Edit tour

Windows Analysis Report
FkJbps6Srrl6lOQ9M_l8dpw2.exe

Overview

General Information

Sample name:	FkJbps6Srrl6lOQ9M_l8dpw2.exe
Analysis ID:	1483175
MD5:	b8e1a18940a4b5f002bbf04f334ee02a
SHA1:	85c3076aad3bed20ecdf94d50d4937132b7788e6
SHA256:	3a46d11a2fe4b8e7e91c0771bbd86de9c22d634ae09278f7739e57ff9725f896
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

FkJbps6Srrl6lOQ9M_l8dpw2.exe (PID: 7500 cmdline: "C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe" MD5: B8E1A18940A4B5F002BBF04F334EE02A)

conhost.exe (PID: 7508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7568 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 7576 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "51.195.145.80:14640", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.1877716871.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: FkJbps6Srrl6lOQ9M_l8dpw2.exe PID: 7500	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7576	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7576	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.FkJbps6Srrl6lOQ9M_l8dpw2.exe.4f0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:16.450766+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:17.612406+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:15.561966+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:14.647518+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 51.195.145.80 - Destination IP: 192.168.2.4

Timestamp:	2024-07-26T19:12:14.083330+0200
SID:	2046056
Source Port:	14640
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:14.468647+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:15.263507+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:17.618191+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.4

Timestamp:	2024-07-26T19:12:16.470779+0200
SID:	2022930
Source Port:	443
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:08.511418+0200
SID:	2046045
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:14.076214+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:18.967700+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:17.178429+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:13.739811+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:14.266111+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:16.274594+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:16.993990+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:16.111175+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:18.617808+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:18.431340+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:15.799653+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:19.143850+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:16.641500+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.4

Timestamp:	2024-07-26T19:12:54.830118+0200
SID:	2022930
Source Port:	443
Destination Port:	49737
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:17.353117+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 51.195.145.80 - Destination IP: 192.168.2.4

Timestamp:	2024-07-26T19:12:08.705205+0200
SID:	2043234
Source Port:	14640
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:18.794183+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:19.351668+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.195.145.80

Timestamp:	2024-07-26T19:12:16.819493+0200
SID:	2043231
Source Port:	49730
Destination Port:	14640
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: FkJbps6Srrl6lOQ9M_l8dpw2.exe

Avira: detected

Found malware configuration

Source: 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "51.195.145.80:14640", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Multi AV Scanner detection for submitted file

Source: FkJbps6Srrl6lOQ9M_l8dpw2.exe

ReversingLabs: Detection: 79%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: FkJbps6Srrl6lOQ9M_l8dpw2.exe

Joe Sandbox ML: detected

Source: FkJbps6Srrl6lOQ9M_l8dpw2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: FkJbps6Srrl6lOQ9M_l8dpw2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe

Code function: 0_2_0050ACA1 FindFirstFileExW,

0_2_0050ACA1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4x nop then jmp 074F0538h

3_2_074F0040

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 51.195.145.80:14640

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 51.195.145.80:14640

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.145.80

Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002BFE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002AF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002CDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002AF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002AF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002AF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002AF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002AF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002AF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002CE6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: FkJbps6Srrl6lOQ9M_l8dpw2.exe, 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1877716871.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpBEFD.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpBEEC.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: 0_2_0050A066	0_2_0050A066
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: 0_2_005011D0	0_2_005011D0
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: 0_2_0050D552	0_2_0050D552
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: 0_2_00505D32	0_2_00505D32
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: 0_2_0050EDCE	0_2_0050EDCE
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: 0_2_004FE7B4	0_2_004FE7B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0270DC74	3_2_0270DC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_064467D8	3_2_064467D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0644A3E8	3_2_0644A3E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06443F50	3_2_06443F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0644A3D8	3_2_0644A3D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06446FE8	3_2_06446FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06446FF8	3_2_06446FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_074FB4A0	3_2_074FB4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_074F0040	3_2_074F0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_074F1F98	3_2_074F1F98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_074FEDD8	3_2_074FEDD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_074F7B48	3_2_074F7B48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_074F2BA8	3_2_074F2BA8

Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe

Code function: String function: 004F8970 appears 50 times

Source: FkJbps6Srrl6lOQ9M_l8dpw2.exe, 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenameHandiworks.exe8 vs FkJbps6Srrl6lOQ9M_l8dpw2.exe

Source: FkJbps6Srrl6lOQ9M_l8dpw2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/5@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7508:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\TmpBEEC.tmp

Jump to behavior

Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe

Command line argument: 2Q

0_2_00513240

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: FkJbps6Srrl6lOQ9M_l8dpw2.exe

ReversingLabs: Detection: 79%

Source: unknown	Process created: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe "C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe"
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.3.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: FkJbps6Srrl6lOQ9M_l8dpw2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: FkJbps6Srrl6lOQ9M_l8dpw2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: FkJbps6Srrl6lOQ9M_l8dpw2.exe

Static PE information: section name: .zzZ

Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: 0_2_004F8115 push ecx; ret	0_2_004F8128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0644E060 push es; ret	3_2_0644E070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0644ECF2 push eax; ret	3_2_0644ED01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06443B4F push dword ptr [esp+ecx*2-75h]; ret	3_2_06443B53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_064449A6 push FFFFFF8Bh; retf	3_2_064449AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_074FB360 push FFFFFF8Bh; iretd	3_2_074FB363
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_074FB371 push FFFFFF8Bh; iretd	3_2_074FB402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_074FB31B push FFFFFF8Bh; iretd	3_2_074FB31E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_074FB3FF push FFFFFF8Bh; iretd	3_2_074FB402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_074F2B68 push ds; ret	3_2_074F2BF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_074F0BE0 push eax; retf	3_2_074F0BE1

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 26E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 29C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 49C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1130			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 5696			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7832	Thread sleep time: -16602069666338586s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7596	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe

Code function: 0_2_0050ACA1 FindFirstFileExW,

0_2_0050ACA1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: RegAsm.exe, 00000003.00000002.1886318047.0000000005F72000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe

Code function: 0_2_004FC783 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_004FC783

Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: 0_2_0050203F mov ecx, dword ptr fs:[00000030h]		0_2_0050203F
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: 0_2_00506B75 mov eax, dword ptr fs:[00000030h]		0_2_00506B75

Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe

Code function: 0_2_0050BE89 GetProcessHeap,

0_2_0050BE89

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: 0_2_004F88FE SetUnhandledExceptionFilter,	0_2_004F88FE
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: 0_2_004F89B5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004F89B5
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: 0_2_004FC783 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004FC783
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: 0_2_004F87A2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004F87A2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe

Code function: 0_2_00B1018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_00B1018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000	Jump to behavior
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 9C9008	Jump to behavior

Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior

Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe

Code function: 0_2_004F8565 cpuid

0_2_004F8565

Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: GetLocaleInfoW,	0_2_0050E107
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: EnumSystemLocalesW,	0_2_00505185
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0050E230
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0050DAA1
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: GetLocaleInfoW,	0_2_0050E336
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0050E405
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: GetLocaleInfoW,	0_2_0050DC9C
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: EnumSystemLocalesW,	0_2_0050DD43
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: EnumSystemLocalesW,	0_2_0050DD8E
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: EnumSystemLocalesW,	0_2_0050DE29
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0050DEB4
Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe	Code function: GetLocaleInfoW,	0_2_005056AB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe

Code function: 0_2_004F8BB2 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_004F8BB2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FkJbps6Srrl6lOQ9M_l8dpw2.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1877716871.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FkJbps6Srrl6lOQ9M_l8dpw2.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7576, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\walletsLR^q
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002CE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR^q
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR^q
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR^q
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `,^qdC:\Users\user\AppData\Roaming`,^qdC:\Users\user\AppData\Roaming\Binance
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR^q
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q&%localappdata%\Coinomi\Coinomi\walletsLR^q(
Source: RegAsm.exe, 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7576, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FkJbps6Srrl6lOQ9M_l8dpw2.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1877716871.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FkJbps6Srrl6lOQ9M_l8dpw2.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7576, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	241 Security Software Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Install Root Certificate	DCSync	134 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
FkJbps6Srrl6lOQ9M_l8dpw2.exe	79%	ReversingLabs	Win32.Spyware.Metastealer
FkJbps6Srrl6lOQ9M_l8dpw2.exe	100%	Avira	HEUR/AGEN.1317026
FkJbps6Srrl6lOQ9M_l8dpw2.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23ResponseD	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	URL Reputation	safe
http://tempuri.org/Entity/Id4	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11ResponseD	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	0%	Avira URL Cloud	safe
51.195.145.80:14640	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
51.195.145.80:14640	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14ResponseD	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	RegAsm.exe, 00000003.00000002.1880460942.0000000002AF5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12Response	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21Response	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id4	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id7	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19Response	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13ResponseD	RegAsm.exe, 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15Response	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	RegAsm.exe, 00000003.00000002.1880460942.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6Response	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	FkJbps6Srrl6lOQ9M_l8dpw2.exe, 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1877716871.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9Response	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id20	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002AF5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24Response	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21ResponseD	RegAsm.exe, 00000003.00000002.1880460942.0000000002AF5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002C4E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16Response	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002CDE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id18	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Response	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15ResponseD	RegAsm.exe, 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10Response	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11ResponseD	RegAsm.exe, 00000003.00000002.1880460942.0000000002BFE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8Response	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17ResponseD	RegAsm.exe, 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	RegAsm.exe, 00000003.00000002.1880460942.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8ResponseD	RegAsm.exe, 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1880460942.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	RegAsm.exe, 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
51.195.145.80	unknown	France		16276	OVHFR	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483175
Start date and time:	2024-07-26 19:11:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FkJbps6Srrl6lOQ9M_l8dpw2.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 108 Number of non-executed functions: 62
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: FkJbps6Srrl6lOQ9M_l8dpw2.exe

Simulations

Behavior and APIs

Time	Type	Description
13:12:14	API Interceptor	35x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51.195.145.80	file.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	VvlYJBzLuW.elf	Get hash	malicious	Mirai	Browse	37.59.105.215
	7Y18r(169).exe	Get hash	malicious	CryptOne	Browse	51.81.194.202
	Endermanch@Antivirus.exe	Get hash	malicious	Bdaejec	Browse	54.39.157.64
	Endermanch@Antivirus.exe	Get hash	malicious	Bdaejec	Browse	54.39.157.64
	file.exe	Get hash	malicious	SystemBC	Browse	144.217.158.194
	file.exe	Get hash	malicious	SmokeLoader	Browse	51.77.140.74
	file.exe	Get hash	malicious	SystemBC	Browse	192.99.8.97
	LisectAVT_2403002A_126.EXE.exe	Get hash	malicious	Wannacry, Conti	Browse	167.114.35.28
	https://erratic-mellow-comte.glitch.me/public/nfcu703553.HTML	Get hash	malicious	HTMLPhisher	Browse	54.36.150.187
	LisectAVT_2403002A_212.exe	Get hash	malicious	Unknown	Browse	51.38.37.194

