B259FD
std::_Lockit::_Lockit.LIBCPMT ref: 00B25A17
std::_Lockit::~_Lockit.LIBCPMT ref: 00B25A38
std::_Lockit::~_Lockit.LIBCPMT ref: 00B25A64
std::_Lockit::~_Lockit.LIBCPMT ref: 00B25A99
std::_Lockit::_Lockit.LIBCPMT ref: 00B25AD6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B25B27
__Getctype.LIBCPMT ref: 00B25B3E
std::_Facet_Register.LIBCPMT ref: 00B25B57
std::_Lockit::~_Lockit.LIBCPMT ref: 00B25B70

Strings

bad locale name, xrefs: 00B25B7F

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_GetctypeLocinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 1407599034-1405518554
Opcode ID: 50d8151ef9ee6cda925b31f00c809b57b5808578099d51430a7bda84c35e2f39
Instruction ID: 05986472a270300c884cf66444b4e86c845a9ee4d4632fe490ae0ea31eff1e6c
Opcode Fuzzy Hash: 50d8151ef9ee6cda925b31f00c809b57b5808578099d51430a7bda84c35e2f39
Instruction Fuzzy Hash: CB41E1716043A49FC720EF58E881B6AB7E0EF91710F15499DE88C87251EB35E909CB92

Function 00B25F80 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 133COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B25F8D
std::_Lockit::_Lockit.LIBCPMT ref: 00B25FA7
std::_Lockit::~_Lockit.LIBCPMT ref: 00B25FC8
std::_Lockit::~_Lockit.LIBCPMT ref: 00B25FF4
std::_Lockit::~_Lockit.LIBCPMT ref: 00B26029
std::_Lockit::_Lockit.LIBCPMT ref: 00B26066
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B260B7
std::_Facet_Register.LIBCPMT ref: 00B260D6
std::_Lockit::~_Lockit.LIBCPMT ref: 00B260EF

Strings

bad locale name, xrefs: 00B260FE

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Locinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 3434717313-1405518554
Opcode ID: 4442e40c581d45b893e97a9335cc697f5dd2a9ce1293541df50b984f666483a8
Instruction ID: 036099e9c0aac732d4ab3762333c2fe7960505e27d42b04a981f94ecd944b7ac
Opcode Fuzzy Hash: 4442e40c581d45b893e97a9335cc697f5dd2a9ce1293541df50b984f666483a8
Instruction Fuzzy Hash: 83419E716043A09FC711DF58E891B5BBBE0EF90710F15489DE88D9B251DB71E909CBA3

Function 00B5546F Relevance: 16.9, APIs: 11, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 00B554E2
shared_ptr.LIBCMT ref: 00B5552A
shared_ptr.LIBCMT ref: 00B55549
operator+.LIBVCRUNTIME ref: 00B55677
DName::operator=.LIBVCRUNTIME ref: 00B55689
shared_ptr.LIBCMT ref: 00B558CE
DName::operator+.LIBCMT ref: 00B55910
operator+.LIBVCRUNTIME ref: 00B55956

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: shared_ptr$operator+$Name::operator+Name::operator=
String ID:
API String ID: 1464150960-0
Opcode ID: 0d4ad61a5d645095a4b371a7c4d25d3cd48775287105c1ee38bb35fdc6dc7428
Instruction ID: 142eda82c250354ae687735774679016599969514d3e1eb02085294370ae446a
Opcode Fuzzy Hash: 0d4ad61a5d645095a4b371a7c4d25d3cd48775287105c1ee38bb35fdc6dc7428
Instruction Fuzzy Hash: 8CE12AB2C04609DBCB24DF94C4A9BFEBBF4EB05306F1081DAD922A6251D7745A4DCF91

Function 00B59C94 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 00B59CD1

Strings

generic-type-, xrefs: 00B59D57
template-parameter-, xrefs: 00B59D30
@, xrefs: 00B59E3D

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Replicator::operator[]
String ID: @$generic-type-$template-parameter-
API String ID: 3676697650-1320211309
Opcode ID: e6b7d5fcb7da4955ad4e3eee36d094d70ee51a8f4e4dcea3e49c449d3345e33d
Instruction ID: a271caa8ec292ab3f422130d277a0a605a449266eddc4f3996b31c6954d95dda
Opcode Fuzzy Hash: e6b7d5fcb7da4955ad4e3eee36d094d70ee51a8f4e4dcea3e49c449d3345e33d
Instruction Fuzzy Hash: EF619171D04209DFDB04DFA4D842BEEB7F8EB08715F1441D9EA05A7291DB74AA0DCBA1

Function 00B75B85 Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 487COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00B75F5D

Strings

f, xrefs: 00B75C7B
p, xrefs: 00B75C82
:, xrefs: 00B75C50
p, xrefs: 00B75CE4
f, xrefs: 00B75CDD
f, xrefs: 00B75C97
p, xrefs: 00B75C9E

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: :$f$f$f$p$p$p
API String ID: 3732870572-1434680307
Opcode ID: 68fde4c78655b4e3f40e40687d29b2e0e9f729efd37e4ac4a778d9f1ff3c1aee
Instruction ID: fa183dcb6c0491bd142022b283a42cb186dd06db17563678814621fe70353239
Opcode Fuzzy Hash: 68fde4c78655b4e3f40e40687d29b2e0e9f729efd37e4ac4a778d9f1ff3c1aee
Instruction Fuzzy Hash: 900282759006189ADF348F64C8986EDB7F6FB40B14FA4C5DAD43DBB280E7708E899B14

Function 00B42620 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B42627

Part of subcall function 00B39040: __EH_prolog3.LIBCMT ref: 00B39047
Part of subcall function 00B39040: std::_Lockit::_Lockit.LIBCPMT ref: 00B39051

Strings

%I : %M : %S %p, xrefs: 00B429B1
%m / %d / %y, xrefs: 00B42723
%d / %m / %y, xrefs: 00B4298A
%H : %M, xrefs: 00B4276C
%H : %M : %S, xrefs: 00B427E3
:AM:am:PM:pm, xrefs: 00B429BC
%b %d %H : %M : %S %Y, xrefs: 00B428DF

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: H_prolog3$LockitLockit::_std::_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 2181796688-2891247106
Opcode ID: 1420d041dd726ed80bb54f0f89775bb8804fee2b02ac4b7f09453b861553ac43
Instruction ID: 84de5fff63cdcfe5e10a62b913dc4e8cd48efcb2d4025f137049db0aae2d3d0c
Opcode Fuzzy Hash: 1420d041dd726ed80bb54f0f89775bb8804fee2b02ac4b7f09453b861553ac43
Instruction Fuzzy Hash: 5DC15C7250010AABDB18DFA8CD96DFE7BE8EF05300F5541A9FA46E2291D6309F04FB61

Function 00B42A10 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B42A17

Part of subcall function 00B390D5: __EH_prolog3.LIBCMT ref: 00B390DC
Part of subcall function 00B390D5: std::_Lockit::_Lockit.LIBCPMT ref: 00B390E6

Strings

%I : %M : %S %p, xrefs: 00B42DA1
%m / %d / %y, xrefs: 00B42B13
%d / %m / %y, xrefs: 00B42D7A
%H : %M, xrefs: 00B42B5C
%H : %M : %S, xrefs: 00B42BD3
:AM:am:PM:pm, xrefs: 00B42DAC
%b %d %H : %M : %S %Y, xrefs: 00B42CCF

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: H_prolog3$LockitLockit::_std::_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 2181796688-2891247106
Opcode ID: 18b4d781a2a2f01fcddaa987532f48af633992d932eb856fa69bb6bfecea115b
Instruction ID: 7b17861b37aae19082905e56b63403118f116a027d87ff757849a95186e89bf0
Opcode Fuzzy Hash: 18b4d781a2a2f01fcddaa987532f48af633992d932eb856fa69bb6bfecea115b
Instruction Fuzzy Hash: B7C16F7290010AABDB19DF58C996DFE7BF8EF09304F5545A9FA02E6251D630DB40FB60

Function 00B49D04 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B49D0B

Part of subcall function 00B259F0: std::_Lockit::_Lockit.LIBCPMT ref: 00B259FD
Part of subcall function 00B259F0: std::_Lockit::_Lockit.LIBCPMT ref: 00B25A17
Part of subcall function 00B259F0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B25A38
Part of subcall function 00B259F0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B25A64

Strings

%I : %M : %S %p, xrefs: 00B4A095
%m / %d / %y, xrefs: 00B49E07
%d / %m / %y, xrefs: 00B4A06E
%H : %M, xrefs: 00B49E50
%H : %M : %S, xrefs: 00B49EC7
:AM:am:PM:pm, xrefs: 00B4A0A0
%b %d %H : %M : %S %Y, xrefs: 00B49FC3

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: c083e28cfa9edc3e82fc248b2ed7b69a2ee85b05208eef35c6b484a62f6413df
Instruction ID: 146a2ea06f111a3f3892a3b8758efe713798ff8e40d4629f884269297aac6eb9
Opcode Fuzzy Hash: c083e28cfa9edc3e82fc248b2ed7b69a2ee85b05208eef35c6b484a62f6413df
Instruction Fuzzy Hash: 2DC17D72540109AFDF18DFA8C9A5DFB7BF8EB09300F14459AFA06E6291D631DB04EB61

Function 00B27230 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B27282
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B272D7
Concurrency::cancel_current_task.LIBCPMT ref: 00B273A1
Concurrency::cancel_current_task.LIBCPMT ref: 00B273A6
Concurrency::cancel_current_task.LIBCPMT ref: 00B273AB

Strings

false, xrefs: 00B2733F
true, xrefs: 00B27365
bad locale name, xrefs: 00B27397

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: 6fc6b1a6709efbf26c186b820aaef0e99e8cf9e64e29d81494c5ace25d858940
Instruction ID: c065bb05005a65c11c4ff3c4a02ca8cab4b8cda9fb491d7f78eb1efc33a4dcb5
Opcode Fuzzy Hash: 6fc6b1a6709efbf26c186b820aaef0e99e8cf9e64e29d81494c5ace25d858940
Instruction Fuzzy Hash: E8419D701483509FD720DF68E881B4BBBE4EF85700F0449ADF89C8B292DBB5D509CBA6

Function 00B4B4B8 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00B4B4BE
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00B4B4CC
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00B4B4DD
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00B4B4EE

Strings

GetTempPath2W, xrefs: 00B4B4E3
GetSystemTimePreciseAsFileTime, xrefs: 00B4B4D2
kernel32.dll, xrefs: 00B4B4B9
GetCurrentPackageId, xrefs: 00B4B4C6

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 93d195ad6b9de49baec04230549d6cc5ffca00d9c24846dd2418e182e9c7739a
Instruction ID: 35481a066fec30608965c3f16f17223fc10f5dd55b4d63f6b51fa2e058d7e327
Opcode Fuzzy Hash: 93d195ad6b9de49baec04230549d6cc5ffca00d9c24846dd2418e182e9c7739a
Instruction Fuzzy Hash: 92E0B635949230ABD7226F74AC0E99B3AE8EA0F7213024056F505D3660EFF44458CBA1

Function 00B58EDB Relevance: 13.8, APIs: 9, Instructions: 297COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00B58FB1
UnDecorator::getSignedDimension.LIBCMT ref: 00B58FBC
UnDecorator::getSignedDimension.LIBCMT ref: 00B590A8
UnDecorator::getSignedDimension.LIBCMT ref: 00B590C5
UnDecorator::getSignedDimension.LIBCMT ref: 00B590E2
DName::operator+.LIBCMT ref: 00B590F7
UnDecorator::getSignedDimension.LIBCMT ref: 00B59111
DName::operator+.LIBCMT ref: 00B591E6

Part of subcall function 00B54E94: DName::DName.LIBVCRUNTIME ref: 00B54EF2

DName::DName.LIBVCRUNTIME ref: 00B5925D

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Decorator::getDimensionSigned$Name::operator+$NameName::
String ID:
API String ID: 3679549980-0
Opcode ID: c4dc0b3128624ef7c971d44a6bc80accb38a3e8fee0e12d5657feef5c62c42b0
Instruction ID: ac98ae8680da6ca562a7a6f9b9ecdd4c1a60ca93c89314c911eeff637c5b2fe8
Opcode Fuzzy Hash: c4dc0b3128624ef7c971d44a6bc80accb38a3e8fee0e12d5657feef5c62c42b0
Instruction Fuzzy Hash: 3791C672C04209E9DB18EBB4DD9ABBE77F8EB04302F5404D6F901B6191DF759A0C8B61

Function 00B522D6 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00B523F5
___TypeMatch.LIBVCRUNTIME ref: 00B52503
_UnwindNestedFrames.LIBCMT ref: 00B52655
CallUnexpected.LIBVCRUNTIME ref: 00B52670

Strings

csm, xrefs: 00B52313
csm, xrefs: 00B52380
csm, xrefs: 00B5242C

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 4a8c2e6dd2a7d8a1f205e42f93e6e15af2f56ca44057c2f13c8a58465bd9afa8
Instruction ID: 198376a065aae578c65a35c6912f4aa18ab96f87472c2587c3be1b0db90dd01a
Opcode Fuzzy Hash: 4a8c2e6dd2a7d8a1f205e42f93e6e15af2f56ca44057c2f13c8a58465bd9afa8
Instruction Fuzzy Hash: A1B17A71802209EFCF19DFA4D881AAEB7F5FF16312B1445E9EC146B212D730DA59CBA1

Function 00B8FA7C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00B8FCF5

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 7b351b185aa23f660b5eac9d602d10eb195361eacd29c052e7789e2c5af612b4
Instruction ID: 6691f66c9e0435af715b2ee6c38a5d74da68769a655fbadaab8215d5fc839945
Opcode Fuzzy Hash: 7b351b185aa23f660b5eac9d602d10eb195361eacd29c052e7789e2c5af612b4
Instruction Fuzzy Hash: 14B19170A0424A9FDB15EF99C881BBD7BF1FF89310F1481E9E5149B2A2D7709D42CB61

Function 00B3E3E0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B3E3E7
_Maklocstr.LIBCPMT ref: 00B3E44E
_Maklocstr.LIBCPMT ref: 00B3E460
_Maklocchr.LIBCPMT ref: 00B3E478
_Maklocchr.LIBCPMT ref: 00B3E488

Strings

false, xrefs: 00B3E449
true, xrefs: 00B3E45B

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: MaklocchrMaklocstr$H_prolog3_
String ID: false$true
API String ID: 2404127365-2658103896
Opcode ID: a9f0780bf3cd228476f9e25da3ced7e411bdc3df076f8772121a6f974baef814
Instruction ID: 1b72af9b43f91d07dc1165feb4b590d25b313c1fddfed1b33b813fe4223f9590
Opcode Fuzzy Hash: a9f0780bf3cd228476f9e25da3ced7e411bdc3df076f8772121a6f974baef814
Instruction Fuzzy Hash: E1216BB1C00344AADB14EFA5D88599EBBF8EF44700F10849AF8159F256EB74D500CB60

Function 00B55223 Relevance: 10.7, APIs: 7, Instructions: 151COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00B552B1
DName::operator+.LIBCMT ref: 00B55304

Part of subcall function 00B53D5A: shared_ptr.LIBCMT ref: 00B53D76

Part of subcall function 00B53C49: DName::operator+.LIBCMT ref: 00B53C6A

DName::operator+.LIBCMT ref: 00B552F5
DName::operator+.LIBCMT ref: 00B55355
DName::operator+.LIBCMT ref: 00B55362
DName::operator+.LIBCMT ref: 00B553A9
DName::operator+.LIBCMT ref: 00B553B6

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Name::operator+$shared_ptr
String ID:
API String ID: 1037112749-0
Opcode ID: 2af2b22d27d8fa593efdbda213524de0ed0f7d8b9737edb820c9b5a393c9439e
Instruction ID: 63e4ad68140b4306898fe7d4bd2fdc8150e236aff30160450042ee96bba0a094
Opcode Fuzzy Hash: 2af2b22d27d8fa593efdbda213524de0ed0f7d8b9737edb820c9b5a393c9439e
Instruction Fuzzy Hash: B9515171D04218ABDB15DB94C855FEEBBF8EB18742F0441D9F906A7281DB709A4CCBA0

Function 00B27890 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 113COMMON

Download Yara Rule

Strings

false, xrefs: 00B27939
true, xrefs: 00B27964
ios_base::badbit set, xrefs: 00B27902, 00B27919

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID: false$ios_base::badbit set$true
API String ID: 0-1679644946
Opcode ID: 56eddf6c40e62d6979851588b16eb948045df3f080408ecd8c768b219a1c6dfe
Instruction ID: 36c90c10e670f2e40f4f24a8eeec6f7c1903c5c649cdf6b7261375b26d43c441
Opcode Fuzzy Hash: 56eddf6c40e62d6979851588b16eb948045df3f080408ecd8c768b219a1c6dfe
Instruction Fuzzy Hash: 363108756443405FD310DF68A840B67BFE0EF56304F0889EDE98D8B312DBB29809CBA2

Function 00B27AB0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

Strings

false, xrefs: 00B27B4C
true, xrefs: 00B27B77
ios_base::badbit set, xrefs: 00B27B15, 00B27B2C

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID: false$ios_base::badbit set$true
API String ID: 0-1679644946
Opcode ID: 079d697dd17eb61bddd817d6daaf87c5344dcf6999dcd722238c36eec77bf652
Instruction ID: de52a4913783cd675fe42a4042e2b9f858b94f3e1b2ec33c4edf5e40a1d3631a
Opcode Fuzzy Hash: 079d697dd17eb61bddd817d6daaf87c5344dcf6999dcd722238c36eec77bf652
Instruction Fuzzy Hash: 9A3135351443504FD720DF74A855B67BFE0EF56314F0889EEE8894B312DAB69409C7A2

Function 00B3E307 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B3E30E
_Maklocstr.LIBCPMT ref: 00B3E377
_Maklocstr.LIBCPMT ref: 00B3E389
_Getvals.LIBCPMT ref: 00B3E3D3

Strings

false, xrefs: 00B3E372
true, xrefs: 00B3E384

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Maklocstr$GetvalsH_prolog3_
String ID: false$true
API String ID: 1611767717-2658103896
Opcode ID: 1d4cec7261dedc242c579c54bb683f09bd4ea69c30904ac8ef4ec6ebb85198d7
Instruction ID: 5b1777d3580005632f98180ad96c3a27e98e28c8ef1b4b52e0dba623e687c2b2
Opcode Fuzzy Hash: 1d4cec7261dedc242c579c54bb683f09bd4ea69c30904ac8ef4ec6ebb85198d7
Instruction Fuzzy Hash: 93213072D00214ABDB15EFE5D885ADF7BE8EF04710F108496B9189F292DBB0D544CBA1

Function 00BA0828 Relevance: 9.2, APIs: 6, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00C24E28,00C24E28,?,7FFFFFFF,?,00BA0AF8,00C24E28,00C24E28,?,00C24E28,?,?,?,?,00C24E28,?), ref: 00BA08CE
__freea.LIBCMT ref: 00BA0A63
__freea.LIBCMT ref: 00BA0A69
__freea.LIBCMT ref: 00BA0A9F
__freea.LIBCMT ref: 00BA0AA5
__freea.LIBCMT ref: 00BA0AB5

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: __freea$Info
String ID:
API String ID: 541289543-0
Opcode ID: 505049043a11120acb42dabd15e581472054b9ecfe1093b0ae57da048af54eb3
Instruction ID: f83732663a5ab2ba5954134e52ece76cd5ca058aa876f08306b3f4845acb77a3
Opcode Fuzzy Hash: 505049043a11120acb42dabd15e581472054b9ecfe1093b0ae57da048af54eb3
Instruction Fuzzy Hash: ED71B572A18305ABEF20BEA8CC81FAF7BF9DF47310F1940D5E915A7242E6359D4087A5

Function 00B4BDAB Relevance: 9.2, APIs: 6, Instructions: 225COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?), ref: 00B4BE36
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00B4BEC2
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00B4BF2D
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00B4BF49
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00B4BFAC
CompareStringEx.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00B4BFC9

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 5ef4e7cdf3b4b391a98088974fc2767eed36a2c4b0d1dcf4b80d4a115e6d771e
Instruction ID: 8224c627e9188964cd8edd6651e6cb4f391c7d3133b6c6111af81f89dec9eedd
Opcode Fuzzy Hash: 5ef4e7cdf3b4b391a98088974fc2767eed36a2c4b0d1dcf4b80d4a115e6d771e
Instruction Fuzzy Hash: BC71D032900215ABDF209F65CC81FEE7BF5EF45750F144595EA44B7190DB31CE08ABA0

Function 00B2EA77 Relevance: 9.2, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00B2EAC0
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00B2EB2B
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B2EB48
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00B2EB87
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B2EBE6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00B2EC09

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: f1c52221a6ad51dc37b107a164950c80fb561fa7c95f42c6832feb78abf3f7f5
Instruction ID: 1cac9d13b9bf2c72f833ae22f2420922dd6e1a641529293cc914f01244e984bb
Opcode Fuzzy Hash: f1c52221a6ad51dc37b107a164950c80fb561fa7c95f42c6832feb78abf3f7f5
Instruction Fuzzy Hash: 5051C37290022AAFDF209FA6EC85FAB7BF9FF45740F1445A4F929A6150DB30DC009B50

Function 00B59B40 Relevance: 9.1, APIs: 6, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00B59B84
DName::operator+.LIBCMT ref: 00B59B90

Part of subcall function 00B53D5A: shared_ptr.LIBCMT ref: 00B53D76

DName::operator+=.LIBCMT ref: 00B59C4E

Part of subcall function 00B583D4: DName::operator+.LIBCMT ref: 00B5843F
Part of subcall function 00B583D4: DName::operator+.LIBCMT ref: 00B58709

Part of subcall function 00B53C49: DName::operator+.LIBCMT ref: 00B53C6A

DName::operator+.LIBCMT ref: 00B59C0B

Part of subcall function 00B53DB2: DName::operator=.LIBVCRUNTIME ref: 00B53DD3

DName::DName.LIBVCRUNTIME ref: 00B59C72
DName::operator+.LIBCMT ref: 00B59C7E

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::Name::operator+=Name::operator=shared_ptr
String ID:
API String ID: 2795783184-0
Opcode ID: d25e4f43f768c9f8195a26c5ee9d00a8ef1ac9b59a4ab5831445af0c3b30b6d3
Instruction ID: c777e6daf199c446d36a7c8fcbca7e63ecfe422d4c99423a4d9432f7872583ab
Opcode Fuzzy Hash: d25e4f43f768c9f8195a26c5ee9d00a8ef1ac9b59a4ab5831445af0c3b30b6d3
Instruction Fuzzy Hash: 2141E8B0E04204EFEB15DF78C891BAE7BF9EB09701F4044D9E94AA7391D7345A48CB60

Function 00B269E0 Relevance: 9.1, APIs: 6, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B269ED
std::_Lockit::_Lockit.LIBCPMT ref: 00B26A0B
std::_Lockit::~_Lockit.LIBCPMT ref: 00B26A2C
std::_Lockit::~_Lockit.LIBCPMT ref: 00B26A7C
std::_Facet_Register.LIBCPMT ref: 00B26AA6
std::_Lockit::~_Lockit.LIBCPMT ref: 00B26ABF

Part of subcall function 00B21FE0: ___std_exception_copy.LIBVCRUNTIME ref: 00B2201C

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Register___std_exception_copy
String ID:
API String ID: 728164013-0
Opcode ID: cc25f977eac83b14a4e80cd87ca6d2adee219415283fa236ee5ccab2569ef07a
Instruction ID: f9296ade6d0b6f85e3bedf1e1d5bdd1a6063c30ada60f18949833ec21f67261f
Opcode Fuzzy Hash: cc25f977eac83b14a4e80cd87ca6d2adee219415283fa236ee5ccab2569ef07a
Instruction Fuzzy Hash: 0131D2719002209FCB11DF18F880A6EB7E4EB91324F1585A9E88D67261DB35ED5DCBD2

Function 00B58792 Relevance: 9.1, APIs: 6, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B59C94: Replicator::operator[].LIBCMT ref: 00B59CD1

DName::operator=.LIBVCRUNTIME ref: 00B5883E

Part of subcall function 00B583D4: DName::operator+.LIBCMT ref: 00B5843F
Part of subcall function 00B583D4: DName::operator+.LIBCMT ref: 00B58709

DName::operator+.LIBCMT ref: 00B587F8
DName::operator+.LIBCMT ref: 00B58804
DName::DName.LIBVCRUNTIME ref: 00B58848
DName::operator+.LIBCMT ref: 00B58865
DName::operator+.LIBCMT ref: 00B58871

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]
String ID:
API String ID: 955152517-0
Opcode ID: 79c8a991d837e5bd3f65a68d94feab716209ff9bd84c9114e706fb784b4e2796
Instruction ID: eda90fa218bdd56c8722c1254121f8e7fb2385209662d6a81f3126083bc97122
Opcode Fuzzy Hash: 79c8a991d837e5bd3f65a68d94feab716209ff9bd84c9114e706fb784b4e2796
Instruction Fuzzy Hash: D131C0B1A043049FDB18DF64C855BAEBBF4EF48301F4484DDE986A7340EB34A948CB60

Function 00B51F68 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00B51F5F,00B4E9FD,00B4D0E2), ref: 00B51F76
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00B51F84
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B51F9D
SetLastError.KERNEL32(00000000,00B51F5F,00B4E9FD,00B4D0E2), ref: 00B51FEF

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: f6d0798e5b92a27dd9aa2ebf5e7d927dfef0fe2212e83b9e54fcda89c4d3507f
Instruction ID: 73af22b746b4abca2475547f9f9ced452b5d2cb28c4a546c38ef4a99850eca2d
Opcode Fuzzy Hash: f6d0798e5b92a27dd9aa2ebf5e7d927dfef0fe2212e83b9e54fcda89c4d3507f
Instruction Fuzzy Hash: 2D012432A0D3216FA7603BBC7CC5B2E27C6EB05777B2007E9F910960E0EF914C089542

Function 00B84203 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,00C07292,00000104), ref: 00B84260