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:31 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.453088564969748
Encrypted:	false
SSDEEP:	48:8SUEdATkoGRYrnvPdAKRkdAGdAKRFdAKR/U:8SU3t
MD5:	303F26E8901B19E5C3A6EF0A630CCDE4
SHA1:	6C0ABAE28D0648A00B167F6A450FABF9BAD649EA
SHA-256:	3B1D09E942CDA11DB9E240E5C16B5E970756C2AAA1750559ACBE92EE3386A789
SHA-512:	FE04F79802E1DB68C88D70320113B9B2B449934B0250C3EC40DE262AF2F8DF6132312F7ECD44FAE66D306E61E74259BBCA4840A93D06BF5415F8C3547B79A348
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,.....nN........q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW5`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWP`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWP`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWP`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDWI`..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\TmpBEEC.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpBEFD.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.640847153729353
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FkJbps6Srrl6lOQ9M_l8dpw2.exe
File size:	521'216 bytes
MD5:	b8e1a18940a4b5f002bbf04f334ee02a
SHA1:	85c3076aad3bed20ecdf94d50d4937132b7788e6
SHA256:	3a46d11a2fe4b8e7e91c0771bbd86de9c22d634ae09278f7739e57ff9725f896
SHA512:	1f3e237b9b9228cabd5a1469d29b5bbc934928502cb5c0427a002d9846c8582574c8d7a4441e321e696732b8b2bf79b779b2f050037c02a53aa8c155fa434d86
SSDEEP:	12288:q88sCGxeImxxbTuylGHljSEqFT/fYUA3BVyt0I4ZCdf:q9rGxDmxxbToHljoffA3BVGmkf
TLSH:	6FB4F12275C08073E62715320AF4D6B56A7EF8714E764E8FA7980BBE4F30283D625667
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g.X.............t.......t.......t.......t..............n.......n.......n......._......._......._.......Rich...................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x408441
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A28656 [Thu Jul 25 17:07:34 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	6addd02d82538c2ca23958c8c292883b

Entrypoint Preview

Instruction
call 00007F5B006AAD9Eh
jmp 00007F5B006AA459h
int3
int3
int3
int3
int3
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 0Fh
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F5B006AAE8Fh
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 07h
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F5B006AAE79h
int3
int3
int3
int3
push ebx
push esi
mov eax, dword ptr [esp+18h]
or eax, eax
jne 00007F5B006AA5FAh
mov ecx, dword ptr [esp+14h]
mov eax, dword ptr [esp+10h]
xor edx, edx
div ecx
mov ebx, eax
mov eax, dword ptr [esp+0Ch]
div ecx
mov edx, ebx
jmp 00007F5B006AA623h
mov ecx, eax
mov ebx, dword ptr [esp+14h]
mov edx, dword ptr [esp+10h]
mov eax, dword ptr [esp+0Ch]
shr ecx, 1
rcr ebx, 1
shr edx, 1
rcr eax, 1
or ecx, ecx
jne 00007F5B006AA5D6h
div ebx
mov esi, eax
mul dword ptr [esp+18h]
mov ecx, eax
mov eax, dword ptr [esp+14h]
mul esi
add edx, ecx
jc 00007F5B006AA5F0h
cmp edx, dword ptr [esp+10h]
jnbe 00007F5B006AA5EAh
jc 00007F5B006AA5E9h
cmp eax, dword ptr [esp+0Ch]
jbe 00007F5B006AA5E3h
dec esi
xor edx, edx
mov eax, esi
pop esi
pop ebx
retn 0010h
int3
int3
int3
int3
int3
int3
int3
int3
push ebx
mov eax, dword ptr [esp+14h]
or eax, eax
jne 00007F5B006AA5FAh
mov ecx, dword ptr [esp+10h]
mov eax, dword ptr [esp+0Ch]
xor edx, edx
div ecx
mov eax, dword ptr [esp+08h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x309c0	0xb8	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x30a78	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81000	0x205c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2df48	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2df80	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2de88	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x26000	0x16c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x23147	0x23200	0b0b57e0ce9a423636e86ab68d22d4c2	False	0.5813431383451957	data	6.630273197897779	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.zzZ	0x25000	0x720	0x800	9a7794508ff1d41f86a95c6eab08a54b	False	0.66796875	data	6.14904307986081	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x26000	0xb2f2	0xb400	10aa0234a4d25732d9e0c491c2c1fab9	False	0.42233072916666664	data	4.896205233219445	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x32000	0x4eebc	0x4e000	90632f44191988318a330a51a653f0f5	False	0.981864733573718	data	7.9871661512615555	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x81000	0x205c	0x2200	d54c3d32de6655445e95ecba5e9b2d65	False	0.7157628676470589	data	6.397411674681506	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

WaitForSingleObject, CreateThread, VirtualAllocEx, FreeConsole, RaiseException, InitOnceBeginInitialize, InitOnceComplete, CloseHandle, GetCurrentThreadId, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, GetLastError, FreeLibraryWhenCallbackReturns, CreateThreadpoolWork, SubmitThreadpoolWork, CloseThreadpoolWork, GetModuleHandleExW, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, QueryPerformanceCounter, EncodePointer, DecodePointer, MultiByteToWideChar, WideCharToMultiByte, LCMapStringEx, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetStringTypeW, GetCPInfo, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, InitializeSListHead, CreateFileW, RtlUnwind, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleFileNameW, GetStdHandle, WriteFile, GetCommandLineA, GetCommandLineW, HeapFree, HeapAlloc, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, GetFileSizeEx, SetFilePointerEx, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetProcessHeap, SetStdHandle, HeapSize, WriteConsoleW

Exports

Name	Ordinal	Address
QuitMessageStr	1	0x42570f
_QuitMessageStr	2	0x42570f
_QuitMessageStr2	3	0x42570f
_QuitMessageStr3	4	0x42570f
_QuitMessageStr4	5	0x42570f

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T19:12:16.450766+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:17.612406+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:15.561966+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:14.647518+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:14.083330+0200	TCP	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	14640	49730	51.195.145.80	192.168.2.4
2024-07-26T19:12:14.468647+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:15.263507+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:17.618191+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:16.470779+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49731	52.165.165.26	192.168.2.4
2024-07-26T19:12:08.511418+0200	TCP	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:14.076214+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:18.967700+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:17.178429+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:13.739811+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:14.266111+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:16.274594+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:16.993990+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:16.111175+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:18.617808+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:18.431340+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:15.799653+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:19.143850+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:16.641500+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:54.830118+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49737	52.165.165.26	192.168.2.4
2024-07-26T19:12:17.353117+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:08.705205+0200	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	14640	49730	51.195.145.80	192.168.2.4
2024-07-26T19:12:18.794183+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:19.351668+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80
2024-07-26T19:12:16.819493+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49730	14640	192.168.2.4	51.195.145.80

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 19:11:58.463174105 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:11:58.851711035 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:11:58.851804018 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:11:58.859029055 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:11:58.866660118 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:08.487121105 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:08.511418104 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:08.516580105 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:08.705204964 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:08.751910925 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:13.739810944 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:13.746704102 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:13.957674026 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:13.957698107 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:13.957714081 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:13.957849026 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:13.957876921 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:13.957895041 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:13.957931995 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:14.001903057 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:14.076214075 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:14.083329916 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:14.255369902 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:14.266110897 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:14.271460056 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:14.438594103 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:14.468647003 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:14.473778963 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:14.640705109 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:14.647517920 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:14.652625084 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:14.652640104 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:14.652652979 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:14.652880907 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:14.652894020 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:14.653265953 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:14.896280050 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:14.939393997 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:15.263506889 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:15.268640041 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:15.268662930 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:15.268872976 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:15.534457922 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:15.561965942 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:15.567198038 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:15.734452009 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:15.783068895 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:15.799653053 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:15.804851055 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:15.804864883 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:15.804888010 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:15.804898977 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:15.804909945 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:15.805258989 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:15.805270910 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:15.805280924 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:15.805301905 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:15.805685043 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:15.809808016 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:15.809819937 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:15.809830904 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:15.809853077 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:15.809864044 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:16.064096928 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:16.111175060 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:16.274594069 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:16.279577017 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:16.447477102 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:16.450766087 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:16.455965996 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:16.636600018 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:16.641499996 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:16.647916079 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:16.815555096 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:16.819493055 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:16.824507952 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:16.992389917 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:16.993989944 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:16.999121904 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.176567078 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.178428888 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.183403969 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.352174044 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.353116989 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.358477116 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.539006948 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.580029964 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.612406015 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.618007898 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.618068933 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.618108988 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.618146896 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.618191004 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.618258953 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.618299961 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.618339062 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.618386030 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.618447065 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.618488073 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.618520975 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.618545055 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.618575096 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.618614912 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.618643999 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.618664980 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.618721962 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.618762970 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.618784904 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.618814945 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.618844986 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.618885040 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.618921995 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.618959904 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.618988037 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.619035006 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.619069099 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.619118929 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.619138956 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.619165897 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.622442007 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.622483969 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.622522116 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.622550964 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.622582912 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.622679949 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.622720003 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.622764111 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.622802973 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.622839928 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.622868061 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.622896910 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.622950077 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.622980118 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.623027086 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.623045921 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.623071909 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.623107910 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.623161077 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.625206947 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.625273943 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.625317097 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.625384092 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.625422001 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.625462055 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.625500917 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.625561953 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.625603914 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.625643969 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.625680923 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.625720978 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.625758886 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.625796080 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.625833988 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.625871897 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.625909090 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.625967979 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.626013994 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.626053095 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.626091003 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.626128912 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.626168966 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.626208067 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.626245022 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.626336098 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.626442909 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.626482964 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.626519918 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.626557112 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.626589060 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.626622915 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.626652956 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.626692057 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.626718998 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.626741886 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.626770973 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.626820087 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.626840115 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.626887083 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.626907110 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.626951933 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.626981974 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.627027988 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.627048016 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.627084017 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.627207041 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.627245903 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.627305984 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.627345085 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.627382040 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.627424002 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.628076077 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.628119946 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.628557920 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.629725933 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.629793882 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.629833937 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.629873037 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.629933119 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.629973888 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.630011082 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.630050898 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.630090952 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.630152941 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.630193949 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.630233049 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.630270958 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.630307913 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.630346060 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.630383015 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.630419970 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.630459070 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.631989002 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.632240057 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.632299900 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.632359028 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.632421970 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.632462025 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.632549047 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.632610083 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.632649899 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.632689953 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.632726908 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.632766962 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.632806063 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.632843971 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.632880926 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.632917881 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.632977009 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.633094072 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.633212090 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.633249044 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.633289099 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.633327007 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.633366108 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.633404016 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.633443117 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.633480072 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.633517027 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.633553982 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.633593082 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.633630991 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.633667946 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.633704901 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.633744955 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.633781910 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.633821011 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.633881092 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.633919954 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.633958101 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.634001970 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.634041071 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.634079933 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.634118080 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.634155989 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.634195089 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.634232998 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.634269953 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.634308100 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.634345055 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.634382963 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.634419918 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.634459972 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.634499073 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.634994984 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.635056019 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.635093927 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.635153055 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.635194063 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.635230064 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.635289907 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.635329962 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.635369062 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.635406017 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.635443926 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.635483027 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.636042118 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.636333942 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.636454105 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.639574051 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.639591932 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.639606953 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.639626026 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.639652967 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.639669895 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.639687061 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.639703989 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.639724016 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.639796019 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.639955044 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.639972925 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.639992952 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640008926 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640037060 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640055895 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640074015 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640101910 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640117884 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640134096 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640614033 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640625954 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640649080 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640669107 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640747070 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640763044 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640782118 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640798092 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640815020 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640841961 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640858889 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640875101 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640891075 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640907049 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640933990 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640949965 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640965939 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640981913 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.640997887 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641016960 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641036987 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641063929 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641079903 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641096115 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641112089 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641128063 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641144037 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641172886 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641190052 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641206026 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641223907 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641243935 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641259909 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641275883 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641422033 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641508102 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.641578913 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.641612053 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641628981 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641644001 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641661882 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641680002 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641714096 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641907930 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641937017 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641952991 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.641985893 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642004013 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642020941 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642040968 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642067909 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642091990 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642108917 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642137051 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642167091 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642184973 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642227888 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642240047 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642256975 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642272949 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642288923 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642326117 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642342091 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642357111 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642374992 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642391920 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642407894 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642433882 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642448902 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642467022 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642482996 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642502069 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642517090 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642534971 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642550945 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642565012 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642592907 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642608881 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642625093 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642641068 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642668009 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642683983 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642700911 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642716885 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642731905 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642759085 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642775059 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642791033 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642808914 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.642843008 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.643250942 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.643321037 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.646960020 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.646976948 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.646996021 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.647006989 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.647031069 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.647135973 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.647160053 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.647178888 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.647207022 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.647224903 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.647346020 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.647373915 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.647578955 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.647655964 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.647814989 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.647846937 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.647936106 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.648035049 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.648179054 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.648267031 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.648448944 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.648479939 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.648545980 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.648617983 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.648745060 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.648823023 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.648868084 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.648897886 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.648926020 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.648955107 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.648988008 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649075031 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649106026 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649135113 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649169922 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649199963 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649245977 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649291992 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649322033 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649349928 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649394989 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649424076 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649451971 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649497032 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649525881 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649554014 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649583101 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649611950 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649656057 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649686098 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649713993 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649741888 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649770021 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649797916 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649825096 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649852991 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649882078 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.649986982 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.650088072 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.650111914 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650161028 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650191069 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650219917 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650248051 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650275946 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650305033 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650335073 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650362968 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650391102 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650419950 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650449038 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650476933 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650504112 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650532007 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650559902 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650587082 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650614977 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650644064 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650672913 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650701046 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650727987 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650755882 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650788069 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650834084 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650863886 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650892019 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650919914 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650948048 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.650975943 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651005983 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651034117 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651062012 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651091099 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651120901 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651149988 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651179075 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651207924 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651237011 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651264906 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651293039 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651324987 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651354074 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651381969 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651411057 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651437998 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651465893 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651494026 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651525974 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651559114 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.651961088 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.652053118 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.656464100 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.656518936 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.656563997 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.656594038 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.656621933 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.656670094 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.656698942 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.656728029 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.656754971 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.656784058 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.656830072 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.656858921 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.656888962 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.656917095 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.656944990 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.656972885 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657001972 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657031059 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657058954 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657087088 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657115936 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657143116 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657191038 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657221079 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657248974 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657277107 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657304049 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657332897 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657361031 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657388926 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657418013 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657444954 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657474041 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657502890 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657531977 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657560110 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657589912 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657618999 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657646894 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657675982 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657705069 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657736063 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657783985 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657814026 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657843113 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657871008 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657900095 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657927990 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657955885 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.657984018 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658011913 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658039093 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658066988 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658102989 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658133030 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658163071 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658191919 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658220053 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658247948 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658276081 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658303022 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658333063 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658363104 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658396959 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658425093 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658452988 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658545971 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.658655882 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.658684015 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658737898 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658768892 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658797026 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658824921 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658853054 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658880949 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658909082 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658936024 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658963919 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.658992052 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.659019947 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.659048080 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.659075022 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.659102917 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.659131050 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.659158945 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.659188986 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.659215927 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.659243107 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.659274101 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.659302950 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.659332037 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.659358978 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.705014944 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.705996990 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.708645105 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.710484028 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.714113951 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.714159012 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.714200020 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.714238882 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.714277029 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.714314938 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.714379072 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.714417934 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.714454889 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.714493036 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.714533091 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.714570045 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.714607954 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.714644909 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.714687109 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:17.736183882 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:17.741437912 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:18.363580942 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:18.408159018 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:18.431339979 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:18.436512947 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:18.616229057 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:18.617808104 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:18.623197079 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:18.791838884 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:18.794183016 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:18.799565077 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:18.967200994 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:18.967700005 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:18.973292112 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:19.143217087 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:19.143850088 CEST	49730	14640	192.168.2.4	51.195.145.80
Jul 26, 2024 19:12:19.150823116 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:19.320058107 CEST	14640	49730	51.195.145.80	192.168.2.4
Jul 26, 2024 19:12:19.351667881 CEST	49730	14640	192.168.2.4	51.195.145.80

Target ID:	0
Start time:	13:11:55
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FkJbps6Srrl6lOQ9M_l8dpw2.exe"
Imagebase:	0x4f0000
File size:	521'216 bytes
MD5 hash:	B8E1A18940A4B5F002BBF04F334EE02A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:11:56
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:11:56
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x2f0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:11:56
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x720000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.1877716871.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1880460942.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1880460942.0000000002CF9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.5%
Total number of Nodes:	1784
Total number of Limit Nodes:	40

Executed Functions

Function 00B1018D Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00B100FF,00B100EF), ref: 00B102FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00B1030F
Wow64GetThreadContext.KERNEL32(0000010C,00000000), ref: 00B1032D
ReadProcessMemory.KERNELBASE(00000108,?,00B10143,00000004,00000000), ref: 00B10351
VirtualAllocEx.KERNELBASE(00000108,?,?,00003000,00000040), ref: 00B1037C
TerminateProcess.KERNELBASE(00000108,00000000), ref: 00B1039B
WriteProcessMemory.KERNELBASE(00000108,00000000,?,?,00000000,?), ref: 00B103D4
WriteProcessMemory.KERNELBASE(00000108,00400000,?,?,00000000,?,00000028), ref: 00B1041F
WriteProcessMemory.KERNELBASE(00000108,-00000008,?,00000004,00000000), ref: 00B1045D
Wow64SetThreadContext.KERNEL32(0000010C,01140000), ref: 00B10499
ResumeThread.KERNELBASE(0000010C), ref: 00B104A8

Strings

SetThreadContext, xrefs: 00B102B3
ResumeThread, xrefs: 00B102C9
WriteProcessMemory, xrefs: 00B102A0
Load, xrefs: 00B101CB
GetThreadContext, xrefs: 00B10267
CreateProcessA, xrefs: 00B10241
VirtualAllocEx, xrefs: 00B1028D
ress, xrefs: 00B10217
VirtualAlloc, xrefs: 00B10254
ReadProcessMemory, xrefs: 00B1027A
TerminateProcess, xrefs: 00B1038B
aryA, xrefs: 00B101D3
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 00B102FB
GetP, xrefs: 00B1020F

Memory Dump Source

Source File: 00000000.00000002.1655580724.0000000000B10000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: ff142b80bf04cc79fcd6951d21412f731658c8d0b289f7f32580f0f99735f513
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: B5B1E57660028AAFDB60CF68CC80BDA77A5FF88714F158564EA0CEB341D774FA518B94

Function 00506B75 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 913097a76a2aa3f9716249509b8196a2f4b16ccbac58342a843d0fa289859693
Instruction ID: 28493dca41f52c00c777af6d00f2007a2c4ab279fadcf7c3e118e221ba0702c5
Opcode Fuzzy Hash: 913097a76a2aa3f9716249509b8196a2f4b16ccbac58342a843d0fa289859693
Instruction Fuzzy Hash: 3AE08C72911228EBCB14DB8CC949D8EF7ECFB84B01F110096B501D3140C670DE00CBD0

Function 0050203F Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 857f0d7d492d1b07fb02e0609ce517428c09b40ad8e6f1d21a06a0ac5173a7a1
Instruction ID: 6516ff5340c01fd628804a7dccd1926f3164ef191014196f1b46209c137f14e3
Opcode Fuzzy Hash: 857f0d7d492d1b07fb02e0609ce517428c09b40ad8e6f1d21a06a0ac5173a7a1
Instruction Fuzzy Hash: D3C08C34000A1086CE398910C27D3AE3764B3D1782F80048CC46A4B6C6CA6F9D83D641

Function 0050534E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,0050545B,?,?,004F4EC6,00000000,?,?,00505685,00000021,FlsSetValue,0051A2C0,0051A2C8,004F4EC6), ref: 0050540F

Strings

api-ms-, xrefs: 005053A5
ext-ms-, xrefs: 005053B9

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: c6c75e1d8f8a1e432678b9f93716e00613451cae3cf0b1f048f6f83597a54232
Instruction ID: 6bcb7c9d07bb31254dec06e306cc5a534505099909764f760edb14a9720e78b8
Opcode Fuzzy Hash: c6c75e1d8f8a1e432678b9f93716e00613451cae3cf0b1f048f6f83597a54232
Instruction Fuzzy Hash: 7121C675A01615A7C7219F24AC45ADF3BA8FB517A0F250520F906A72D0E6B0ED04DEA0

Function 00507849 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 005078D0
__alloca_probe_16.LIBCMT ref: 00507991
__freea.LIBCMT ref: 005079F8

Part of subcall function 00505BDF: RtlAllocateHeap.NTDLL(00000000,004F4EC6,?,?,004F930A,?,?,?,?,?,004F2617,004F4EC6,?,?,?,?), ref: 00505C11

__freea.LIBCMT ref: 00507A0D
__freea.LIBCMT ref: 00507A1D

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: b8655a539676166a65a99d69e0f77527858cd13b4fb540157e6ff104460ece08
Instruction ID: 1246d14e91778276ce2e83eb085b6c00746bdb6ed892d9125b0e54239d0a8418
Opcode Fuzzy Hash: b8655a539676166a65a99d69e0f77527858cd13b4fb540157e6ff104460ece08
Instruction Fuzzy Hash: C851B372A0421EAFEB219E65CC45EBF3FA9FF48354B154929FD04D7191E634ED1087A0

Function 0051554F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004F13CB: __EH_prolog3_catch.LIBCMT ref: 004F13D2
Part of subcall function 004F13CB: _strlen.LIBCMT ref: 004F13E4

Part of subcall function 004F1920: __EH_prolog3_catch.LIBCMT ref: 004F1927

_Deallocate.LIBCONCRT ref: 00515606

Strings

Own head, xrefs: 00515595
Earth, xrefs: 005155B0
,sQ, xrefs: 0051557F, 0051559A, 005155B5

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: H_prolog3_catch$Deallocate_strlen
String ID: ,sQ$Earth$Own head
API String ID: 1170754441-1411447988
Opcode ID: 11da8c66abc51a76ef9a8fef648f6c999cd6b13b7e02e7bf2456421c70cf2953
Instruction ID: 8a37a0c2afd32bc19181a72f684355ce99403cb1218a7caa524db4e3249fd19d
Opcode Fuzzy Hash: 11da8c66abc51a76ef9a8fef648f6c999cd6b13b7e02e7bf2456421c70cf2953
Instruction Fuzzy Hash: 6D21B572409786AED300EF399841CAFFFE8B995308F941A1EF49052116D635E649CBA6

Function 00515653 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004F217E: _strlen.LIBCMT ref: 004F2196

VirtualAllocEx.KERNELBASE(?,00000000,000004AC,00001000,00000040,0000000006:1@0000000005:@), ref: 0051569D

Strings

0 R, xrefs: 005156DC
0000000006:1@0000000005:@, xrefs: 00515666

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: AllocVirtual_strlen
String ID: 0 R$0000000006:1@0000000005:@
API String ID: 3554592677-168714497
Opcode ID: a6f16eca5abaab094aeb7b5792c9aa23a41c0abe4111f960812101fe487c43c8
Instruction ID: 5ca03ff2a255af5832527f5a1805ed0ef7458f5c85c404c81049ab8948eeb909
Opcode Fuzzy Hash: a6f16eca5abaab094aeb7b5792c9aa23a41c0abe4111f960812101fe487c43c8
Instruction Fuzzy Hash: 01110831A0120CAAEB14EBA5DC42FFE7B74AFD4764F50011EF201761C1EEB85D4586A8

Function 00501FC8 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00501FC2,00000016,004FC782,?,?,25454A19,004FC782,?), ref: 00501FD9
TerminateProcess.KERNEL32(00000000,?,00501FC2,00000016,004FC782,?,?,25454A19,004FC782,?), ref: 00501FE0
ExitProcess.KERNEL32 ref: 00501FF2