Strings

<program name unknown>, xrefs: 00B8426F
..., xrefs: 00B842AE
Microsoft Visual C++ Runtime Library, xrefs: 00B842F5
Runtime Error!Program: , xrefs: 00B8422C

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 514040917-4022980321
Opcode ID: 80430f71a95b81cff92a5de7e5a370a3def8688f2927976c32f3b29a654e573a
Instruction ID: 5fb1c5f623cdb2d9994547e091355a9fefb0aad56a6082bc00e56115204d4936
Opcode Fuzzy Hash: 80430f71a95b81cff92a5de7e5a370a3def8688f2927976c32f3b29a654e573a
Instruction Fuzzy Hash: 77213832E4430776DA2476655C0AF6B3BCCDBA2744F0406B1FD08A2162F761DD11C3E9

Function 00B3E140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3E147
_Getvals.LIBCPMT ref: 00B3E199
_Mpunct.LIBCPMT ref: 00B3E1D4
_Mpunct.LIBCPMT ref: 00B3E1EE

Strings

$+xv, xrefs: 00B3E1F9

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Mpunct$GetvalsH_prolog3
String ID: $+xv
API String ID: 2204710431-1686923651
Opcode ID: bf64aa8dd4095d49a20ea31fc2d61052053c041112d0f6c7de8f95d93c6b4c4b
Instruction ID: 230c6a902aa21aeabe6747dd44f7c184831fd3262785e2e59026e135df793f72
Opcode Fuzzy Hash: bf64aa8dd4095d49a20ea31fc2d61052053c041112d0f6c7de8f95d93c6b4c4b
Instruction Fuzzy Hash: 8921A4B1904B566ED725DF749890B3BBEF8AF09700F14469AE499C7A41D730EA01CF90

Function 00B8580B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,5838D13B,?,?,00000000,00BA649A,000000FF,?,00B85792,00000002,?,00B85766,00B76DCA), ref: 00B85840
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00B85852
FreeLibrary.KERNEL32(00000000,?,?,00000000,00BA649A,000000FF,?,00B85792,00000002,?,00B85766,00B76DCA), ref: 00B85874

Strings

mscoree.dll, xrefs: 00B85839
CorExitProcess, xrefs: 00B8584A

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 412767817119cadcc5ca3d88ff313fe7e8d4b578442e928520aebf1dfcd9a627
Instruction ID: 51da8b6aeb4234fdf19b7749ee00f24e32e5cf70047a6fbd2e3458303bbd6410
Opcode Fuzzy Hash: 412767817119cadcc5ca3d88ff313fe7e8d4b578442e928520aebf1dfcd9a627
Instruction Fuzzy Hash: 9F01A272944A15AFCB219F50CC09BAEBBF8FB09B15F040666E811A26A0DF759800CB40

Function 00B88D7D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00B88D36), ref: 00B88D8C
GetLastError.KERNEL32(?,00B88D36), ref: 00B88D96
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00B88DD4

Strings

api-ms-, xrefs: 00B88DA3
ext-ms-, xrefs: 00B88DB9

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-$ext-ms-
API String ID: 3177248105-537541572
Opcode ID: 88eec3172cde9f280e227f6aec86729c4264ec13f3d202d9d6deb7fe2e1a2c83
Instruction ID: 1e74f6ef2246cc2c0a36a9a7aadca0255bbca25e143fe65d247f601af944549b
Opcode Fuzzy Hash: 88eec3172cde9f280e227f6aec86729c4264ec13f3d202d9d6deb7fe2e1a2c83
Instruction Fuzzy Hash: CEF01271644204BBDF203B61EC07B5A3EA59B26B80F544070F90CB95F2EF71D912D784

Function 00B3EBF7 Relevance: 7.9, APIs: 5, Instructions: 433COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3EBFE
ctype.LIBCPMT ref: 00B3EC45

Part of subcall function 00B3E277: __Getctype.LIBCPMT ref: 00B3E286

Part of subcall function 00B39294: __EH_prolog3.LIBCMT ref: 00B3929B
Part of subcall function 00B39294: std::_Lockit::_Lockit.LIBCPMT ref: 00B392A5

Part of subcall function 00B393BE: __EH_prolog3.LIBCMT ref: 00B393C5
Part of subcall function 00B393BE: std::_Lockit::_Lockit.LIBCPMT ref: 00B393CF

Part of subcall function 00B3957D: __EH_prolog3.LIBCMT ref: 00B39584
Part of subcall function 00B3957D: std::_Lockit::_Lockit.LIBCPMT ref: 00B3958E
Part of subcall function 00B3957D: std::_Lockit::~_Lockit.LIBCPMT ref: 00B395FF

Part of subcall function 00B394E8: __EH_prolog3.LIBCMT ref: 00B394EF
Part of subcall function 00B394E8: std::_Lockit::_Lockit.LIBCPMT ref: 00B394F9

Part of subcall function 00B2D92A: __EH_prolog3.LIBCMT ref: 00B2D931
Part of subcall function 00B2D92A: std::_Lockit::_Lockit.LIBCPMT ref: 00B2D93B
Part of subcall function 00B2D92A: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2D9E2

numpunct.LIBCPMT ref: 00B3EFF3

Part of subcall function 00B3A31C: __EH_prolog3.LIBCMT ref: 00B3A323

Part of subcall function 00B39ABA: __EH_prolog3.LIBCMT ref: 00B39AC1
Part of subcall function 00B39ABA: std::_Lockit::_Lockit.LIBCPMT ref: 00B39ACB
Part of subcall function 00B39ABA: std::_Lockit::~_Lockit.LIBCPMT ref: 00B39B3C

Part of subcall function 00B39BE4: __EH_prolog3.LIBCMT ref: 00B39BEB
Part of subcall function 00B39BE4: std::_Lockit::_Lockit.LIBCPMT ref: 00B39BF5
Part of subcall function 00B39BE4: std::_Lockit::~_Lockit.LIBCPMT ref: 00B39C66

Part of subcall function 00B2D92A: Concurrency::cancel_current_task.LIBCPMT ref: 00B2D9ED

Part of subcall function 00B38DEC: __EH_prolog3.LIBCMT ref: 00B38DF3
Part of subcall function 00B38DEC: std::_Lockit::_Lockit.LIBCPMT ref: 00B38DFD
Part of subcall function 00B38DEC: std::_Lockit::~_Lockit.LIBCPMT ref: 00B38E6E

__Getcoll.LIBCPMT ref: 00B3EDB9

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

codecvt.LIBCPMT ref: 00B3F0A4

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3$Lockit::_$Lockit::~_$Concurrency::cancel_current_taskGetcollGetctypecodecvtctypenumpunct
String ID:
API String ID: 778957219-0
Opcode ID: 92aaee07f0d450b5e638e295c3edf76cafe6fca2290bce957dfd9b284b575608
Instruction ID: b0cbd78c08c0cac5878b7c9bc4ef1f48a8f479a3f728e3930ee86a456e60baa5
Opcode Fuzzy Hash: 92aaee07f0d450b5e638e295c3edf76cafe6fca2290bce957dfd9b284b575608
Instruction Fuzzy Hash: 17E10472804226AFEF256F649C4297F7AE5EF41350F2445EEF868AB2C1EB71CD009791

Function 00B3F0D3 Relevance: 7.9, APIs: 5, Instructions: 433COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3F0DA
ctype.LIBCPMT ref: 00B3F121

Part of subcall function 00B3E2B0: __Getctype.LIBCPMT ref: 00B3E2BF

Part of subcall function 00B39329: __EH_prolog3.LIBCMT ref: 00B39330
Part of subcall function 00B39329: std::_Lockit::_Lockit.LIBCPMT ref: 00B3933A

Part of subcall function 00B39453: __EH_prolog3.LIBCMT ref: 00B3945A
Part of subcall function 00B39453: std::_Lockit::_Lockit.LIBCPMT ref: 00B39464

Part of subcall function 00B396A7: __EH_prolog3.LIBCMT ref: 00B396AE
Part of subcall function 00B396A7: std::_Lockit::_Lockit.LIBCPMT ref: 00B396B8
Part of subcall function 00B396A7: std::_Lockit::~_Lockit.LIBCPMT ref: 00B39729

Part of subcall function 00B39612: __EH_prolog3.LIBCMT ref: 00B39619
Part of subcall function 00B39612: std::_Lockit::_Lockit.LIBCPMT ref: 00B39623
Part of subcall function 00B39612: std::_Lockit::~_Lockit.LIBCPMT ref: 00B39694

Part of subcall function 00B2D92A: __EH_prolog3.LIBCMT ref: 00B2D931
Part of subcall function 00B2D92A: std::_Lockit::_Lockit.LIBCPMT ref: 00B2D93B
Part of subcall function 00B2D92A: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2D9E2

numpunct.LIBCPMT ref: 00B3F4CF

Part of subcall function 00B3A34F: __EH_prolog3.LIBCMT ref: 00B3A356

Part of subcall function 00B39B4F: __EH_prolog3.LIBCMT ref: 00B39B56
Part of subcall function 00B39B4F: std::_Lockit::_Lockit.LIBCPMT ref: 00B39B60
Part of subcall function 00B39B4F: std::_Lockit::~_Lockit.LIBCPMT ref: 00B39BD1

Part of subcall function 00B39C79: __EH_prolog3.LIBCMT ref: 00B39C80
Part of subcall function 00B39C79: std::_Lockit::_Lockit.LIBCPMT ref: 00B39C8A
Part of subcall function 00B39C79: std::_Lockit::~_Lockit.LIBCPMT ref: 00B39CFB

Part of subcall function 00B2D92A: Concurrency::cancel_current_task.LIBCPMT ref: 00B2D9ED

Part of subcall function 00B38E81: __EH_prolog3.LIBCMT ref: 00B38E88
Part of subcall function 00B38E81: std::_Lockit::_Lockit.LIBCPMT ref: 00B38E92
Part of subcall function 00B38E81: std::_Lockit::~_Lockit.LIBCPMT ref: 00B38F03

__Getcoll.LIBCPMT ref: 00B3F295

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

codecvt.LIBCPMT ref: 00B3F580

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3$Lockit::_$Lockit::~_$Concurrency::cancel_current_taskGetcollGetctypecodecvtctypenumpunct
String ID:
API String ID: 778957219-0
Opcode ID: 15b05df7fb8846657ffa6308e6d781da069ae5af45bb22024708a2cc538caf3e
Instruction ID: 323cfb3912f951e890754db98a5a469da6c5f9896ff27e31cf6e0950c04f6216
Opcode Fuzzy Hash: 15b05df7fb8846657ffa6308e6d781da069ae5af45bb22024708a2cc538caf3e
Instruction Fuzzy Hash: 08E1E3B2C04217ABDB156FA49C42A7F7AF5EF41350F2445FDF858AB291EB318D00A791

Function 00B57DA4 Relevance: 7.7, APIs: 5, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 00B57E0F
operator+.LIBVCRUNTIME ref: 00B57E5F
shared_ptr.LIBCMT ref: 00B57F2B
DName::DName.LIBVCRUNTIME ref: 00B57F5B
operator+.LIBVCRUNTIME ref: 00B57FBC

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: operator+shared_ptr$NameName::
String ID:
API String ID: 2894330373-0
Opcode ID: 80c6607b113ad3ef529524821f879c1ac0d5440613350992dd930c5a51be3ece
Instruction ID: bea49be325a3a1c6f81602bc1ccff494884c8a71bf959ddb5cc2f458962feca4
Opcode Fuzzy Hash: 80c6607b113ad3ef529524821f879c1ac0d5440613350992dd930c5a51be3ece
Instruction Fuzzy Hash: 1F616F71A48209EFDB14DF68E846BAE7BF8FB05305F1482D9EC199B211DB319A09CF50

Function 00B2EDB2 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B2EDC6
AcquireSRWLockExclusive.KERNEL32(?,?,00B2BF2B,?), ref: 00B2EDE5
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00B2BF2B,?), ref: 00B2EE13
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00B2BF2B,?), ref: 00B2EE6E
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00B2BF2B,?), ref: 00B2EE85

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: c3d1cf87389609ed37d023b596662e6a3389c46042a519bb40e7be8a0d62a0bd
Instruction ID: ea1c43bcbe2226f270fd2e681eff8ea29d69951644af593397d603cfa880f101
Opcode Fuzzy Hash: c3d1cf87389609ed37d023b596662e6a3389c46042a519bb40e7be8a0d62a0bd
Instruction Fuzzy Hash: 9A418E3190062ADFCB60EF66E4819BAB3F5FF08350B2249A9D46ED7650D730F985CB51

Function 00B29DBA Relevance: 7.6, APIs: 5, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B29DC1
std::_Lockit::_Lockit.LIBCPMT ref: 00B29DCB

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

codecvt.LIBCPMT ref: 00B29E05
std::_Facet_Register.LIBCPMT ref: 00B29E1C
std::_Lockit::~_Lockit.LIBCPMT ref: 00B29E3C

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 3f1653f3199ed81685ba3f34a87b8a5d5b45386bb6ad4097a7d8da252b131990
Instruction ID: f0302eb217996482dba63c9e6030145ae3fe7773dc524517bff27b015051c74e
Opcode Fuzzy Hash: 3f1653f3199ed81685ba3f34a87b8a5d5b45386bb6ad4097a7d8da252b131990
Instruction Fuzzy Hash: 171193B1904235ABCF05EFA8E842AAEBBE5EF54710F154589F80DAB391DF709E00C791

Function 00B38DEC Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B38DF3
std::_Lockit::_Lockit.LIBCPMT ref: 00B38DFD

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

codecvt.LIBCPMT ref: 00B38E37
std::_Facet_Register.LIBCPMT ref: 00B38E4E
std::_Lockit::~_Lockit.LIBCPMT ref: 00B38E6E

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 05e03cf6966fc908945486b63522a56672b9ea1bc7e966603bf9373249bf4195
Instruction ID: 5f7235512499fba6b57dac9a1dde820409cb6b3de0ecfeb04018ae01deb25ad2
Opcode Fuzzy Hash: 05e03cf6966fc908945486b63522a56672b9ea1bc7e966603bf9373249bf4195
Instruction Fuzzy Hash: 7101D271900229AFCF15EBA4E841AAEB7F1EF90710F244589F415A7391CF719E01CB91

Function 00B38E81 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B38E88
std::_Lockit::_Lockit.LIBCPMT ref: 00B38E92

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

codecvt.LIBCPMT ref: 00B38ECC
std::_Facet_Register.LIBCPMT ref: 00B38EE3
std::_Lockit::~_Lockit.LIBCPMT ref: 00B38F03

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 5bb5f943966f43284218970e261c8cd638dc1a760a7a5c198bd357d7e318b1ea
Instruction ID: 5ba54168f0ff30a7e5150c8c96e30aea8e567ef29670d0cd4f7f594f276a79a3
Opcode Fuzzy Hash: 5bb5f943966f43284218970e261c8cd638dc1a760a7a5c198bd357d7e318b1ea
Instruction Fuzzy Hash: A901C471900225ABCB05EBA4D851AAE77F1AF90710F250989F41467291CF309E00CB81

Function 00B474A0 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B474A7
std::_Lockit::_Lockit.LIBCPMT ref: 00B474B1

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

messages.LIBCPMT ref: 00B474EB
std::_Facet_Register.LIBCPMT ref: 00B47502
std::_Lockit::~_Lockit.LIBCPMT ref: 00B47522

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: 8634e33dfb9d817a7ae827a3469e06aef52ea30eab923f751a1a511b06ea4fd2
Instruction ID: f28fd1175e37790fc6a232c72f7d7ff051342828294fed9c56638a89de01e1a5
Opcode Fuzzy Hash: 8634e33dfb9d817a7ae827a3469e06aef52ea30eab923f751a1a511b06ea4fd2
Instruction Fuzzy Hash: 0D01C0719041299BCB09EFA4E855ABE77F1EF90710F244489E419AB2C2CF349F01DB90

Function 00B3957D Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B39584
std::_Lockit::_Lockit.LIBCPMT ref: 00B3958E

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

moneypunct.LIBCPMT ref: 00B395C8
std::_Facet_Register.LIBCPMT ref: 00B395DF
std::_Lockit::~_Lockit.LIBCPMT ref: 00B395FF

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: ab7f6c16a39d0aae24bedc999a77759175714b501d69bac6376ce6b6b556cede
Instruction ID: dcb980b6201bbc3825ba3f972109a7a29af3bf597461fbf744bb73d91d530e2b
Opcode Fuzzy Hash: ab7f6c16a39d0aae24bedc999a77759175714b501d69bac6376ce6b6b556cede
Instruction Fuzzy Hash: 7C01D671900229DFCF06EBA4E841BAEB7F0EF94710F254589F81567281CF749E01CB80

Function 00B396A7 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B396AE
std::_Lockit::_Lockit.LIBCPMT ref: 00B396B8

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

moneypunct.LIBCPMT ref: 00B396F2
std::_Facet_Register.LIBCPMT ref: 00B39709
std::_Lockit::~_Lockit.LIBCPMT ref: 00B39729

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 987d40ba7c3037997639544f505597258c80a0c6efcae50bf1f631dda8affb8b
Instruction ID: 9aab4e69de6c7bcae78c748d30e3ec72f7c9e1a758aeadd6eef17b6489d397ee
Opcode Fuzzy Hash: 987d40ba7c3037997639544f505597258c80a0c6efcae50bf1f631dda8affb8b
Instruction Fuzzy Hash: 4C01C071901129DBCB15EFA8E842AAEB7F1EF90310F240589E415A72D1CF709E01CB80

Function 00B476F4 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B476FB
std::_Lockit::_Lockit.LIBCPMT ref: 00B47705

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

moneypunct.LIBCPMT ref: 00B4773F
std::_Facet_Register.LIBCPMT ref: 00B47756
std::_Lockit::~_Lockit.LIBCPMT ref: 00B47776

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 8610c093500b82e7518f125b95c8c0f88c5c3806561aaf0ae4d68ce66ff211f1
Instruction ID: f1e81535885237aee5f6a1a4963cfb45b3d48dd753b838b2a7e85e24dc6ca833
Opcode Fuzzy Hash: 8610c093500b82e7518f125b95c8c0f88c5c3806561aaf0ae4d68ce66ff211f1
Instruction Fuzzy Hash: 4501C075A041299BCB05EBA4E845AAEB7F1EF90720F640589E414AB281CF359F05DB81

Function 00B39612 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B39619
std::_Lockit::_Lockit.LIBCPMT ref: 00B39623

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

moneypunct.LIBCPMT ref: 00B3965D
std::_Facet_Register.LIBCPMT ref: 00B39674
std::_Lockit::~_Lockit.LIBCPMT ref: 00B39694

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 5b15029b9c87b8682b9e1b8387326ae0e3214c3216247d4ac5f993b4b14a5c70
Instruction ID: 42f675ad75679624be3aab57e3b8bac58b978e52896d63fc2f0fcd1eb5203bb6
Opcode Fuzzy Hash: 5b15029b9c87b8682b9e1b8387326ae0e3214c3216247d4ac5f993b4b14a5c70
Instruction Fuzzy Hash: BA01DE759012299BCB05EBA4E842AAEB7F1EF90310F354489E819AB291CF719E00CB80

Function 00B4765F Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B47666
std::_Lockit::_Lockit.LIBCPMT ref: 00B47670

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

moneypunct.LIBCPMT ref: 00B476AA
std::_Facet_Register.LIBCPMT ref: 00B476C1
std::_Lockit::~_Lockit.LIBCPMT ref: 00B476E1

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 92ab2970a22cb4a81a6b30816af2517a4094fc5f68a8bde1e22a3ade4f421acf
Instruction ID: 96157c4d9fd008f98f3e6f7fba021bb3599cb5fb0c00a6eef38089c616f71114
Opcode Fuzzy Hash: 92ab2970a22cb4a81a6b30816af2517a4094fc5f68a8bde1e22a3ade4f421acf
Instruction Fuzzy Hash: DC012271904128ABCB05EBA8E801AAEB7F6EF90320F254088E414A73C0DF309F00DB80

Function 00B39990 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B39997
std::_Lockit::_Lockit.LIBCPMT ref: 00B399A1

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

numpunct.LIBCPMT ref: 00B399DB
std::_Facet_Register.LIBCPMT ref: 00B399F2
std::_Lockit::~_Lockit.LIBCPMT ref: 00B39A12

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID:
API String ID: 743221004-0
Opcode ID: e9ffd25857a711ffe2f07741bef336c2601002bbbb68e9d0cf15915862b51399
Instruction ID: 47ec942eb45b7ed0a9e36a554d86323d2cf8c5583b12eb88738dcf153b6fcbf6
Opcode Fuzzy Hash: e9ffd25857a711ffe2f07741bef336c2601002bbbb68e9d0cf15915862b51399
Instruction Fuzzy Hash: 1501C071900129EBDF05EBA8E842AAEB7F5EF90710F250589E419A7281CF749E01CB90

Function 00B39A25 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B39A2C
std::_Lockit::_Lockit.LIBCPMT ref: 00B39A36

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

numpunct.LIBCPMT ref: 00B39A70
std::_Facet_Register.LIBCPMT ref: 00B39A87
std::_Lockit::~_Lockit.LIBCPMT ref: 00B39AA7

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID:
API String ID: 743221004-0
Opcode ID: 7397eaab01952f6748460fadc1082af69b1a2ae671cdd0427087939f8910a806
Instruction ID: d4052a25d1548980bf6c32cab0268a7ff34e8f54553ff9ee346e2cb362c499e0
Opcode Fuzzy Hash: 7397eaab01952f6748460fadc1082af69b1a2ae671cdd0427087939f8910a806
Instruction Fuzzy Hash: EF01D272901129EFCF05EBA4E841ABEB7F4EF90710F244589F414AB281CF759E04CB80

Function 00B2B636 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B2B63D
std::_Lockit::_Lockit.LIBCPMT ref: 00B2B648
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2B6B6

Part of subcall function 00B2B7C9: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00B2B7E1

std::locale::_Setgloballocale.LIBCPMT ref: 00B2B663
_Yarn.LIBCPMT ref: 00B2B679

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: a98588620da09cb569b54b9c448f873b5c23b0b91d9d18142d11b126b2721150
Instruction ID: 5acd6957a031c07f623d30290f81d13fc06a006620d9b5321b1f2e58aae90c2d
Opcode Fuzzy Hash: a98588620da09cb569b54b9c448f873b5c23b0b91d9d18142d11b126b2721150
Instruction Fuzzy Hash: 8E01BCB5A016209BCB06AF60E851A7D7BF1FF84700B158089E80917391CF746E02CBC1

Function 00B81EAE Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 369COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00B8202E
__freea.LIBCMT ref: 00B8204A

Strings

a/p, xrefs: 00B82112
am/pm, xrefs: 00B820AE

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: __freea
String ID: a/p$am/pm
API String ID: 240046367-3206640213
Opcode ID: 55280965b5ee16d88c8045d488cc4b49570b6de3b5b111fa6dbfb89a69ff9215
Instruction ID: efb589068a815a0448915596258340d5eb1cbd26482c8c321b189e83480db8fe
Opcode Fuzzy Hash: 55280965b5ee16d88c8045d488cc4b49570b6de3b5b111fa6dbfb89a69ff9215
Instruction Fuzzy Hash: AFC1CE75904216DBDB28FFA8C889ABAB7F1FF49700F2441D9EA01AB270D3359D41DB61

Function 00B22480 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B224C9
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B2251A
__Getctype.LIBCPMT ref: 00B22531

Strings

bad locale name, xrefs: 00B22557

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: 757fee2313a9231af006498ba3eb31669fdbd8e4af64610eb75e7978d25ac9ed
Instruction ID: dd2fbec4186599db300e18e4b5b111935225ef35b48fd349103c3f5b60cb4ec0
Opcode Fuzzy Hash: 757fee2313a9231af006498ba3eb31669fdbd8e4af64610eb75e7978d25ac9ed
Instruction Fuzzy Hash: 2631AFB1909350AFD7209F18E851B5BBBE0AF94714F1489ADF88C9B212D7B1D944CB92

Function 00B3E075 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3E07C

Part of subcall function 00B36003: _Maklocstr.LIBCPMT ref: 00B36023
Part of subcall function 00B36003: _Maklocstr.LIBCPMT ref: 00B36040
Part of subcall function 00B36003: _Maklocstr.LIBCPMT ref: 00B3605D

_Mpunct.LIBCPMT ref: 00B3E109
_Mpunct.LIBCPMT ref: 00B3E123

Strings

$+xv, xrefs: 00B3E12E

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Maklocstr$Mpunct$H_prolog3
String ID: $+xv
API String ID: 4259326447-1686923651
Opcode ID: ed8cefe941e33fae429259da0cda1bddd9ec17da35faff7a7bb21b34b35b1c4f
Instruction ID: 72f2886c64e77e8181c1b75bdc16c66d0a5bd4f414f65171fffd23a653e1aa61
Opcode Fuzzy Hash: ed8cefe941e33fae429259da0cda1bddd9ec17da35faff7a7bb21b34b35b1c4f
Instruction Fuzzy Hash: 2E21C4B1904B926ED725DF74889073BBEF8BB09301F24499AE499C7A41D770EA01CB90

Function 00B48EF9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B48F00
_Mpunct.LIBCPMT ref: 00B48F8D
_Mpunct.LIBCPMT ref: 00B48FA7

Strings

$+xv, xrefs: 00B48FB2

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Mpunct$H_prolog3
String ID: $+xv
API String ID: 4281374311-1686923651
Opcode ID: 857ef35002ef02bc72542a508235d22ac74bf069c7fefcc45cddc7635c79fb73
Instruction ID: 7870c7cfece4c0c14228ecc4a51c04e44ccd848f0ab81079703dc6e7d66cc640
Opcode Fuzzy Hash: 857ef35002ef02bc72542a508235d22ac74bf069c7fefcc45cddc7635c79fb73
Instruction Fuzzy Hash: 852192B1904A526EDB61DF74889077FBEF8AB09700F044A9AF499C7A41DB70EA05DB90