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 289b408a35eb03f6177a8b1e71a3f0235a823d26eb0b467900c03838a46c27dc
Instruction ID: ff9cd448253380568fc438fe61ee16fba056b4a8e8ba0b0a67f1929f0c84a4bf
Opcode Fuzzy Hash: 289b408a35eb03f6177a8b1e71a3f0235a823d26eb0b467900c03838a46c27dc
Instruction Fuzzy Hash: A9D09239405209AFCF216FA1DC0D99D3F2ABF98395B458014B90D8A1B2DB31999AEA94

Function 005086C8 Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00507E12: GetConsoleOutputCP.KERNEL32(25454A19,00000000,00000000,00000000), ref: 00507E75

WriteFile.KERNEL32(?,00000000,00000000,004FFDC0,00000000,00000000,00000000,00000000,00000000,?,004FFDC0,00000000,00000000,005204B0,00000010,00000000), ref: 00508831
GetLastError.KERNEL32(?,004FFDC0,00000000,00000000,005204B0,00000010,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0050883B

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 57a0eaa371e1feed2bfb895c8dd203d513fd368651264a6f16976e548e1931e8
Instruction ID: f2339aff6a67093662763e44d4311212e32a7356688f891ed2c170efb181b137
Opcode Fuzzy Hash: 57a0eaa371e1feed2bfb895c8dd203d513fd368651264a6f16976e548e1931e8
Instruction Fuzzy Hash: 5C61A1B1D00149AEDF118FA8C888EFEBFB9BF49304F144485E984A7296DB36D945CB60

Function 0050B74D Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0050B27D: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 0050B2A8

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,0050B594,?,00000000,?,00000000,?), ref: 0050B7AE
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,0050B594,?,00000000,?,00000000,?), ref: 0050B7F0

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 7061e7d955e02b054971ab5d16bc06bb82c8f26b88d3b9528ed16914065fd181
Instruction ID: 72491ec2b53a33a1b9d0064b829351e2b5f4c3d57c69d4183aaf2c86728371fb
Opcode Fuzzy Hash: 7061e7d955e02b054971ab5d16bc06bb82c8f26b88d3b9528ed16914065fd181
Instruction Fuzzy Hash: 07510270E002458EEB20CF36C8D16AEBFF8FF95304F18856ED0968B2A2E7759945CB50

Function 004F13CB Relevance: 3.1, APIs: 2, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 004F13D2
_strlen.LIBCMT ref: 004F13E4

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: H_prolog3_catch_strlen
String ID:
API String ID: 3133806014-0
Opcode ID: 3706da750823c34a50ce6f58ed02f129f9f7702d387f24b14595da481fe6c744
Instruction ID: 279f1d2a967825e0afe9d410f7ca93a7eedfcd0b2e0af8ca8c2d3a129ff0b3be
Opcode Fuzzy Hash: 3706da750823c34a50ce6f58ed02f129f9f7702d387f24b14595da481fe6c744
Instruction Fuzzy Hash: 89516171E00518CFCB20DF68C9809BDB7F1AF88328B25425BEA25EB3A2D635DD41CB55

Function 005082CA Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,00000000,?,00508817,?,00000000,00000000,00000000,00000000,00000000), ref: 00508366
GetLastError.KERNEL32(?,00508817,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,004FFDC0,00000000,00000000,005204B0,00000010), ref: 0050838C

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: c2b37459d17fcbd83ea3ffa0a3948da1c807e09e25998419b00e373b888601cb
Instruction ID: 9154e6c1837187e7058bfe214c8fa9a31ba58397d17d8f8eff9c6e41c7443131
Opcode Fuzzy Hash: c2b37459d17fcbd83ea3ffa0a3948da1c807e09e25998419b00e373b888601cb
Instruction Fuzzy Hash: 55218034A00219DFCF15CF29DC809EDBBB9FB98705F1448AAEA46D7251DA30DE46CB64

Function 00505AA3 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00505AEF
GetFileType.KERNELBASE(00000000), ref: 00505B01

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 67a181ce7d8c238e83b85cc586ca71d3baf48231d6b65af90ace1a78c9d34bad
Instruction ID: 7361d73ab4f51d8c9fff6ad31f4b6111bfb1fb9764e54f19c48226975ac64c30
Opcode Fuzzy Hash: 67a181ce7d8c238e83b85cc586ca71d3baf48231d6b65af90ace1a78c9d34bad
Instruction Fuzzy Hash: CF118131204F518AC7308E3E9CC862BBE95F756331B380B1AD4B7865F1E630E886EE50

Function 005057E8 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00507937,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0050581C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00507937,?,?,00000000,?,00000000), ref: 0050583A

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: c4458336f5802c235be92d0f6f49c1da858bd9d5ca862270669d990275972f27
Instruction ID: 4873f37fdd434139f8e241d352548bf714ecf2181d7879078745e37aacc6e738
Opcode Fuzzy Hash: c4458336f5802c235be92d0f6f49c1da858bd9d5ca862270669d990275972f27
Instruction Fuzzy Hash: D0F0643240051AFBCF126F90DC09ADE3F26FF483A0B158020FE1865061DB36D932AF94

Function 00515637 Relevance: 3.0, APIs: 2, Instructions: 12
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00025653,00000000,00000000,00000000), ref: 00515643
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0051564C

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleThreadWait
String ID:
API String ID: 1891408510-0
Opcode ID: 33843fb27ef57f7669a312ab3ce424a076af5fc682d66f1bfa97f3dad38a45df
Instruction ID: a1525cb0743c0cdea9583ed6125ea10bc0a9b05b2fd5b477e8a52c7cd3778232
Opcode Fuzzy Hash: 33843fb27ef57f7669a312ab3ce424a076af5fc682d66f1bfa97f3dad38a45df
Instruction Fuzzy Hash: B6C092F0A54200BEFE005BB0AD0CDB73A1CE6587A13208B007E22D20E0EA348C049634

Function 0050B351 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,0050B5A0,0050B594,00000000), ref: 0050B383

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 4dd8535c06428b43249739de247bb502ad93e2dc31a2db9455cdd63cb09323c3
Instruction ID: c8513f74132aa224b5e764cb2817fb4e54cb460a1a019c5d917c53451d09a6e5
Opcode Fuzzy Hash: 4dd8535c06428b43249739de247bb502ad93e2dc31a2db9455cdd63cb09323c3
Instruction Fuzzy Hash: 50514B719042589AEF218E28CDC4AEE7FB9FB55304F2409ADE599C7183C375AE45CB20

Function 004F6F32 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef634a8d8fcb1691247a346389038009f016caa27e4c576ff046d2315421e9c6
Instruction ID: abc1f4d30ba651e693aa4628fbeff8984887e421f8c47aeac3b76815f5ad5455
Opcode Fuzzy Hash: ef634a8d8fcb1691247a346389038009f016caa27e4c576ff046d2315421e9c6
Instruction Fuzzy Hash: AA31727690451EAFCB14CF68D9808FEB7B8FF19314B14066BE701A7280DB39E914CBA5

Function 00505419 Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f434da4de59e0bf9c3e0d7969dcfde0b4adb0bc5b9d5d87485771d37e935a2fd
Instruction ID: 8775c0eb3591f71b1d69c2320addbb0acd433fac1b54442cf3a4663bf2f36162
Opcode Fuzzy Hash: f434da4de59e0bf9c3e0d7969dcfde0b4adb0bc5b9d5d87485771d37e935a2fd
Instruction Fuzzy Hash: A001F537600A255BDF128E7DED4599F3B9AFBD53217148924F904CB1C4FA3098459F51

Function 00505BDF Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,004F4EC6,?,?,004F930A,?,?,?,?,?,004F2617,004F4EC6,?,?,?,?), ref: 00505C11

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3c02fd5793f441c8b2a43e3fdda2126e5450fa1fa2bc898db875f419e66448bf
Instruction ID: fd8ae4d8ea88803316e8803af84b4603be5ce890659e32a80ab11d97a29af3e2
Opcode Fuzzy Hash: 3c02fd5793f441c8b2a43e3fdda2126e5450fa1fa2bc898db875f419e66448bf
Instruction Fuzzy Hash: FCE09231601F229BFB3127699D09B9F3E4CBF827A0F590120FD0A960D1FB60DC419EA9

Function 00515712 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

FreeConsole.KERNELBASE(004F83B9,00000000,00000000,00000000,00520308,00000014), ref: 00515712

Part of subcall function 00515637: CreateThread.KERNELBASE(00000000,00000000,Function_00025653,00000000,00000000,00000000), ref: 00515643
Part of subcall function 00515637: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0051564C

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ConsoleCreateFreeObjectSingleThreadWait
String ID:
API String ID: 973188901-0
Opcode ID: 862092e2ccb57f932ca4ef57963fe4b65dfb4e9d5d7d33e5301d909c9b200f46
Instruction ID: d95d864551c9cd566c7283676bb2fc9394fe15631fe44929bddbe9e3f1ad7e60
Opcode Fuzzy Hash: 862092e2ccb57f932ca4ef57963fe4b65dfb4e9d5d7d33e5301d909c9b200f46
Instruction Fuzzy Hash: 0C900270111541C697802730AC0D4892A5076D424279085607105C0025FF7645446950

Non-executed Functions

Function 0050E230 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,NP,00000002,00000000,?,?,?,0050E54E,?,00000000), ref: 0050E2C9
GetLocaleInfoW.KERNEL32(?,20001004,NP,00000002,00000000,?,?,?,0050E54E,?,00000000), ref: 0050E2F2
GetACP.KERNEL32(?,?,0050E54E,?,00000000), ref: 0050E307

Strings

OCP, xrefs: 0050E284
NP, xrefs: 0050E2E3, 0050E300, 0050E2BA, 0050E2D3, 0050E2BD, 0050E2E6
ACP, xrefs: 0050E24E

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$NP$OCP
API String ID: 2299586839-4142511605
Opcode ID: 733b06eecde50f66f36eedb73298e2d8d2beca38c082bf88fb37faf8335e616c
Instruction ID: cd93f75956e717d0e4f85f7d86a6ae9c344dfee5decdbe2b9ede3bab5b1834a9
Opcode Fuzzy Hash: 733b06eecde50f66f36eedb73298e2d8d2beca38c082bf88fb37faf8335e616c
Instruction Fuzzy Hash: 41217126640106A7EB358F54CA07ADF7EABBB64B50B768C24E90AD7191E732DD40C350

Function 0050EDCE Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0050EFB2

Strings

1#INF, xrefs: 0050EF04
1#SNAN, xrefs: 0050EEDA
1#IND, xrefs: 0050EED3
1#QNAN, xrefs: 0050EEE1

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 698d52712a418fbc706e906f8d785f51c9fd745b4b0cd39b77040c75aa515911
Instruction ID: 5fb52f6c530c4d4013e6ed4560363e5785f83c2cd32d6679aae55b554b02048a
Opcode Fuzzy Hash: 698d52712a418fbc706e906f8d785f51c9fd745b4b0cd39b77040c75aa515911
Instruction Fuzzy Hash: 65D21771E082298BDB75CE28DD447EEBBB5FB84304F1445EAD80DA7680D778AE818F41

Function 0050E405 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00504900: GetLastError.KERNEL32(?,00000008,00504EFF), ref: 00504904
Part of subcall function 00504900: SetLastError.KERNEL32(00000000,004F4EC6,00000002,000000FF), ref: 005049A6

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0050E511
IsValidCodePage.KERNEL32(00000000), ref: 0050E55A
IsValidLocale.KERNEL32(?,00000001), ref: 0050E569
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0050E5B1
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0050E5D0

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 293f3cbab5a19e5912b57f34e46dbad488aeb09f3407da8fd406cb73a9df12c0
Instruction ID: 7cefe2e4dc43956bea2951604fad9e1f17ee7292466ce723904f391c8fdf0348
Opcode Fuzzy Hash: 293f3cbab5a19e5912b57f34e46dbad488aeb09f3407da8fd406cb73a9df12c0
Instruction Fuzzy Hash: 28515072A00216ABEF11DFA4DC46ABE7BB8BF58704F244C69F910EB1D1E7709944CB61

Function 0050DAA1 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00504900: GetLastError.KERNEL32(?,00000008,00504EFF), ref: 00504904
Part of subcall function 00504900: SetLastError.KERNEL32(00000000,004F4EC6,00000002,000000FF), ref: 005049A6

GetACP.KERNEL32(?,?,?,?,?,?,005034A3,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0050DB62
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,005034A3,?,?,?,00000055,?,-00000050,?,?), ref: 0050DB8D
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0050DCF0

Strings

utf8, xrefs: 0050DC5F

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 93f33f9629cde2ed2fb0ae33b089d0153ca3cd40826988c9d3965e37349c5ca8
Instruction ID: 22607f5a943affe362dcd87a955d616a5b1622b2d78994b6663c13ef3613f078
Opcode Fuzzy Hash: 93f33f9629cde2ed2fb0ae33b089d0153ca3cd40826988c9d3965e37349c5ca8
Instruction Fuzzy Hash: 2271B371600206AAEB24ABB5DC4ABBE7BB8FF94700F144429F905D71C1EAB4ED41CA71

Function 00505D32 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00505DBF

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 1f47ff457ba235831066e09548e84625a770d893a1596bb91e99954b6fab6d07
Instruction ID: 5885bf90886ded0a222534ae281d5a1aa945cbcd5d51792c58e94551a1a304de
Opcode Fuzzy Hash: 1f47ff457ba235831066e09548e84625a770d893a1596bb91e99954b6fab6d07
Instruction Fuzzy Hash: 85B158729046469FDB11CF68C8957EFBFA5FF55340F1481AAE945AB2C1E2389E01CFA0

Function 004F87A2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 004F87AE
IsDebuggerPresent.KERNEL32 ref: 004F887A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004F8893
UnhandledExceptionFilter.KERNEL32(?), ref: 004F889D

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3e77c48546410da6e63f845d8a6212ced8ff9b615a5a1302f9adf252e010ef16
Instruction ID: f92f0ca0a8d5035fac1638b2ab3d777999828dc8ad07cb7611d1c132fc752df3
Opcode Fuzzy Hash: 3e77c48546410da6e63f845d8a6212ced8ff9b615a5a1302f9adf252e010ef16
Instruction Fuzzy Hash: F431F7B5D0121C9BDF60EFA5D949BDDBBB8AF08304F1041AEE50DAB250EB749A84CF45

Function 0050DEB4 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00504900: GetLastError.KERNEL32(?,00000008,00504EFF), ref: 00504904
Part of subcall function 00504900: SetLastError.KERNEL32(00000000,004F4EC6,00000002,000000FF), ref: 005049A6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0050DF08
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0050DF52
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0050E018

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: c90251cce8bfd06828ed4a52d1585a07e65188566df821acfafe2000787fc6ac
Instruction ID: a52208d0f00b52d900544aa549a6b9a8987d8399ce28e099651a28722225a2cb
Opcode Fuzzy Hash: c90251cce8bfd06828ed4a52d1585a07e65188566df821acfafe2000787fc6ac
Instruction Fuzzy Hash: 68618D715006179FDB289F28CD9ABAE7BA8FF04300F248979E905C66C1EB74E985DB50

Function 004FC783 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,004F4EC6), ref: 004FC87B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,004F4EC6), ref: 004FC885
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,004F4EC6), ref: 004FC892

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: e8f69781ef06cd43524d9a4b85c9c45cc77509c3b3e9207fe6a901ab028361ed
Instruction ID: a87968dba2473887d8812498cc50eb49a46103eb4c52f42285a52f6be8d2e539
Opcode Fuzzy Hash: e8f69781ef06cd43524d9a4b85c9c45cc77509c3b3e9207fe6a901ab028361ed
Instruction Fuzzy Hash: B431C47490122CABCB21DF25D989BDDBBB8BF18310F5041EAE50CA7250EB749F858F49

Function 0050DD8E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00504900: GetLastError.KERNEL32(?,00000008,00504EFF), ref: 00504904
Part of subcall function 00504900: SetLastError.KERNEL32(00000000,004F4EC6,00000002,000000FF), ref: 005049A6

EnumSystemLocalesW.KERNEL32(0050DEB4,00000001,00000000,?,-00000050,?,0050E4E5,00000000,?,?,?,00000055,?), ref: 0050DE00

Strings

P, xrefs: 0050DDD5

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID: P
API String ID: 2417226690-290524615
Opcode ID: 45a9b8dc75b940df76e641594d090df2e62d3ca667e8775f25202c2a4f5416e1
Instruction ID: 6b526bc313d85b062b3b418ae5a4322fa53973bf9bc68cd3783574b00c99cbc3
Opcode Fuzzy Hash: 45a9b8dc75b940df76e641594d090df2e62d3ca667e8775f25202c2a4f5416e1
Instruction Fuzzy Hash: 1611E5372007055FDB189F79D8916BEBBA5FF90368B18842DE9868BA80D771B942CB50

Function 005011D0 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45359dbdee025ceff4488a092b7096e5c1b1646e308180004250f0db49df2fef
Instruction ID: 0fe01d9e61600c213285f76eeecb792103d9cd89c0e1c19cc9bb57eb3fcdb9c7
Opcode Fuzzy Hash: 45359dbdee025ceff4488a092b7096e5c1b1646e308180004250f0db49df2fef
Instruction Fuzzy Hash: C4F13F71E006199FDF14CFA9C880AADBBB1FF88314F158269E815AB391D731AD41CF95

Function 0050A066 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0050A061,?,?,00000008,?,?,00513135,00000000), ref: 0050A293

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 35a0c205967521b4907aba9d9a928ea0cb7a589479a0726df3d9c0d037152b56
Instruction ID: 2bc79e0ce58512208252a810c9a088d2ea574d83bc9f2952604e43f422734985
Opcode Fuzzy Hash: 35a0c205967521b4907aba9d9a928ea0cb7a589479a0726df3d9c0d037152b56
Instruction Fuzzy Hash: C9B12B356107098FD715CF28C48ABA97FA1FF45364F298658E89ACF2E1C336E991CB41

Function 004F8565 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 004F857B

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 217bc871bb7facb6ff6ab55ff8e4fe800d9cad5acfa6ef563913192193fd736f
Instruction ID: d9b1e8e62adf453e605e7a94d4f542cb4d736fc885eb19b6876950a65a25c878
Opcode Fuzzy Hash: 217bc871bb7facb6ff6ab55ff8e4fe800d9cad5acfa6ef563913192193fd736f
Instruction Fuzzy Hash: 5C519BB1A11209CFEB14CF58E8817AEBBF0FB68344F20846AD505EB390D7B89945DF50

Function 0050ACA1 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60ecddf4fca1b5693e772b95f88875515976e59a29d0a8cf03625d1ffcd330bc
Instruction ID: 61ba42824c1d69b3c5f0a959ffb2189e7f43c0d843b97de910006c419346151a
Opcode Fuzzy Hash: 60ecddf4fca1b5693e772b95f88875515976e59a29d0a8cf03625d1ffcd330bc
Instruction Fuzzy Hash: 0141A1B580521DAFDB20DF69CC89AAEBBB9FF45304F1442D9E44DD3281EA359E858F10

Function 0050E107 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00504900: GetLastError.KERNEL32(?,00000008,00504EFF), ref: 00504904
Part of subcall function 00504900: SetLastError.KERNEL32(00000000,004F4EC6,00000002,000000FF), ref: 005049A6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0050E15B

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: e2967f4a375ece797fb9d113f96faab0191eb2c885043845429fd09c26868467
Instruction ID: a150734f7782d12b6a8eaa731fd51f91536fb27feaca13054e3588870860e329
Opcode Fuzzy Hash: e2967f4a375ece797fb9d113f96faab0191eb2c885043845429fd09c26868467
Instruction Fuzzy Hash: 88218072645206ABDB289A25DC47EBE7BA8FF44310B20487AF901D71C1EB34AD05DB50

Function 0050E336 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00504900: GetLastError.KERNEL32(?,00000008,00504EFF), ref: 00504904
Part of subcall function 00504900: SetLastError.KERNEL32(00000000,004F4EC6,00000002,000000FF), ref: 005049A6

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0050E1B1,00000000,00000000,?), ref: 0050E362

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 3b6a918a85fba6a3358f699eb6b0db0785bd1afb5bcb9208d18b4e914fadf084
Instruction ID: cf70cdd8708c68a9537d047c1b58a3d9e06144bdef31ae7bf8dc082bd0d3ca6e
Opcode Fuzzy Hash: 3b6a918a85fba6a3358f699eb6b0db0785bd1afb5bcb9208d18b4e914fadf084
Instruction Fuzzy Hash: 51F08632510116ABDB2896659807BFE7F68FB80754F254C29ED45A31C0DA74FD41C590

Function 0050DC9C Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00504900: GetLastError.KERNEL32(?,00000008,00504EFF), ref: 00504904
Part of subcall function 00504900: SetLastError.KERNEL32(00000000,004F4EC6,00000002,000000FF), ref: 005049A6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0050DCF0

Strings

utf8, xrefs: 0050DC5F

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: bd4c99b11953b3ef804acf8f02db9628269a460f731ee7210c56a73f47a4fca2
Instruction ID: cbcc0e5b9c149aa2e94d0d0ad78166465fa9f924b534e9a13ea3106ef4756f1a
Opcode Fuzzy Hash: bd4c99b11953b3ef804acf8f02db9628269a460f731ee7210c56a73f47a4fca2
Instruction Fuzzy Hash: 18F0F432600109ABC714AB74EC0AAFE77A8EB44310B10047EBA02D7281EA74AD05C7A0

Function 0050DE29 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00504900: GetLastError.KERNEL32(?,00000008,00504EFF), ref: 00504904
Part of subcall function 00504900: SetLastError.KERNEL32(00000000,004F4EC6,00000002,000000FF), ref: 005049A6

EnumSystemLocalesW.KERNEL32(0050E107,00000001,?,?,-00000050,?,0050E4A9,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0050DE73

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a102a4e4623b14ec1a5b4c200f31d0e9986dfbb46faccd2f21f6976e330619ec
Instruction ID: cfcc5a0e0711939f0127c146e9c70902debc79b7b12e6b3874e0a4c1e2a78b7d
Opcode Fuzzy Hash: a102a4e4623b14ec1a5b4c200f31d0e9986dfbb46faccd2f21f6976e330619ec
Instruction Fuzzy Hash: 68F0F6362003045FDB145F75DC85A7F7FA9FF90768B15842DF9458B6C0C6B1AC02CA60

Function 00505185 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004FF268: EnterCriticalSection.KERNEL32(-0007B90A,?,00501C4F,00000000,005205F0,0000000C,00501C16,?,?,0050514E,?,?,00504A9E,00000001,00000364,004F4EC6), ref: 004FF277

EnumSystemLocalesW.KERNEL32(00505178,00000001,005207E0,0000000C,005055A7,00000000), ref: 005051BD

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 0ecaa6dd67db7d1fdc8368f41f4f6c7fb0dc20c61477a1f474918a240a830b65
Instruction ID: 6b8ac4aa20dd99a5a93d30b421974d683c1b8ab96d50b74447a006a4b118233c
Opcode Fuzzy Hash: 0ecaa6dd67db7d1fdc8368f41f4f6c7fb0dc20c61477a1f474918a240a830b65
Instruction Fuzzy Hash: 4FF03776A40204EFDB00DF98E846B9D7BF0FB55725F10412AF8149B2E1DBB55944EF84

Function 0050DD43 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00504900: GetLastError.KERNEL32(?,00000008,00504EFF), ref: 00504904
Part of subcall function 00504900: SetLastError.KERNEL32(00000000,004F4EC6,00000002,000000FF), ref: 005049A6