Function 00B4E956 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63COMMON

Download Yara Rule

APIs

__is_exception_typeof.LIBVCRUNTIME ref: 00B4E9EA

Strings

RCC, xrefs: 00B4E960
csm, xrefs: 00B4E970
MOC, xrefs: 00B4E968

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: __is_exception_typeof
String ID: MOC$RCC$csm
API String ID: 3140442014-2671469338
Opcode ID: 9814d4fd951d7961e4b66649a77827b21ce077a29de881a9f70c9312ef954ebe
Instruction ID: e2f9899b0b7e5e14c683e779be3b6870206d12d2f85f6d420aceaee6568278fa
Opcode Fuzzy Hash: 9814d4fd951d7961e4b66649a77827b21ce077a29de881a9f70c9312ef954ebe
Instruction Fuzzy Hash: D3118235504315DFD718DF98C405BA9B7E8FF00322F1644EAE8589B2A1D7B4EE40DB91

Function 00B5A5F6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000011,00000000,00000800,?,00B5A4F3,00000000,00000001,00C07074,?,?,?,00B5A74A,00000004,InitializeCriticalSectionEx,00BAB5DC,InitializeCriticalSectionEx), ref: 00B5A603
GetLastError.KERNEL32(?,00B5A4F3,00000000,00000001,00C07074,?,?,?,00B5A74A,00000004,InitializeCriticalSectionEx,00BAB5DC,InitializeCriticalSectionEx,00000000,?,00B5323D), ref: 00B5A60D
LoadLibraryExW.KERNEL32(00000011,00000000,00000000,?,00000011,00B51C03), ref: 00B5A635

Strings

api-ms-, xrefs: 00B5A61A

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: f3cad3d23a552fdc9fd7d5fe95e89e9d05f071c86e30c06eba923a3ed8f18d05
Instruction ID: c74dd5e4cc082633c2018d7e37344828801e649ecfe21b3b3f01e22664db4fdc
Opcode Fuzzy Hash: f3cad3d23a552fdc9fd7d5fe95e89e9d05f071c86e30c06eba923a3ed8f18d05
Instruction Fuzzy Hash: C2E04F70680208B7EF202F61EC07F583AA4EB16B41F1444A1FE4DB94E1EF71E917DA99

Function 00B8D8DF Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(5838D13B,00000010,00000000,?), ref: 00B8D942

Part of subcall function 00B91787: WideCharToMultiByte.KERNEL32(00000010,00000000,00BB8230,00000010,00000010,00000010,00B8E31A,0000FDE9,00BB8230,?,?,?,00B8E013,0000FDE9,00000000,?), ref: 00B91833

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00B8DB9D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00B8DBE5
GetLastError.KERNEL32 ref: 00B8DC88

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 2191fc5c27f65ccb7333fabce6bd51fe687c352992b552e6e2f561287bfe4355
Instruction ID: 2c4f3cf5d2a2241332dc717b323aaaedce06e95985fd54cba3f22e164523f18d
Opcode Fuzzy Hash: 2191fc5c27f65ccb7333fabce6bd51fe687c352992b552e6e2f561287bfe4355
Instruction Fuzzy Hash: EED15A75E04258AFCB15DFA8D880AADBBF5FF49300F2845AAE855E73A1D730A941CF50

Function 00B56411 Relevance: 6.2, APIs: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B56418
UnDecorator::getSymbolName.LIBCMT ref: 00B564AA
DName::operator+.LIBCMT ref: 00B565AE
DName::DName.LIBVCRUNTIME ref: 00B56651

Part of subcall function 00B53D5A: shared_ptr.LIBCMT ref: 00B53D76

Part of subcall function 00B53FF4: DName::DName.LIBVCRUNTIME ref: 00B54042

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Name$Name::$Decorator::getH_prolog3Name::operator+Symbolshared_ptr
String ID:
API String ID: 1134295639-0
Opcode ID: bb7179c5b5e9e07019838fee16364b75903ace2683ddbec1a2d6d8289388ea97
Instruction ID: c9d0e0dda5bc89cfddcac58de0b93f2fead881f6c7b20814070bb4a826e9705a
Opcode Fuzzy Hash: bb7179c5b5e9e07019838fee16364b75903ace2683ddbec1a2d6d8289388ea97
Instruction Fuzzy Hash: 65715E71D042199FDB15CFA4D881BEEBBF4EB08316F5441EAED05AB251DB34A948CB60

Function 00B56AB0 Relevance: 6.2, APIs: 4, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00B56BE5

Part of subcall function 00B539A9: __aulldvrm.LIBCMT ref: 00B539DA

DName::operator+.LIBCMT ref: 00B56B46
DName::operator=.LIBVCRUNTIME ref: 00B56C2A
DName::DName.LIBVCRUNTIME ref: 00B56C5C

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::Name::operator=__aulldvrm
String ID:
API String ID: 2973644308-0
Opcode ID: 7cf99a1bd6add52bfb8cf6a4839b2e97e043ef86006aa4c633fab100839d0688
Instruction ID: 798d52277fa759d764066b0340b4566bf8d7d3a87c001317889c8ef1023a302f
Opcode Fuzzy Hash: 7cf99a1bd6add52bfb8cf6a4839b2e97e043ef86006aa4c633fab100839d0688
Instruction Fuzzy Hash: D3616DB0D04219DFDB09CF64C881BAEBBF0FB45702F5582DAE9456B351D770AA44CBA0

Function 00B5207F Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00B52146
___AdjustPointer.LIBCMT ref: 00B52169
___AdjustPointer.LIBCMT ref: 00B52205

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: f228488e0972d1c74cdc8e98f0765c155e1607ed2ec13ac137af20e62c3da62b
Instruction ID: 9754e4cfa7270b94baaf33260679894740848270e42ef154582d55cd67702cff
Opcode Fuzzy Hash: f228488e0972d1c74cdc8e98f0765c155e1607ed2ec13ac137af20e62c3da62b
Instruction Fuzzy Hash: 8F51E576606A02AFEB289F10D881BBB73E4FF56702F1441D9EE0167291D731ED89DB90

Function 00B567E1 Relevance: 6.1, APIs: 4, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00B56814

Part of subcall function 00B53D1E: DName::operator+=.LIBCMT ref: 00B53D34

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Name::operator+Name::operator+=
String ID:
API String ID: 382699925-0
Opcode ID: 6e2243beb9ce3ade03b900cc72c8103dec4acdf3f5c9544303d31ce64c8ce997
Instruction ID: 52666d0d5b5e0ddd3485f6ff9ab14ba69f83d72518d690f63cd2b509336ca3f6
Opcode Fuzzy Hash: 6e2243beb9ce3ade03b900cc72c8103dec4acdf3f5c9544303d31ce64c8ce997
Instruction Fuzzy Hash: 1D412971D0420ADACB04DFA8D889BEEBBF4EF19305F5041DAE915A7341D7759A8CCB90

Function 00B2E884 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B2E88B

Part of subcall function 00B2B636: __EH_prolog3.LIBCMT ref: 00B2B63D
Part of subcall function 00B2B636: std::_Lockit::_Lockit.LIBCPMT ref: 00B2B648
Part of subcall function 00B2B636: std::locale::_Setgloballocale.LIBCPMT ref: 00B2B663
Part of subcall function 00B2B636: _Yarn.LIBCPMT ref: 00B2B679
Part of subcall function 00B2B636: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2B6B6

std::_Lockit::_Lockit.LIBCPMT ref: 00B2E8AF
std::locale::_Setgloballocale.LIBCPMT ref: 00B2E8FE
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2E95E

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_Setgloballocalestd::locale::_$Yarn
String ID:
API String ID: 2301162320-0
Opcode ID: 40a05ae80259cb570a6b07c90309e495af029529b70d073f3b21379a21d8dbcb
Instruction ID: 9dd5e8e02470af81df793c46976da0bfe311e52ef3e32b851a01d1df26126919
Opcode Fuzzy Hash: 40a05ae80259cb570a6b07c90309e495af029529b70d073f3b21379a21d8dbcb
Instruction Fuzzy Hash: 23217E726002249FDB44DF69D8D1A6D77F4EF8931070440AAE81EDB282DF30ED41CB91

Function 00B9298E Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00B91787: WideCharToMultiByte.KERNEL32(00000010,00000000,00BB8230,00000010,00000010,00000010,00B8E31A,0000FDE9,00BB8230,?,?,?,00B8E013,0000FDE9,00000000,?), ref: 00B91833

GetLastError.KERNEL32 ref: 00B929F2
__dosmaperr.LIBCMT ref: 00B929F9
GetLastError.KERNEL32(?,?,?,?), ref: 00B92A33
__dosmaperr.LIBCMT ref: 00B92A3A

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 04680ac488c53efbbeb0316dd8c0e866add400323e0f4c1ef5033e77d6889f05
Instruction ID: b4c9608c7014e6127074a760eb2d7b291903fc28b5250b81b38005f821e5fc5a
Opcode Fuzzy Hash: 04680ac488c53efbbeb0316dd8c0e866add400323e0f4c1ef5033e77d6889f05
Instruction Fuzzy Hash: 6621C532A00205BFDF20AF75888186BB7E8FF4936471185B9F959D7250D730ED419B90

Function 00B80BE4 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6afa9a4c8e6f52061ef2afe552a70e574f539fc2d9674da114b20bd408e4e193
Instruction ID: cef36a6a46f9645517a9a0e7b3d53628a4e6f0f5f30520fdf219575987c9685d
Opcode Fuzzy Hash: 6afa9a4c8e6f52061ef2afe552a70e574f539fc2d9674da114b20bd408e4e193
Instruction Fuzzy Hash: 1121D871210205AFDBA0BF76DC81C6B77E8EF443A4B1086A5F955D7161EB30EC05DB50

Function 00B9463F Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00B94647

Part of subcall function 00B91787: WideCharToMultiByte.KERNEL32(00000010,00000000,00BB8230,00000010,00000010,00000010,00B8E31A,0000FDE9,00BB8230,?,?,?,00B8E013,0000FDE9,00000000,?), ref: 00B91833

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B9467F
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B9469F

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 9c6d51d12cdb44bc4d7c9d3404a6ab69bc1180974c40e819ae67bd45e5b4f680
Instruction ID: 7b1c25a381d9545f8263e654c97c8c001a01f16c02d20832ee59d8be80a43aad
Opcode Fuzzy Hash: 9c6d51d12cdb44bc4d7c9d3404a6ab69bc1180974c40e819ae67bd45e5b4f680
Instruction Fuzzy Hash: 9B11ADE19015167FAA112BB55C8ECAF6AECEE8B2D871005F5F902A2101FF249D0292B9

Function 00B2D92A Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B2D931
std::_Lockit::_Lockit.LIBCPMT ref: 00B2D93B
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2D9E2
Concurrency::cancel_current_task.LIBCPMT ref: 00B2D9ED

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Concurrency::cancel_current_taskH_prolog3Lockit::_Lockit::~_
String ID:
API String ID: 4244582100-0
Opcode ID: da13c4feffdbe46c7a8601412c8939f43db618a5326192a8dd9e617d104b7b98
Instruction ID: 3fe2f7c8304d43f4afa56a4739f012c24721ecfa800287758143510f8e3cdc65
Opcode Fuzzy Hash: da13c4feffdbe46c7a8601412c8939f43db618a5326192a8dd9e617d104b7b98
Instruction Fuzzy Hash: EE212C7460062AAFDB04EF14D891A6DB7B1FF49710F10849AE8699B7A1DF71ED50CF80

Function 00B2D701 Relevance: 6.1, APIs: 4, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B2D708
std::_Lockit::_Lockit.LIBCPMT ref: 00B2D712

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

std::_Facet_Register.LIBCPMT ref: 00B2D763
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2D783

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: c37a9bb8b4cde5212228d6d33944004bc9bb27820473e1c3c7287802381d4f44
Instruction ID: 897e2f94fcec56f5db8bed716e1c8a14b6408b889867ba0433d42976225be195
Opcode Fuzzy Hash: c37a9bb8b4cde5212228d6d33944004bc9bb27820473e1c3c7287802381d4f44
Instruction Fuzzy Hash: 0E11C475900228EBCB05EFA4E841AAEBBF4EF54310F244599F818E7391CF759E05DB80

Function 00B5AE4C Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00B5ABA1,00000000,00000004,00000000), ref: 00B5AE9B
GetLastError.KERNEL32 ref: 00B5AEA7
__dosmaperr.LIBCMT ref: 00B5AEAE

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 610e6ed5ca027f6b26cc6f8bddc3ce853578af7160252edfa99b07f9fa884862
Instruction ID: 84a6a35cc7440533f5712afed43527b28aeaafbb3b4cf384f4895df9794649c3
Opcode Fuzzy Hash: 610e6ed5ca027f6b26cc6f8bddc3ce853578af7160252edfa99b07f9fa884862
Instruction Fuzzy Hash: 8C01DB72500104BBDB119BA5DC4AB9E7BF5DF81372F2043D5FA24A60D0DF708905D761

Function 00B90129 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001,?), ref: 00B9013F
GetLastError.KERNEL32(?,?,?,?), ref: 00B9014C
SetFilePointerEx.KERNEL32(?,?,?,?,?), ref: 00B90172
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,?,?), ref: 00B90198