EnumSystemLocalesW.KERNEL32(0050DC9C,00000001,?,?,?,0050E507,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0050DD7A

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: cf1a1a35c7cc5556f15c8439415bdb3c26c1ef2646c772408e1f1de96b54381d
Instruction ID: f93d71500ce4d3635f62b40791ab58605777040d8e751862dcf3cded255c444b
Opcode Fuzzy Hash: cf1a1a35c7cc5556f15c8439415bdb3c26c1ef2646c772408e1f1de96b54381d
Instruction Fuzzy Hash: 9DF0E53A30020557CB04AF75D85976EBFA4FFC2750B068059EA058B291C6719842CBA0

Function 005056AB Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00504009,?,20001004,00000000,00000002,?,?,0050360B), ref: 005056DF

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: a5eff292dfd6b62011b6d0dac93fa8475ead69ca7944bf6a88428f6d0014fcc0
Instruction ID: e6929ef2558a282d846ba541361811e47010b757f3bfc3aae5adcc68273639a1
Opcode Fuzzy Hash: a5eff292dfd6b62011b6d0dac93fa8475ead69ca7944bf6a88428f6d0014fcc0
Instruction Fuzzy Hash: DAE04F35540A29BBCF122F60DC08A9F3F15FF55751F148420FC05652A1EB728D20EFA4

Function 004F88FE Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000890A,004F82B2), ref: 004F8903

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: bea1bd61a410280d8d813663079c10d14962daa85f8d9bfb20c02f44bcdf9f69
Instruction ID: fc74bcfd5a8d71552ddee77af8aee72dc6f1af3163802957aa61386b56b58380
Opcode Fuzzy Hash: bea1bd61a410280d8d813663079c10d14962daa85f8d9bfb20c02f44bcdf9f69
Instruction Fuzzy Hash:

Function 0050BE89 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0050BE89

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 918a2301495c5a336830d1f453bb2b0bef42e68440ae8c9bb99431bf01971f66
Instruction ID: f43b466ff4810cb46cdce922588a0efb59c32ac73b1e76fe2e4fbfcb28f79c60
Opcode Fuzzy Hash: 918a2301495c5a336830d1f453bb2b0bef42e68440ae8c9bb99431bf01971f66
Instruction Fuzzy Hash: 83A01130200200CB83808F30AA8820A3BE8AB2228030AA028AC08C02A0EB2080C8BA00

Function 0050D552 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: d991bcbc99cf9a6863d9ce182947f0e13ce23c7fded8baf4619519dc2f76def5
Instruction ID: 3107aa97246941bd44c9bb5c3885f2d96d219cfbc07f3a0e526c736f845ae1f8
Opcode Fuzzy Hash: d991bcbc99cf9a6863d9ce182947f0e13ce23c7fded8baf4619519dc2f76def5
Instruction Fuzzy Hash: 84B1F8355007068BDB349FA5CC96BBFBBB8FF44308F54892DE947865C0EA75A945CB20

Function 004FE7B4 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00ca5361333671212f85c3c7222c10ce47e4d2f682e3e006e2c4c47d8a31ff16
Instruction ID: d60864f06b96ac05ec18aaad9d21b4534d80d8e5ba86e16de4d203c5a0add353
Opcode Fuzzy Hash: 00ca5361333671212f85c3c7222c10ce47e4d2f682e3e006e2c4c47d8a31ff16
Instruction Fuzzy Hash: 5CB1C17090060E8BCF24EF6BC455ABFB7A1AF40346F14451FD752D73A1C679A902CB6A

Function 004F7D24 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004F7D2A
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 004F7D38
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 004F7D49
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 004F7D5A

Strings

kernel32.dll, xrefs: 004F7D25
GetSystemTimePreciseAsFileTime, xrefs: 004F7D3E
GetCurrentPackageId, xrefs: 004F7D32
GetTempPath2W, xrefs: 004F7D4F

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 8f3e84a7218c5f722990277ebb96d214ac931a65e4ed69e62766ec40ebb2912d
Instruction ID: b1b3823ac0b5331acc4caf4012e5e325661ab31adc401398bc68b3066753968d
Opcode Fuzzy Hash: 8f3e84a7218c5f722990277ebb96d214ac931a65e4ed69e62766ec40ebb2912d
Instruction Fuzzy Hash: 86E0EC31996314ABEB10DF78BC0DCC63EFDFA2D7223025855F505D21A0E6B40588ABA0

Function 004FB6E2 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 004FB801
___TypeMatch.LIBVCRUNTIME ref: 004FB90F
_UnwindNestedFrames.LIBCMT ref: 004FBA61
CallUnexpected.LIBVCRUNTIME ref: 004FBA7C

Strings

csm, xrefs: 004FB78C
csm, xrefs: 004FB71F
csm, xrefs: 004FB838

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 89277f590dd0edbda4e8df4bdac284e59c7055c1c418bdb3add1088551f8f199
Instruction ID: d620f6b3f893f3ea02fbfad7eaf2c48d385e85be34ed86629aae6a879e3ed97d
Opcode Fuzzy Hash: 89277f590dd0edbda4e8df4bdac284e59c7055c1c418bdb3add1088551f8f199
Instruction Fuzzy Hash: BEB14471C0020DABCF25EFA5C9819BEBBB5FF06314B14415AEA016B212D778DA51CFD9

Function 00509668 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 005098E1

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 2288c3d2f525a1eb9412ccec43e00325a8e8bcb40746b8987893d5a57e5ba9b5
Instruction ID: 18123b034c15644e1d53866f406da098f89168f2ab095ccb4d06dcf9ecd08878
Opcode Fuzzy Hash: 2288c3d2f525a1eb9412ccec43e00325a8e8bcb40746b8987893d5a57e5ba9b5
Instruction Fuzzy Hash: FCB1F374A04246AFDB15DF99C884BADBFB1BF86304F148558E504AB3DBC7709E42CB61

Function 00511FFA Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00BD05C8,00BD05C8,?,7FFFFFFF,?,005122CA,00BD05C8,00BD05C8,?,00BD05C8,?,?,?,?,00BD05C8,?), ref: 005120A0
__alloca_probe_16.LIBCMT ref: 0051215B
__alloca_probe_16.LIBCMT ref: 005121EA
__freea.LIBCMT ref: 00512235
__freea.LIBCMT ref: 0051223B
__freea.LIBCMT ref: 00512271
__freea.LIBCMT ref: 00512277
__freea.LIBCMT ref: 00512287

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: e8dce8155ee83b8d134aa924d36a775b89e69d99ec87db01bfbb6674ebdc086d
Instruction ID: 046fc91f26a4b4b2e6019140506569125864b779531a5610767205b8b3a0e305
Opcode Fuzzy Hash: e8dce8155ee83b8d134aa924d36a775b89e69d99ec87db01bfbb6674ebdc086d
Instruction Fuzzy Hash: 8771073690024A6BEF219F548C45FFE7FB6BF49314F284509E914A7281E635DCD0C7A0

Function 004F79FA Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 004F7A43
__alloca_probe_16.LIBCMT ref: 004F7A6F
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 004F7AAE
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004F7ACB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 004F7B0A
__alloca_probe_16.LIBCMT ref: 004F7B27
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004F7B69
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 004F7B8C

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 27bbbd0daaeac2da5a64c3cb4de8b2743f875be91284a04d8022ff91cfd90058
Instruction ID: f618ea8b6badb487276b2baa3cbabfdd66d01b3d60c3ba5b3ded75908c65824c
Opcode Fuzzy Hash: 27bbbd0daaeac2da5a64c3cb4de8b2743f875be91284a04d8022ff91cfd90058
Instruction Fuzzy Hash: CB51CF7250420AABEB205F60CC45FBF3BB9EF45748F15452AFA14A6250E73C9D11CB69

Function 004FB1B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 004FB1E7
___except_validate_context_record.LIBVCRUNTIME ref: 004FB1EF
_ValidateLocalCookies.LIBCMT ref: 004FB278
__IsNonwritableInCurrentImage.LIBCMT ref: 004FB2A3
_ValidateLocalCookies.LIBCMT ref: 004FB2F8

Strings

csm, xrefs: 004FB28D

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 564b6c5140fec468430e8a0abc97c80843471abc5204104b11f91394efcf3adc
Instruction ID: d0f6f80ef62556129db5c75815930d43886a02ae8582ecfe39a95b7a2cd4a039
Opcode Fuzzy Hash: 564b6c5140fec468430e8a0abc97c80843471abc5204104b11f91394efcf3adc
Instruction Fuzzy Hash: 7441C334A0020DDBCF10DF69C889AAE7FB0FF46324F14819AE9149B392D7399A15CBD5

Function 004F665D Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004F6664
std::_Lockit::_Lockit.LIBCPMT ref: 004F666E
int.LIBCPMT ref: 004F6685

Part of subcall function 004F2C1B: std::_Lockit::_Lockit.LIBCPMT ref: 004F2C2C
Part of subcall function 004F2C1B: std::_Lockit::~_Lockit.LIBCPMT ref: 004F2C46

codecvt.LIBCPMT ref: 004F66A8
std::_Facet_Register.LIBCPMT ref: 004F66BF
std::_Lockit::~_Lockit.LIBCPMT ref: 004F66DF

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 927deb212a8bf6fff85f2f2f5f288b34e1a99e5509a430f04952be11db746b07
Instruction ID: 23862da12aa29f8173c620d3bcfe242af0f36ecbdcff97564afe49a4273fd8ae
Opcode Fuzzy Hash: 927deb212a8bf6fff85f2f2f5f288b34e1a99e5509a430f04952be11db746b07
Instruction Fuzzy Hash: B811D27190022D9BCB00EB65D9466BEBBF4AF84314F11050FE605A7382DF789A01CB89

Function 004FB374 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,004FB36B,004F9930,004F585E,25454A19,?,?,?,?,00513C63,000000FF), ref: 004FB382
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004FB390
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004FB3A9
SetLastError.KERNEL32(00000000,?,004FB36B,004F9930,004F585E,25454A19,?,?,?,?,00513C63,000000FF), ref: 004FB3FB

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: bc3aa5e2c8f5276cdbcc170fa598aff66fc1b851fb68cd80d86c0932b7c678c8
Instruction ID: 4cdd39f2aacb05be0b7d443af9b71367db93d3a15a4b42412e3961b49f02509c
Opcode Fuzzy Hash: bc3aa5e2c8f5276cdbcc170fa598aff66fc1b851fb68cd80d86c0932b7c678c8
Instruction Fuzzy Hash: 7101D83614922D6F9A542B7AFCC68772A54EB33379320022FFB10851F1EF9A4D4A61DC

Function 00502061 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,25454A19,?,?,00000000,00513E8A,000000FF,?,00501FEE,?,?,00501FC2,00000016), ref: 00502096
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 005020A8
FreeLibrary.KERNEL32(00000000,?,00000000,00513E8A,000000FF,?,00501FEE,?,?,00501FC2,00000016), ref: 005020CA

Strings

CorExitProcess, xrefs: 005020A0
mscoree.dll, xrefs: 0050208F

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e1e821fdc5dca99a05d58c664ee8b4081e5183fa752b01e685d4965c0c3b5353
Instruction ID: 67bef8f275122921c738ab978b0f9b8516965923f8fd8d969de07d04197f24cc
Opcode Fuzzy Hash: e1e821fdc5dca99a05d58c664ee8b4081e5183fa752b01e685d4965c0c3b5353
Instruction Fuzzy Hash: EB018B35900629ABDB128F50DC1DBEEBFB8FB08B10F008629F811A22D0DBB49944CA90