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: b5e69fb01b0ad1bcbed4e39c37b7b5717cec31b2a2dd1335623a96ebadc339de
Instruction ID: d028451234e5a2312730d23a31313a07fb2058a6e1e614f7442250be5a1a3043
Opcode Fuzzy Hash: b5e69fb01b0ad1bcbed4e39c37b7b5717cec31b2a2dd1335623a96ebadc339de
Instruction Fuzzy Hash: C4117571810228BFDF10AFA6DC499DF3FB9EF05760F108198F824A61A0CB31CA41DBA0

Function 00B38FAB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B38FB2
std::_Lockit::_Lockit.LIBCPMT ref: 00B38FBC

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

std::_Facet_Register.LIBCPMT ref: 00B3900D
std::_Lockit::~_Lockit.LIBCPMT ref: 00B3902D

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 6c83a71975e8fd8f9df108bcfbd30db731c914105329da2acc5fb73c1821acb5
Instruction ID: 67cfb22c22bd0014f3adc84577f3e68d69b425b3dd9e9e14080737cd7a40eb7e
Opcode Fuzzy Hash: 6c83a71975e8fd8f9df108bcfbd30db731c914105329da2acc5fb73c1821acb5
Instruction Fuzzy Hash: 5501D275900129DBDB06EBA4E852AAEB7F1EF90320F240489F415A72D1DF709E01CB80

Function 00B38F16 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B38F1D
std::_Lockit::_Lockit.LIBCPMT ref: 00B38F27

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

std::_Facet_Register.LIBCPMT ref: 00B38F78
std::_Lockit::~_Lockit.LIBCPMT ref: 00B38F98

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: e555f4da398cce7a4620b44bcb4f29eb67bbc9f67c1015d2cba510a329ed94ce
Instruction ID: 252f850926b1a92ce40c5ece48d0c1ca525d76e5b0a197074bf3f5e7a7913e6d
Opcode Fuzzy Hash: e555f4da398cce7a4620b44bcb4f29eb67bbc9f67c1015d2cba510a329ed94ce
Instruction Fuzzy Hash: 4401C4719002259BDB05EBA4D851ABE77F5EF94310F254589F4186B281CF749E01CB81

Function 00B4740B Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B47412
std::_Lockit::_Lockit.LIBCPMT ref: 00B4741C

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

std::_Facet_Register.LIBCPMT ref: 00B4746D
std::_Lockit::~_Lockit.LIBCPMT ref: 00B4748D

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 2affc321c83943d54bf0ef2a1293d882254278c0b3eb871972d45d74445b4042
Instruction ID: a9f3ab877e0aa4d2232ead191395a1e5d0f39576f53763be64aa2edba15a1b26
Opcode Fuzzy Hash: 2affc321c83943d54bf0ef2a1293d882254278c0b3eb871972d45d74445b4042
Instruction Fuzzy Hash: 7801C075A041299BCB05EFA4E845ABE7BF1EF90310F254589E415AB3C1DF709E01DB90

Function 00B475CA Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B475D1
std::_Lockit::_Lockit.LIBCPMT ref: 00B475DB

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

std::_Facet_Register.LIBCPMT ref: 00B4762C
std::_Lockit::~_Lockit.LIBCPMT ref: 00B4764C

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 2b32b202199969677982625a99beccd245d6627d36a6390f430d990fb38d1c6c
Instruction ID: e058ae97e20019e6c76f50929c2d16c069496584f46243b8b4e5481f715b8f66
Opcode Fuzzy Hash: 2b32b202199969677982625a99beccd245d6627d36a6390f430d990fb38d1c6c
Instruction Fuzzy Hash: 5F01F571944629DBCB05EFA8E845BBEB7F5EF90310F254589E419AB281CF319F00DB90

Function 00B47535 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B4753C
std::_Lockit::_Lockit.LIBCPMT ref: 00B47546

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

std::_Facet_Register.LIBCPMT ref: 00B47597
std::_Lockit::~_Lockit.LIBCPMT ref: 00B475B7

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 6b6f6d4b8c20d9fc4752facfa11ca85a481956b4e598f3310b09c51de1b0baf5
Instruction ID: 33dcf39aa8af99b0113f1eb6aaa50198ba46a3110effe41101a7fcf40acd212b
Opcode Fuzzy Hash: 6b6f6d4b8c20d9fc4752facfa11ca85a481956b4e598f3310b09c51de1b0baf5
Instruction Fuzzy Hash: 3F01C0719041299BCB15EFA4E845ABE77F4EF90320F240489E415AB291CF349F00DB90

Function 00B47789 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B47790
std::_Lockit::_Lockit.LIBCPMT ref: 00B4779A

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

std::_Facet_Register.LIBCPMT ref: 00B477EB
std::_Lockit::~_Lockit.LIBCPMT ref: 00B4780B

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 75bdc7203aac41f0892e9c407dbd381cfe244097e9fedeb71cfa58c4513154a9
Instruction ID: db3eab1276b922d6b528fab23e1bb0533a2e94aafb0bd43ae7607639206f1277
Opcode Fuzzy Hash: 75bdc7203aac41f0892e9c407dbd381cfe244097e9fedeb71cfa58c4513154a9
Instruction Fuzzy Hash: 0301D2719441299BDF05EBA8E845ABEBBF0EF90720F254489E814AB381CF309F04DB80

Function 00B397D1 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B397D8
std::_Lockit::_Lockit.LIBCPMT ref: 00B397E2

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

std::_Facet_Register.LIBCPMT ref: 00B39833
std::_Lockit::~_Lockit.LIBCPMT ref: 00B39853

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 39baa25898755b3f839a39841618877019aeeb18b5b2d2dbd21f383d9f88b097
Instruction ID: 1645c688db90e8883cfc248c531d4b68d065aa22d971bf0af3319d31dadcced7
Opcode Fuzzy Hash: 39baa25898755b3f839a39841618877019aeeb18b5b2d2dbd21f383d9f88b097
Instruction Fuzzy Hash: DB01D271900129DBCF05EFA4E841AAEBBF0EF94710F244589E918AB281DF749E01CB80

Function 00B3973C Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B39743
std::_Lockit::_Lockit.LIBCPMT ref: 00B3974D

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

std::_Facet_Register.LIBCPMT ref: 00B3979E
std::_Lockit::~_Lockit.LIBCPMT ref: 00B397BE

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 8124f37d48919a88e27aaa03e5c6eaf940f7e56251dd91bbaf009493efd00ea9
Instruction ID: 18d012cfbce27122d1d4e4823660a53bac5973912ce596d110605743759b240d
Opcode Fuzzy Hash: 8124f37d48919a88e27aaa03e5c6eaf940f7e56251dd91bbaf009493efd00ea9
Instruction Fuzzy Hash: 1C01D275900229EFCB05EFA4E846AAEB7F5EF90710F240589F815A72D1CF709E01CB80

Function 00B398FB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B39902
std::_Lockit::_Lockit.LIBCPMT ref: 00B3990C

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

std::_Facet_Register.LIBCPMT ref: 00B3995D
std::_Lockit::~_Lockit.LIBCPMT ref: 00B3997D

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: ec0a495705fcb72ab17f283fff4898d1cec356710ebc0641bbdf42ecea587815
Instruction ID: ef639f96cfa3d39a60f5a17728e79e6547c419b1e6ad40df537c880f6d51d746
Opcode Fuzzy Hash: ec0a495705fcb72ab17f283fff4898d1cec356710ebc0641bbdf42ecea587815
Instruction Fuzzy Hash: CF01D276901129DBDF05EBA4E841BAEB7F1FF90310F240589E819AB281CF719E01CB80

Function 00B4781E Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B47825
std::_Lockit::_Lockit.LIBCPMT ref: 00B4782F

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

std::_Facet_Register.LIBCPMT ref: 00B47880
std::_Lockit::~_Lockit.LIBCPMT ref: 00B478A0

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 5c9f7417995de701c56aa8ad5479ac78625dcad5229c6191de8dceef1d541c59
Instruction ID: 338f3e972be6300239a85f36d70acbd158a8a82c3870e14dbc30dcaa276bab39
Opcode Fuzzy Hash: 5c9f7417995de701c56aa8ad5479ac78625dcad5229c6191de8dceef1d541c59
Instruction Fuzzy Hash: 7201D271900129EBCF05EBA8E845ABEB7F0EF94720F244589E419A7391CF319F04DB90

Function 00B39866 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3986D
std::_Lockit::_Lockit.LIBCPMT ref: 00B39877

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

std::_Facet_Register.LIBCPMT ref: 00B398C8
std::_Lockit::~_Lockit.LIBCPMT ref: 00B398E8

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 2688f992aa29f4cfea934f5573920abd4e8748578d0dea2e8edc12d82c89b743
Instruction ID: 918df4bb5d2723bc0912e0a4f802633c78a3ed1f785db6e4db5f03789c5a4f9e
Opcode Fuzzy Hash: 2688f992aa29f4cfea934f5573920abd4e8748578d0dea2e8edc12d82c89b743
Instruction Fuzzy Hash: 13010071900228DFCF05EBA8E855AAE77F1EF81310F244488E419AB281CF709E00CB80

Function 00B39ABA Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B39AC1
std::_Lockit::_Lockit.LIBCPMT ref: 00B39ACB

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

std::_Facet_Register.LIBCPMT ref: 00B39B1C
std::_Lockit::~_Lockit.LIBCPMT ref: 00B39B3C

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: f595c959fdde30d25600ac3dd08b393f4c87b335efdb648ab88bba2adef41917
Instruction ID: d5783393cb5b5cf92c7ac529681a535987534a7f17458f90f9f8f8f5c3db10d7
Opcode Fuzzy Hash: f595c959fdde30d25600ac3dd08b393f4c87b335efdb648ab88bba2adef41917
Instruction Fuzzy Hash: 2E019275900129DFCB05EFA4E845ABEBBF5EF94710F244589E415A7391DF749E01CB80

Function 00B39BE4 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B39BEB
std::_Lockit::_Lockit.LIBCPMT ref: 00B39BF5

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

std::_Facet_Register.LIBCPMT ref: 00B39C46
std::_Lockit::~_Lockit.LIBCPMT ref: 00B39C66

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: d18883c5850547e2fb9fd198e6c5a811bedf1853cd3c18662b8021e6a73379d2
Instruction ID: ca3b5b9565f68d00c7ebdcd765fe061de6e4ab25f7de6cc4a19424fdd34c9a93
Opcode Fuzzy Hash: d18883c5850547e2fb9fd198e6c5a811bedf1853cd3c18662b8021e6a73379d2
Instruction Fuzzy Hash: 1501D271900129AFCB05EBA8E881BBE7BF4EF90310F640489E415A7391CF749E00CB80

Function 00B39B4F Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B39B56
std::_Lockit::_Lockit.LIBCPMT ref: 00B39B60

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

std::_Facet_Register.LIBCPMT ref: 00B39BB1
std::_Lockit::~_Lockit.LIBCPMT ref: 00B39BD1

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: a36e004afeb4a80def5481f21551760e8fb8c159a1ff10cd60a6bec719f5996d
Instruction ID: f946606ae9f5c078e8a54f887f6335e7f825d546b3ee2b106dac222f7ade2cc9
Opcode Fuzzy Hash: a36e004afeb4a80def5481f21551760e8fb8c159a1ff10cd60a6bec719f5996d
Instruction Fuzzy Hash: FD01D271904129DBCF05EFA4E841BAEBBF5EF90710F240599F419AB291DF749E05CB80

Function 00B39C79 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B39C80
std::_Lockit::_Lockit.LIBCPMT ref: 00B39C8A

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

std::_Facet_Register.LIBCPMT ref: 00B39CDB
std::_Lockit::~_Lockit.LIBCPMT ref: 00B39CFB

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 96b03e31522f03566b7fa68bb95f9661586af36f9ec79012a95e3d63ac10ba36
Instruction ID: 21aa4bff4be82dae7551bb10c14cf19a1ed99d27ab0800256d1b6defeb28d638
Opcode Fuzzy Hash: 96b03e31522f03566b7fa68bb95f9661586af36f9ec79012a95e3d63ac10ba36
Instruction Fuzzy Hash: 9601D271900129DBCB05EBA4E841AAE7BF0EF94710F244489E819AB381CF749E05CB80

Function 00B390D5 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B390DC
std::_Lockit::_Lockit.LIBCPMT ref: 00B390E6

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

ctype.LIBCPMT ref: 00B39120
std::_Lockit::~_Lockit.LIBCPMT ref: 00B39157

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3ctype
String ID:
API String ID: 3358926169-0
Opcode ID: 2aab3bc5347b1cfff081ec1a8c720526c07bcc17d04297fd1197510f8f02a271
Instruction ID: b269f470a6601c50caf267b4dc7c983e22961fe6b17e8f556c83c0b86919bc1c
Opcode Fuzzy Hash: 2aab3bc5347b1cfff081ec1a8c720526c07bcc17d04297fd1197510f8f02a271
Instruction Fuzzy Hash: 76F0BB3190052ABBDB05EBA4E846BAE37E4DF50710F200594F529B71C1DF759E08D780

Function 00B39040 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B39047
std::_Lockit::_Lockit.LIBCPMT ref: 00B39051