Function 004F5A47 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 004F5A5B
AcquireSRWLockExclusive.KERNEL32(00000000,?,004F49A2,?,?,004F3B2B), ref: 004F5A7A
AcquireSRWLockExclusive.KERNEL32(00000000,?,00000000,?,004F49A2,?,?,004F3B2B), ref: 004F5AA8
TryAcquireSRWLockExclusive.KERNEL32(00000000,?,00000000,?,004F49A2,?,?,004F3B2B), ref: 004F5B03
TryAcquireSRWLockExclusive.KERNEL32(00000000,?,00000000,?,004F49A2,?,?,004F3B2B), ref: 004F5B1A

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 26d72449e0d0cd7597b6fdfe012cdbdc39a9b1ce2f5a9a127ef516b36292bc6c
Instruction ID: e26dde74e9b3a0b3ded41edf41f0590dfb5a054ba3a8af26e9e849302c310d0c
Opcode Fuzzy Hash: 26d72449e0d0cd7597b6fdfe012cdbdc39a9b1ce2f5a9a127ef516b36292bc6c
Instruction Fuzzy Hash: 92412830900E0ADBCB20DF65C4859BAB7F4FF08311B104A6BD7569B640D738F995CB69

Function 004F5F5B Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004F5F62
std::_Lockit::_Lockit.LIBCPMT ref: 004F5F6D
std::_Lockit::~_Lockit.LIBCPMT ref: 004F5FDB

Part of subcall function 004F60BE: std::locale::_Locimp::_Locimp.LIBCPMT ref: 004F60D6

std::locale::_Setgloballocale.LIBCPMT ref: 004F5F88
_Yarn.LIBCPMT ref: 004F5F9E

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 824be4ea7a56739cd8764a32d624cb8ecc71fa102c5968c10ad2507d173458ae
Instruction ID: 4f1da6579c44cb9e0a7222b88cf95d9ff552177e164b944e983d04515d2f6565
Opcode Fuzzy Hash: 824be4ea7a56739cd8764a32d624cb8ecc71fa102c5968c10ad2507d173458ae
Instruction Fuzzy Hash: 16014234A006289BCB06EF20DC415BEBBB1BF95300B14400EFA0157391CF78AE42EBC9

Function 004F591F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 004F59A7
RaiseException.KERNEL32(?,?,?,004F4BEB,?,?,?,?,?,?,?,?,?,?,004F4BEB,00000001), ref: 004F59CC

Part of subcall function 004F9362: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,?,004F4ED4,?,0051FDA8,?), ref: 004F93C2

Part of subcall function 004FC9FB: IsProcessorFeaturePresent.KERNEL32(00000017,004FC782,?,004FC6F1,004F4EC6,00000016,004FC900,?,?,?,?,?,00000000,?,?), ref: 004FCA17

Strings

KO, xrefs: 004F59C1, 004F59C4
csm, xrefs: 004F595B

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm$KO
API String ID: 1924019822-2281408922
Opcode ID: ac21ee4a7c608b98ba93a0d507ce1a5f6cb8eeb82f5821d77f86816f6666c0f6
Instruction ID: 73136abd4a64b68d3b2b5af7c09137d98c1d76c2a1726801fb9765b2ad17de7a
Opcode Fuzzy Hash: ac21ee4a7c608b98ba93a0d507ce1a5f6cb8eeb82f5821d77f86816f6666c0f6
Instruction Fuzzy Hash: D721BD71D0061CDBCF28DF95D845ABFB7B8AF04324F54080EE705AB250DAB8AD45CB98

Function 004FC477 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,004FC428,?,?,00000000,?,?,?,004FC552,00000002,FlsGetValue,00518080,FlsGetValue), ref: 004FC484
GetLastError.KERNEL32(?,004FC428,?,?,00000000,?,?,?,004FC552,00000002,FlsGetValue,00518080,FlsGetValue,?,?,004FB395), ref: 004FC48E
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 004FC4B6

Strings

api-ms-, xrefs: 004FC49B

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: ebb5997972e14e8c5fb7a5d6f7d064a34a5e58d78770f9e4f2c35b76be189f63
Instruction ID: e9a4d7e33670fecbec3ea0543cbfbc79dcd319a735958b30b907a831a9335db5
Opcode Fuzzy Hash: ebb5997972e14e8c5fb7a5d6f7d064a34a5e58d78770f9e4f2c35b76be189f63
Instruction Fuzzy Hash: 3BE0483028020CB7EF202B50DD4ABB93E59AB54B44F118021FB0CA45E1DB759954A644

Function 00507E12 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(25454A19,00000000,00000000,00000000), ref: 00507E75

Part of subcall function 0050A79E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,005079EE,?,00000000,-00000008), ref: 0050A84A

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 005080D0
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00508118
GetLastError.KERNEL32 ref: 005081BB

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: b3254420026eafd2c9298f1029cebc3a580448ecc0bdf8bf141132d4482c89bc
Instruction ID: 50868425facf094ececc3f84e3512e2e71d5a87a2a6d17d9ebe13ead221fea41
Opcode Fuzzy Hash: b3254420026eafd2c9298f1029cebc3a580448ecc0bdf8bf141132d4482c89bc
Instruction Fuzzy Hash: 81D169B5D042599FCF11CFA8D8849ADBFB4FF48304F18852AE966E7391DB30A946CB50

Function 004FB48B Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 004FB552
___AdjustPointer.LIBCMT ref: 004FB575
___AdjustPointer.LIBCMT ref: 004FB611

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 81b35cb02d5339c35f475b35e0e3e49564a16940a1526c667833a3ad2ce2cfc8
Instruction ID: 368d318b9133c5be1e39372f545c00db216b29296fe4943a74c43a01a5a82eb0
Opcode Fuzzy Hash: 81b35cb02d5339c35f475b35e0e3e49564a16940a1526c667833a3ad2ce2cfc8
Instruction Fuzzy Hash: A051BFB260020EAFDB299F25D841BBA77A5EF06318F14452FEA0187291D73DEC41CBD8

Function 0050AA5E Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0050A79E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,005079EE,?,00000000,-00000008), ref: 0050A84A

GetLastError.KERNEL32 ref: 0050AAC2
__dosmaperr.LIBCMT ref: 0050AAC9
GetLastError.KERNEL32(?,?,?,?), ref: 0050AB03
__dosmaperr.LIBCMT ref: 0050AB0A

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: bafc7ba68f4ad8d5c815bf444415ab4636ee682df214cfa4f72856586b18396f
Instruction ID: fce6c36902afa2e1eaadc468e79941ecbb80550eedc886b638a948d90ef28cf8
Opcode Fuzzy Hash: bafc7ba68f4ad8d5c815bf444415ab4636ee682df214cfa4f72856586b18396f
Instruction Fuzzy Hash: 85217C7160070AAFDB20AF658999D6FBFA9FF843647148519F929971D0E730EC40CBA2

Function 00501774 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3d8dd0f34c493664aa5583f0e1f94bf503939b5a3a5d6875a42eae2aada9ce
Instruction ID: a2a0f5677dfc127f67a9b8836a98ff9468572be77bd53ca0b8310ba9e154e518
Opcode Fuzzy Hash: 7f3d8dd0f34c493664aa5583f0e1f94bf503939b5a3a5d6875a42eae2aada9ce
Instruction Fuzzy Hash: 8B21A131600A06AFDB20AF61CC98D6F7FA9FF903647148525F815971C0D730ED40C796

Function 0050B9F4 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0050B9FC

Part of subcall function 0050A79E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,005079EE,?,00000000,-00000008), ref: 0050A84A

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0050BA34
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0050BA54

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 4fc754c40661dfce61e1349b84556fe34e545df722e3fe1cda8777cea3b5e6d7
Instruction ID: 217c31a7b0f7e3ed1e9a451f3ad6f26c263ad4a0461d2cbc33c66899fafa2821
Opcode Fuzzy Hash: 4fc754c40661dfce61e1349b84556fe34e545df722e3fe1cda8777cea3b5e6d7
Instruction Fuzzy Hash: 2D11EDB2A0560A7EFA11ABB25CCECBF7E6CFFD52983104425F90291281FB20DE00D571

Function 004F1F5B Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004F1F67
int.LIBCPMT ref: 004F1F7A

Part of subcall function 004F2C1B: std::_Lockit::_Lockit.LIBCPMT ref: 004F2C2C
Part of subcall function 004F2C1B: std::_Lockit::~_Lockit.LIBCPMT ref: 004F2C46

std::_Facet_Register.LIBCPMT ref: 004F1FAD
std::_Lockit::~_Lockit.LIBCPMT ref: 004F1FC3

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 518c7b1cbb1c51f8a718cc7b325363fab32ca742cd909fb4a4acc77c8039bddd
Instruction ID: b10ee2adf83ba6022dbe1b9979caff1bea15a07e19a0e01063308403cbf13f98
Opcode Fuzzy Hash: 518c7b1cbb1c51f8a718cc7b325363fab32ca742cd909fb4a4acc77c8039bddd
Instruction Fuzzy Hash: BA01887190011CEBC714AB56E8458BE7BA8DF80764B10015FF615A73A1DF789E419798

Function 00511E2F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00510770,00000000,00000001,00000000,00000000,?,0050820F,00000000,00000000,00000000), ref: 00511E46
GetLastError.KERNEL32(?,00510770,00000000,00000001,00000000,00000000,?,0050820F,00000000,00000000,00000000,00000000,00000000,?,00508796,?), ref: 00511E52

Part of subcall function 00511E18: CloseHandle.KERNEL32(FFFFFFFE,00511E62,?,00510770,00000000,00000001,00000000,00000000,?,0050820F,00000000,00000000,00000000,00000000,00000000), ref: 00511E28

___initconout.LIBCMT ref: 00511E62

Part of subcall function 00511DDA: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00511E09,0051075D,00000000,?,0050820F,00000000,00000000,00000000,00000000), ref: 00511DED

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,00510770,00000000,00000001,00000000,00000000,?,0050820F,00000000,00000000,00000000,00000000), ref: 00511E77

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: eac3bafe63c2d9c6c1bb3a6bcbbe7a80b33ba03247976e8d50ee889d2a4aab38
Instruction ID: 874194269571cdde057dcdf42df98512fb295a8f61bbb789168e6bd9bea6261b
Opcode Fuzzy Hash: eac3bafe63c2d9c6c1bb3a6bcbbe7a80b33ba03247976e8d50ee889d2a4aab38
Instruction Fuzzy Hash: 8BF03036441615BBDF622FD5EC08ECA3F66FF693A1B008160FE2986131C7728864EBD5

Function 0050C43C Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 373COMMON

Download Yara Rule

Strings

PV, xrefs: 0050C74F
PV, xrefs: 0050C46A

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID:
String ID: PV$PV
API String ID: 0-2024304159
Opcode ID: e05543e6efa093a43a6d77d4f56f0c7a7276926c69408e0b8d267aa41d5d357e
Instruction ID: 33026d33a9de3d69e89669a5c63547bb57fee1a3183d708b1500a1674a49db68
Opcode Fuzzy Hash: e05543e6efa093a43a6d77d4f56f0c7a7276926c69408e0b8d267aa41d5d357e
Instruction Fuzzy Hash: DEC10775D44209ABDB20DBA8CC86FEE7FF8BB49700F144555FA05FB2C2E670A9419B60

Function 0050D088 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00504BEB: HeapFree.KERNEL32(00000000,00000000,?,0050CA85,?,00000000,?,?,0050CD26,?,00000007,?,?,0050D21F,?,?), ref: 00504C01
Part of subcall function 00504BEB: GetLastError.KERNEL32(?,?,0050CA85,?,00000000,?,?,0050CD26,?,00000007,?,?,0050D21F,?,?), ref: 00504C0C