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

ctype.LIBCPMT ref: 00B3908B
std::_Lockit::~_Lockit.LIBCPMT ref: 00B390C2

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3ctype
String ID:
API String ID: 3358926169-0
Opcode ID: b60cad6b95f1feabcf5b95f581b48c9a55835a32d7fd05b595b83b67f0c79df2
Instruction ID: 6d28ae838524b58a72319dfdcdcce5f7d855845093fe0ee8f729da1ba8b9b1dc
Opcode Fuzzy Hash: b60cad6b95f1feabcf5b95f581b48c9a55835a32d7fd05b595b83b67f0c79df2
Instruction Fuzzy Hash: 83F0B431900129ABDB19FBB0D842BAE77E0EF50710F204588F5186B1C2EF759E04CB81

Function 00B391FF Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B39206
std::_Lockit::_Lockit.LIBCPMT ref: 00B39210

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

messages.LIBCPMT ref: 00B3924A
std::_Lockit::~_Lockit.LIBCPMT ref: 00B39281

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3messages
String ID:
API String ID: 50917705-0
Opcode ID: a49413dafeffb7602d21f00f581a5ccac72deb80c35d96bd192e4c5b4a9b5d98
Instruction ID: 4a2fc6893b21d9d4b29c514490ca87ead939a5cbc80b7fc4db6f5aab6cd8f2d0
Opcode Fuzzy Hash: a49413dafeffb7602d21f00f581a5ccac72deb80c35d96bd192e4c5b4a9b5d98
Instruction Fuzzy Hash: F9F0BE31905529ABCB05FBA0E842BAE37E4AF50710F7005D9F918AB2D1EF75AE04CB80

Function 00B3916A Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B39171
std::_Lockit::_Lockit.LIBCPMT ref: 00B3917B

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

messages.LIBCPMT ref: 00B391B5
std::_Lockit::~_Lockit.LIBCPMT ref: 00B391EC

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3messages
String ID:
API String ID: 50917705-0
Opcode ID: 1adf6c33665d5589e49d9d970321f45440ca24cf653be1901ad5586f77bd38ad
Instruction ID: 6545f9c4014fa727a3d19a8a607acb90244b54a40be9063272d59bfb1a29fee6
Opcode Fuzzy Hash: 1adf6c33665d5589e49d9d970321f45440ca24cf653be1901ad5586f77bd38ad
Instruction Fuzzy Hash: F8F0BE7190052ABBDB09FBA4E856BBE77E5EF50710F200688F518BB2C1DF759E058780

Function 00BA039B Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 00BA03B5
GetLastError.KERNEL32 ref: 00BA03C1

Part of subcall function 00BA046A: CloseHandle.KERNEL32(FFFFFFFE,00BA04B4,?,00B9BFAF,00000010,00000001,00000010,?,?,00B8DCDC,?,00000010,00000000,?,?), ref: 00BA047A

___initconout.LIBCMT ref: 00BA03D1

Part of subcall function 00BA042C: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00BA045B,00B9BF9C,?,?,00B8DCDC,?,00000010,00000000,?), ref: 00BA043F

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 00BA03E5

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: cd50afc473420079fbdb3d018150d6f1e940b3ae1c42b4c02e22be8db5603a09
Instruction ID: 4680fce3cda4b655f2f1b96db0b0541400013c59f6344a9f3572c80c1ccac4fc
Opcode Fuzzy Hash: cd50afc473420079fbdb3d018150d6f1e940b3ae1c42b4c02e22be8db5603a09
Instruction Fuzzy Hash: 89F05E36110601BBCB222B96DC059467FF6FB8E711B104415F64993530DE729851DB60

Function 00BA0481 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000010,00000000,00BB8230,00000000,00000010,?,00B9BFAF,00000010,00000001,00000010,?,?,00B8DCDC,?,00000010,00000000), ref: 00BA0498
GetLastError.KERNEL32(?,00B9BFAF,00000010,00000001,00000010,?,?,00B8DCDC,?,00000010,00000000,?,?,?,00B8E2AB,00000010), ref: 00BA04A4

Part of subcall function 00BA046A: CloseHandle.KERNEL32(FFFFFFFE,00BA04B4,?,00B9BFAF,00000010,00000001,00000010,?,?,00B8DCDC,?,00000010,00000000,?,?), ref: 00BA047A

___initconout.LIBCMT ref: 00BA04B4

Part of subcall function 00BA042C: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00BA045B,00B9BF9C,?,?,00B8DCDC,?,00000010,00000000,?), ref: 00BA043F

WriteConsoleW.KERNEL32(00000010,00000000,00BB8230,00000000,?,00B9BFAF,00000010,00000001,00000010,?,?,00B8DCDC,?,00000010,00000000,?), ref: 00BA04C9

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 90a27e797715aba827c2aa3cf026f65526f6af2ede09d9865c98368c28cd763d
Instruction ID: d2e508d96ba0c6f2d197835886416e2d4b1d730fc883aa2573d8419a1ab46fe5
Opcode Fuzzy Hash: 90a27e797715aba827c2aa3cf026f65526f6af2ede09d9865c98368c28cd763d
Instruction Fuzzy Hash: 1DF01C36514125BBCF222F91DC0598A3FB6FB0E3A1F008050FA09A6631DE728C20DBD1

Function 00B394E8 Relevance: 6.0, APIs: 4, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B394EF
std::_Lockit::_Lockit.LIBCPMT ref: 00B394F9

Part of subcall function 00B22220: std::_Lockit::_Lockit.LIBCPMT ref: 00B2222F
Part of subcall function 00B22220: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2224A

moneypunct.LIBCPMT ref: 00B39533
std::_Lockit::~_Lockit.LIBCPMT ref: 00B3956A

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3moneypunct
String ID:
API String ID: 3160146232-0
Opcode ID: bcf5b809f0e01fc0609945cb90ec67b7dc8b87a396191d265ac3598d40410fe3
Instruction ID: 140cdf8636d91203bba78bbf9ab126a05a26584e8c00cb44a7c10086af43b7c1
Opcode Fuzzy Hash: bcf5b809f0e01fc0609945cb90ec67b7dc8b87a396191d265ac3598d40410fe3
Instruction Fuzzy Hash: D8F0A071900229BBDF02FBA0D852BAE37A5EF50700F610098F8086B281CF759F04CB81

Function 00B758BD Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 291COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00B75A34

Strings

+, xrefs: 00B75992
-, xrefs: 00B75985

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: +$-
API String ID: 3732870572-2137968064
Opcode ID: 55ea88ad12684d53603bdb65b5a3d19b7dc181b6f7c924530d379be042662d04
Instruction ID: 4bf584bb9c9a6c9db6149c83cc459bd7942a60d056040a08f69403905c656210
Opcode Fuzzy Hash: 55ea88ad12684d53603bdb65b5a3d19b7dc181b6f7c924530d379be042662d04
Instruction Fuzzy Hash: E5A1B4309056599FDF34CE6888916FE7BF5EF45320F18C6E9E8B9AB381D2B499018B50

Function 00B45A6E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 193COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B45A75
__cftoe.LIBCMT ref: 00B45B08

Strings

!%x, xrefs: 00B45A83

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: b94e0ae9d7d86f06522292a30dca4cf0a6b01ae9d0962d93c3726794fd11aaff
Instruction ID: 4a297118d6af01295c5ae9ecc62ba0df953803c2172a7c96819c68273ce87734
Opcode Fuzzy Hash: b94e0ae9d7d86f06522292a30dca4cf0a6b01ae9d0962d93c3726794fd11aaff
Instruction Fuzzy Hash: 95717C71D00609AFDF18EFA8E881AEDB7F5EF48300F1041A9F415A7252EB35AE41CB50

Function 00B45C88 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 193COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B45C8F
__cftoe.LIBCMT ref: 00B45D22

Strings

!%x, xrefs: 00B45C9D

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: b42173aec94d549ef68a202726b9febb0460f587b80a070e7f9db70dd93fe9e5
Instruction ID: 2b6aee9842fe23a1848838de096c8c7de8964263975a17d93df639b62de6e5a3
Opcode Fuzzy Hash: b42173aec94d549ef68a202726b9febb0460f587b80a070e7f9db70dd93fe9e5
Instruction Fuzzy Hash: 75716A72D00509AFDF28EFA8E885AEDB7F5EF48300F1045A9F415A7252EB35AE41CB50

Function 00B4B2F8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 183COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00B4B45B

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00B4B3B9, 00B4B3F0, 00B4B3F5
-, xrefs: 00B4B489

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: -$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3732870572-1956417402
Opcode ID: 18df8299cf270231cd73f9332d56c356808625bb34b080de345946c641b1ec98
Instruction ID: b8e2f491c73e69b697241b6c0ae3e8d1156cd37a9138764e8c9f7984086061a6
Opcode Fuzzy Hash: 18df8299cf270231cd73f9332d56c356808625bb34b080de345946c641b1ec98
Instruction Fuzzy Hash: F951E730A042589BCF258E6E8481FBEBBF9DF49710F1444DAE691D7342C374CB41AB55

Function 00B51AA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00B51ADF
__IsNonwritableInCurrentImage.LIBCMT ref: 00B51B93

Strings

csm, xrefs: 00B51B7D

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: f7dbbaa0373e66d038f5f81d439a957153cf907c8b321eb019547bd239e3a328
Instruction ID: cebf957ac10454ff9e3fa7c625fb1856f82db3997f77d0b650f2f7d706b66a46
Opcode Fuzzy Hash: f7dbbaa0373e66d038f5f81d439a957153cf907c8b321eb019547bd239e3a328
Instruction Fuzzy Hash: 45419D34A00208ABCF10DF6CC881B9EBBF5EF46315F1485D5EC15AB392E775AA19CB91

Function 00B5267B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00B526A0

Strings

RCC, xrefs: 00B526BA
MOC, xrefs: 00B526B2

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 61c1ec72569604b4d30ff335253dcbad9177b2401db552d5d33990a7ea436178
Instruction ID: 6afaf5f98b8cdd309cd189ca69bf8dbfb129939db2aee13186d7b7a6d38b09b1
Opcode Fuzzy Hash: 61c1ec72569604b4d30ff335253dcbad9177b2401db552d5d33990a7ea436178
Instruction Fuzzy Hash: 41414472900209AFDF16CF98CD81AAEBBF5FF49305F1480D9F908A6221D335AE64DB50

Function 00B4422C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B44233

Part of subcall function 00B39040: __EH_prolog3.LIBCMT ref: 00B39047
Part of subcall function 00B39040: std::_Lockit::_Lockit.LIBCPMT ref: 00B39051

Strings

0123456789-, xrefs: 00B44283
%.0Lf, xrefs: 00B4427E

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: H_prolog3H_prolog3_LockitLockit::_std::_
String ID: %.0Lf$0123456789-
API String ID: 79917597-3094241602
Opcode ID: 24a4edd964abc56c4397c729fe2b3717abf0cf935d15d489f7771aac82dae76e
Instruction ID: 6f17eb8a36b4ea2d3e00649c7344e84bb30eda807febebd9a269703a2eceb237
Opcode Fuzzy Hash: 24a4edd964abc56c4397c729fe2b3717abf0cf935d15d489f7771aac82dae76e
Instruction Fuzzy Hash: DB415835910119EFCF05EFA4C9819EEBBF4FF09314F200199F911AB251DB709A56DB91

Function 00B44559 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B44560

Part of subcall function 00B390D5: __EH_prolog3.LIBCMT ref: 00B390DC
Part of subcall function 00B390D5: std::_Lockit::_Lockit.LIBCPMT ref: 00B390E6

Strings

0123456789-, xrefs: 00B445AB
0123456789-, xrefs: 00B445B0

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: H_prolog3H_prolog3_LockitLockit::_std::_
String ID: 0123456789-$0123456789-
API String ID: 79917597-2494171821
Opcode ID: 7ef8cf307414121b53bff138dc45ffeb53a0e542434d13d1894fbdd4d9d6a81c
Instruction ID: c149ec63dac28b44e888e49e6ee789c8d4040a05228dc9e56b99c59b38b358b5
Opcode Fuzzy Hash: 7ef8cf307414121b53bff138dc45ffeb53a0e542434d13d1894fbdd4d9d6a81c
Instruction Fuzzy Hash: 80416C31900219EFCF15EFA4C981AEEBBF5FF09310F200099E911AB251DB30AE56DB51

Function 00B4A84D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B4A854

Part of subcall function 00B259F0: std::_Lockit::_Lockit.LIBCPMT ref: 00B259FD
Part of subcall function 00B259F0: std::_Lockit::_Lockit.LIBCPMT ref: 00B25A17
Part of subcall function 00B259F0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B25A38
Part of subcall function 00B259F0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B25A64

Strings

0123456789-, xrefs: 00B4A8A4
0123456789-, xrefs: 00B4A89F

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 2088892359-2494171821
Opcode ID: ea6587e61333d21d788e35b4d1d711d1ac5bc270f9b04780c00b5222374ca8ea
Instruction ID: ca749bdd9d2341d5726b1d58d00721ede63eefd8a62fc238f1f5d99ad9ac34f2
Opcode Fuzzy Hash: ea6587e61333d21d788e35b4d1d711d1ac5bc270f9b04780c00b5222374ca8ea
Instruction Fuzzy Hash: 16415871D00218EFCF15EFA4E8819AEBBB5EF19310B10409AF815AB252DB359E16EB51

Function 00B273F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B27439
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B2748A

Strings

bad locale name, xrefs: 00B274B6

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: f14fb63a410ec3fbda1ac1921071af3cb1009dda1f3812e8c85f79dc6fd61d63
Instruction ID: b28a71ad1bf194054c4a24a3b6b0fb764794e56b7a602ae1ba13dadfa59a4e67
Opcode Fuzzy Hash: f14fb63a410ec3fbda1ac1921071af3cb1009dda1f3812e8c85f79dc6fd61d63
Instruction Fuzzy Hash: EF2168715093509BD710DF28D89174BBFE0AF94714F68489DE48C9B241D7B6C909CB97

Function 00B56D19 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00B56D30
DName::DName.LIBVCRUNTIME ref: 00B56DB5

Strings

A, xrefs: 00B56D95

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: NameName::
String ID: A
API String ID: 1333004437-3554254475
Opcode ID: 5a8cdd2608598b82ae1d5981a389a7bfea02516699da6bfa7ec3ddc168e6d522
Instruction ID: 63ecbd74f5e1249ec1d2163d31f39c0e76595cc5b20920abd237d143cb49dcbb
Opcode Fuzzy Hash: 5a8cdd2608598b82ae1d5981a389a7bfea02516699da6bfa7ec3ddc168e6d522
Instruction Fuzzy Hash: DE218EB1A04208EFEF15DF64C851BAD7BF1FB04346F5488E9E8095B291C730AA8ACF50

Function 00B22070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B22075
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B220BA

Part of subcall function 00B2B734: _Yarn.LIBCPMT ref: 00B2B753
Part of subcall function 00B2B734: _Yarn.LIBCPMT ref: 00B2B777

Strings

bad locale name, xrefs: 00B220C8

Memory Dump Source

Source File: 00000000.00000002.2271391310.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.2271367347.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271452400.0000000000BA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BBA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271476585.0000000000BFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271542859.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_file.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 41002b4104a0f591084bd71d3eaf440de21d950c5475ae4303a33fa384a21098
Instruction ID: 330597de89cc10078b3c7bca885a588bbb667953c6add4bd1f8b13dd8a217cf9
Opcode Fuzzy Hash: 41002b4104a0f591084bd71d3eaf440de21d950c5475ae4303a33fa384a21098
Instruction Fuzzy Hash: 99F0F461101B509ED3709F399805747BEE4AF29310F048E6EE48EC7A52E375E508CBAA

Analysis Process: RegAsm.exePID: 5780, Parent PID: 6760COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	52
Total number of Limit Nodes:	7

Executed Functions

Function 02BAAE30 Relevance: 1.7, APIs: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02BAB086

Memory Dump Source

Source File: 00000002.00000002.2194482508.0000000002BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ba0000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4afd5c98d305868ebc1fba2fb5e4a1b086dd0d3f4628e19201c7f480adadb64f
Instruction ID: 9ae4b6519f2fa2f449e415508b6cc378a9e6d8c7e03f0053ddbc971fd27b5284
Opcode Fuzzy Hash: 4afd5c98d305868ebc1fba2fb5e4a1b086dd0d3f4628e19201c7f480adadb64f
Instruction Fuzzy Hash: DA8167B0A04B058FDB24DF29D55179ABBF1FF48704F00896ED49AD7A50D735E84ACBA0

Function 02BA5935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02BA59F1

Memory Dump Source

Source File: 00000002.00000002.2194482508.0000000002BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ba0000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 1416a1c5d18e7122e63b756576de98e6fee6400fc304bbe6722b516abd01daca
Instruction ID: 1d87ae20df298f29676b425bc5cab9a1a216d0907f586ee5ea523b26803ad8a0
Opcode Fuzzy Hash: 1416a1c5d18e7122e63b756576de98e6fee6400fc304bbe6722b516abd01daca
Instruction Fuzzy Hash: 1F4121B1D00619CEDB24CFA9C884BCDBBB5FF49304F24809AD019AB250DB75698ACF90

Function 02BA4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02BA59F1

Memory Dump Source

Source File: 00000002.00000002.2194482508.0000000002BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ba0000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 25ab3a623dc6de0f017b06a1b679f7ec9794759387735182bf2c224f2ddc7ac4
Instruction ID: f3829256ce7d0542b5d80f368ef56c475b92e33381b28128917ed82136cb76dc
Opcode Fuzzy Hash: 25ab3a623dc6de0f017b06a1b679f7ec9794759387735182bf2c224f2ddc7ac4
Instruction Fuzzy Hash: 394102B1D04719CFDB28CFA9C884B9DBBB5FF45304F60806AD419AB250DBB5694ACF90

Function 02BAA858 Relevance: 1.6, APIs: 1, Instructions: 77
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02BAB101,00000800,00000000,00000000), ref: 02BAB312

Memory Dump Source

Source File: 00000002.00000002.2194482508.0000000002BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ba0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: edf515517be21049c52932baa3758417a7fbbc8e9642f068b6dc7751ac20a9b7
Instruction ID: 3b7b6dc03e23c032a24c65510a742547355461e525dc9a895eb67f9e7cedc0b2
Opcode Fuzzy Hash: edf515517be21049c52932baa3758417a7fbbc8e9642f068b6dc7751ac20a9b7
Instruction Fuzzy Hash: 652188B68083888FDB11DFAAD8A4ADEBFF4EF59314F04809AD458A7211C3789545CFA1

Function 02BAC9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02BAD2C6,?,?,?,?,?), ref: 02BAD387

Memory Dump Source

Source File: 00000002.00000002.2194482508.0000000002BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ba0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7fe288a43f112a1dc81962b14b7d0241afefb0278694d30f286a760ef3e4e149
Instruction ID: 6151afc0094ef31770aac694558b6318b3e3c9ec0c235756916076dd63514d3f
Opcode Fuzzy Hash: 7fe288a43f112a1dc81962b14b7d0241afefb0278694d30f286a760ef3e4e149
Instruction Fuzzy Hash: 4C21E6B59002499FDB10CF9AD984ADEBFF4EB48310F14845AE918A3310D378A954CFA4

Function 02BAD2F9 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02BAD2C6,?,?,?,?,?), ref: 02BAD387

Memory Dump Source

Source File: 00000002.00000002.2194482508.0000000002BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ba0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 93cf3499904b668370471c668ffd4fc03a6312d9dfe2e438a5487ceec6485264
Instruction ID: 5415f41a46b7d63c8d6457a46308e1365236b75f6e4344ac73eeedad93be4f74
Opcode Fuzzy Hash: 93cf3499904b668370471c668ffd4fc03a6312d9dfe2e438a5487ceec6485264
Instruction Fuzzy Hash: AE21C4B5D002499FDB10CF99D585ADEBBF5EB48324F14845AE918B3310D378A954CFA0

Function 02BAA870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02BAB101,00000800,00000000,00000000), ref: 02BAB312

Memory Dump Source

Source File: 00000002.00000002.2194482508.0000000002BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ba0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0b68f43b6a35c6af5bcd4b977fc419f2dc5bef8d1c2efbe3f29aa8d1d9a2fa15
Instruction ID: 702003bd4663007013f605baeddb82d4242a5b8ac917d9ce64e6cbf50ea48703
Opcode Fuzzy Hash: 0b68f43b6a35c6af5bcd4b977fc419f2dc5bef8d1c2efbe3f29aa8d1d9a2fa15
Instruction Fuzzy Hash: F41103B69043499FCB10CF9AD444ADEFBF4EB58314F10846ED529A7200C378A545CFA4

Function 02BAB2A0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02BAB101,00000800,00000000,00000000), ref: 02BAB312

Memory Dump Source

Source File: 00000002.00000002.2194482508.0000000002BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ba0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9982448e48648ae85c14f9665e51578b3cb2d18d6638fad20db87bf064ecb4bf
Instruction ID: cbe3509b5bedfc4c5536217474fc571371aba75c83229d9f9d1b68343a7ee0a6
Opcode Fuzzy Hash: 9982448e48648ae85c14f9665e51578b3cb2d18d6638fad20db87bf064ecb4bf
Instruction Fuzzy Hash: F31144B69003498FCB10CFAAC444ADEFFF4EF58314F14845AD828A7200C378A545CFA0

Function 02BAB020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02BAB086

Memory Dump Source

Source File: 00000002.00000002.2194482508.0000000002BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ba0000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3fb44e3032f18488783da1e3d024e44fa01eb5f4ae02efcfe8d7418f7eae35d1
Instruction ID: 7c15219bea8630ad8edd336b9a9f25c497ac607b68baa66657418ef4470eda90
Opcode Fuzzy Hash: 3fb44e3032f18488783da1e3d024e44fa01eb5f4ae02efcfe8d7418f7eae35d1
Instruction Fuzzy Hash: CF110FB6C003498FCB20DF9AC444ADEFBF4EB88224F10845AD428B7210C379A545CFA1

Function 00FAD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2193708711.0000000000FAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fad000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 776f27d149542d860a8c31c3ebf89589da66dd54431c0e985f8ee5052c3970ba
Instruction ID: de3447eec991af7a978b05b98c8d337138e335eae7e99284145fbe2136acedf3
Opcode Fuzzy Hash: 776f27d149542d860a8c31c3ebf89589da66dd54431c0e985f8ee5052c3970ba
Instruction Fuzzy Hash: 4D2133B2500204DFDB05DF14C9C0B26BF65FB99324F20C569DD0A0B616C33AE846EAA2

Function 0100D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2193825637.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 332128dffb2f5c0bef461d1595b21f9832db03ccabdae7dce35c489318933d78
Instruction ID: 5254c3b0e4f5a529764b051552c927651a11411e50e13992f8e7e42cccded838
Opcode Fuzzy Hash: 332128dffb2f5c0bef461d1595b21f9832db03ccabdae7dce35c489318933d78
Instruction Fuzzy Hash: A0212571604200DFEB16CFA8D980B16BFA5EB84314F20C5ADE98D4B296C33AD407CB72

Function 00FAD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2193708711.0000000000FAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fad000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d586b370810bf15e8d939e07fb0dccd80900219e7a08ccebccaf9c83e80135
Instruction ID: 7ed7accb298d2cefc1cb286aadd6a58f4c261e40158ac92ef61e433af937f918
Opcode Fuzzy Hash: 07d586b370810bf15e8d939e07fb0dccd80900219e7a08ccebccaf9c83e80135
Instruction Fuzzy Hash: D81129B6804240CFDB06CF00D5C4B16BF71FB99324F24C6A9DD090B616C33AE456DBA1

Function 0100D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2193825637.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_100d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c3f0733ce8851a1589f40a5fbe057aabe2b6f8a867c37c7fcc40a2fdda36e59
Instruction ID: b5f31aa71aa851ed7b635e6d1bc4d4f948e32807313096a8549a95458e4c9cd4
Opcode Fuzzy Hash: 5c3f0733ce8851a1589f40a5fbe057aabe2b6f8a867c37c7fcc40a2fdda36e59
Instruction Fuzzy Hash: DE11D075504280CFDB12CF94D5C4B15FFA1FB44314F24C6AAE84D4B696C33AD44ACB62

Function 00FADA51 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2193708711.0000000000FAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fad000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81b3799aa5eec4a8b9169b8bc5f99db71c15ccd96bff8000824a58637215c139
Instruction ID: 5cf77812a2095e249c322662a053de3e99951b7dc41da8a35c83e153d6c569ff
Opcode Fuzzy Hash: 81b3799aa5eec4a8b9169b8bc5f99db71c15ccd96bff8000824a58637215c139
Instruction Fuzzy Hash: B9012BB15093449EE7108A15CD84B67BF98EF42334F18C469ED0A4A647C67C9C40D6B1

Function 00FADA50 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2193708711.0000000000FAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_fad000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d6564a0d91b688a37a91bae255925e98bc2f8decc1ec7f80d0297a244eb8da6
Instruction ID: 1fafa0ba9bb42338672c534da949a44409a965de2cf0cca39119cb2bd3dd22e9
Opcode Fuzzy Hash: 6d6564a0d91b688a37a91bae255925e98bc2f8decc1ec7f80d0297a244eb8da6
Instruction Fuzzy Hash: A9F0F6715093449EE7108A06CDC4B62FFA8EF52734F18C45AED084F686C2789C44CAB0

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_bcb8debaf6c6e3eea7b81188b2bf0e7b56e59ac_910c98a4_d3d94960-ed1e-43ed-9c25-2307c05e8a8c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D23.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7DE0.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E1F.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Windows Analysis Report
file.exe

Function 007E018D Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 00BA78B0 Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 311
memoryCOMMON

Function 00B8A697 Relevance: .0, Instructions: 29
COMMON

Function 00BA7E40 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 68
libraryloaderCOMMON

Function 00B88BB9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00B4C198 Relevance: 7.6, APIs: 5, Instructions: 119
COMMON

Function 00BA7D20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79
threadCOMMON

Function 00B5AEDA Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMONLIBRARYCODE

Function 00B5AC21 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 00B88C84 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Function 00BA7AF0 Relevance: 1.3, APIs: 1, Instructions: 89
memoryCOMMON