___free_lconv_mon.LIBCMT ref: 0050D0CC

Strings

xV, xrefs: 0050D174
PV, xrefs: 0050D09E

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast___free_lconv_mon
String ID: PV$xV
API String ID: 4068849827-2300119770
Opcode ID: fb3408aad42d9b8669546eacc38ebe7f73d027b2c1d66f5a399bac553665f1d9
Instruction ID: 9441d643823157fa4a23dd90b1bf7f6fcba1241c720736040d99a04cd4011498
Opcode Fuzzy Hash: fb3408aad42d9b8669546eacc38ebe7f73d027b2c1d66f5a399bac553665f1d9
Instruction Fuzzy Hash: 823118756087029FEB21AEB9D889B5EBBF8FF80310F148819E159971D1DE74F941CA20

Function 004FBA87 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 004FBAAC

Strings

RCC, xrefs: 004FBAC6
MOC, xrefs: 004FBABE

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 8129257d3c99e1fd658878fedc700ec64833b2b9572e17c63d3a1894e63c4fd1
Instruction ID: d2aa101c91b3d32ff3128b75691a7d6dd82b4ee14862a25e63fe315124884345
Opcode Fuzzy Hash: 8129257d3c99e1fd658878fedc700ec64833b2b9572e17c63d3a1894e63c4fd1
Instruction Fuzzy Hash: 2E41587190020DAFCF16DF95CD81EEEBBB5FF49304F14819AFA04A6225D339AA50DB94

Function 004F8AE3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004F8AEE
___raise_securityfailure.LIBCMT ref: 004F8BAB

Strings

/<P, xrefs: 004F8B59

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: /<P
API String ID: 3761405300-3569938628
Opcode ID: 8fecf3e2a38f2579bf01b2bfe1ec92fde58db353dc978f52b9b71e2c41818760
Instruction ID: 3b4b3ca570c4da9310f1730419bdd97ca7f40ce2fdefe864ca6a1a55421f9cc5
Opcode Fuzzy Hash: 8fecf3e2a38f2579bf01b2bfe1ec92fde58db353dc978f52b9b71e2c41818760
Instruction Fuzzy Hash: 4911F0B4550305CBCB50CF19F984A443BEABB68304F00601AE61C8B3E1E3B0A5C9BF44

Function 004F22C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004F22CF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004F2307

Part of subcall function 004F6059: _Yarn.LIBCPMT ref: 004F6078
Part of subcall function 004F6059: _Yarn.LIBCPMT ref: 004F609C

Strings

bad locale name, xrefs: 004F2315

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 69274e9879feb9adbc8a17969faec18bce4bcca2681619bf193536c9fe9a6305
Instruction ID: 90a42792e848f43a7a4ad76b2c081d1ba645c817345a11512d1871d89f384f28
Opcode Fuzzy Hash: 69274e9879feb9adbc8a17969faec18bce4bcca2681619bf193536c9fe9a6305
Instruction Fuzzy Hash: 35F01D71505B449E83309F7A9481457FBE4BE292103508E2FE1DEC3A12D734A404CB6D

Function 004F106D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004F1074

Strings

TV, xrefs: 004F1079
\gQ, xrefs: 004F107E

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: H_prolog3
String ID: TV$\gQ
API String ID: 431132790-677070127
Opcode ID: 752925aaa6407c2aaf0aa83d7111ab5c942c39da657e1628aa6765fc96994d83
Instruction ID: a1d77cc148940a9c9ef6232b9f65d2864b3520a6af0f9d24b173de097c765e1b
Opcode Fuzzy Hash: 752925aaa6407c2aaf0aa83d7111ab5c942c39da657e1628aa6765fc96994d83
Instruction Fuzzy Hash: 9CE0D8B89422099AEB00AB95890B7EC7DF0BB1171CF90024DB1217F2D1DFF9070A4B52

Function 004F1016 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004F101D

Strings

`V, xrefs: 004F1027
HbQ, xrefs: 004F1022, 004F1035

Memory Dump Source

Source File: 00000000.00000002.1655414684.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.1655384104.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655451157.0000000000516000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000522000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655478069.0000000000565000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1655526997.0000000000571000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_FkJbps6Srrl6lOQ9M_l8dpw2.jbxd

Yara matches

Similarity

API ID: H_prolog3
String ID: HbQ$`V
API String ID: 431132790-39652462
Opcode ID: 4a691927aab97ce458b902ff6a7b6c1d0dae987db4bd56b645b08e9818e7ef2a
Instruction ID: 929569b9bf5d432e6cf22105d2a0e780651c1e5551f0cfebbfdd9cc91b0da0fe
Opcode Fuzzy Hash: 4a691927aab97ce458b902ff6a7b6c1d0dae987db4bd56b645b08e9818e7ef2a
Instruction Fuzzy Hash: DCE09274A0160996EB00AB9189076ED7DE0BB1170CF80434DE1207F2E1EBF94A844F55

Analysis Process: RegAsm.exePID: 7576, Parent PID: 7500COMMON

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	66
Total number of Limit Nodes:	10

Executed Functions

Function 074F0040 Relevance: 2.9, Strings: 2, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 074F02C0
1, xrefs: 074F0345

Memory Dump Source

Source File: 00000003.00000002.1888297708.00000000074F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_74f0000_RegAsm.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: 1640cbe986b13d0b3ee113defe7f49cba37dbbb7119acfe531e48c73df4d0aa5
Instruction ID: 71ee40ad17f3c58329d512025fb241d544dee7c232cbe7dec8f314caeea57cbc
Opcode Fuzzy Hash: 1640cbe986b13d0b3ee113defe7f49cba37dbbb7119acfe531e48c73df4d0aa5
Instruction Fuzzy Hash: 87F1EF74E01229CFDB68DF65C884BEDBBB2BF89301F1095AAD50AA7250DB315E85CF10

Function 06443F50 Relevance: 1.8, Strings: 1, Instructions: 523COMMON

Download Yara Rule

Strings

$^q, xrefs: 064441E4

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: 04232cbae5e94253064b64b8fc0209fe3696d46f1cd768706658d163965eaa27
Instruction ID: 05f36768a44e24d48e4ecfebce317d64a723ebde604f59152d0a7252a19afa46
Opcode Fuzzy Hash: 04232cbae5e94253064b64b8fc0209fe3696d46f1cd768706658d163965eaa27
Instruction Fuzzy Hash: 7B126E34B002158FDB55EF69C585AAEBBF2FF88740B14816AE506EB365DB31DC42CB90

Function 0644A3D8 Relevance: 1.5, Strings: 1, Instructions: 298COMMON

Download Yara Rule

Strings

^q0, xrefs: 0644A566

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: ^q0
API String ID: 0-2308874931
Opcode ID: 188c664579605c2c0f6ed4f73d391d06d1ae8f152936f318e4ce3bb3adf70cf9
Instruction ID: b3045cf2ddc7965fd3c0cd45b4accf5060267c055ecdd3f70401f39040fb605d
Opcode Fuzzy Hash: 188c664579605c2c0f6ed4f73d391d06d1ae8f152936f318e4ce3bb3adf70cf9
Instruction Fuzzy Hash: F3D10834D00219CFCB64EFB4D844A9DBBB2FF8A301F1081A9D50AAB354DB31598ACF11

Function 0644A3E8 Relevance: 1.5, Strings: 1, Instructions: 289COMMON

Download Yara Rule

Strings

^q0, xrefs: 0644A566

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: ^q0
API String ID: 0-2308874931
Opcode ID: b025b4cdb92e2aecf05b76b0dfe0facadcf460838b29a0cdb9682b51116eb5ec
Instruction ID: 01d5afe0a3b566bfd30ba23c778cbe7e1de3b500e4f714b63a88beac348a25f2
Opcode Fuzzy Hash: b025b4cdb92e2aecf05b76b0dfe0facadcf460838b29a0cdb9682b51116eb5ec
Instruction Fuzzy Hash: 0BD1E734D00219CFCB68EFB5D844A9DBBB2FF8A301F109569D50AAB394DB31598ADF11

Function 064467D8 Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02c6402d0cef308f801bc8dde925e8f0ad95acff4ee6f5c776c2324500902285
Instruction ID: d017a9b2f270dba4993c734b07a83e824d45efbb44640ee8aa9fa21833f072fc
Opcode Fuzzy Hash: 02c6402d0cef308f801bc8dde925e8f0ad95acff4ee6f5c776c2324500902285
Instruction Fuzzy Hash: BCF1B031A002099FDB05DF68D985B9EBBF2EF89300F15856AE405EB365DB31ED46CB90

Function 06420D80 Relevance: 20.6, Strings: 16, Instructions: 622
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06420FAC
$^q, xrefs: 06420F86
$^q, xrefs: 064213A0
$^q, xrefs: 06420E02
$^q, xrefs: 0642137B
$^q, xrefs: 06421336
$^q, xrefs: 06420FB8
$^q, xrefs: 06420E78
$^q, xrefs: 06420E52
$^q, xrefs: 06421455
$^q, xrefs: 06421461
$^q, xrefs: 064213EB
$^q, xrefs: 06420F36
$^q, xrefs: 064213AC
$^q, xrefs: 06420E84
$^q, xrefs: 06421430

Memory Dump Source

Source File: 00000003.00000002.1886778396.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6420000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2449488485
Opcode ID: 5905c18271c0a639d48b9a7629bf53b2f6866081081a333d9119e96b3e246509
Instruction ID: 306c0996f9f5315075ec51730c273699283403a92d231fe1940a0b923d79ba04
Opcode Fuzzy Hash: 5905c18271c0a639d48b9a7629bf53b2f6866081081a333d9119e96b3e246509
Instruction Fuzzy Hash: 8132C030B002268FDB559F69C844A6EBBF6FF89700B65845AE506DB3A6CF70DC41CB91

Function 06421584 Relevance: 7.8, Strings: 6, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06421A12
$^q, xrefs: 064218E3
$^q, xrefs: 06421A88
$^q, xrefs: 0642182E
$^q, xrefs: 06421A57
$^q, xrefs: 06421A7C

Memory Dump Source

Source File: 00000003.00000002.1886778396.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6420000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: e949917533a8a8c8d8ecf3009fd0804cf7d2d698a8132eb1f85563153edbda44
Instruction ID: 0f017e27dbb6495f081aafda881cf5d7fd568a6dc523c1ffb08c639834b4f7b6
Opcode Fuzzy Hash: e949917533a8a8c8d8ecf3009fd0804cf7d2d698a8132eb1f85563153edbda44
Instruction Fuzzy Hash: 32C1B430B002669FDB55AB64C854A2F77E6AFC9700F60445AE603CB3A2DF75DC46C791

Function 0270D0A8 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0270D136
GetCurrentThread.KERNEL32 ref: 0270D173
GetCurrentProcess.KERNEL32 ref: 0270D1B0
GetCurrentThreadId.KERNEL32 ref: 0270D209

Memory Dump Source

Source File: 00000003.00000002.1880319435.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2700000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7c68f2c935a683e2975fd28849349ca5a68db1c79677b02aa6c3375426c91799
Instruction ID: 972c6ab29cb5db5688fa81e038329b01db49e7652cea9ff4a3572408e6a4d559
Opcode Fuzzy Hash: 7c68f2c935a683e2975fd28849349ca5a68db1c79677b02aa6c3375426c91799
Instruction Fuzzy Hash: 3F5158B0901349CFDB14DFAAD548B9EBBF1EF48314F208069E019A73A0DB749985CF65

Function 0270D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0270D136
GetCurrentThread.KERNEL32 ref: 0270D173
GetCurrentProcess.KERNEL32 ref: 0270D1B0
GetCurrentThreadId.KERNEL32 ref: 0270D209

Memory Dump Source

Source File: 00000003.00000002.1880319435.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2700000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d372317bf2f8714a4376f52f3bcc36ae960c4e2d282c22e250191418f1b71559
Instruction ID: 8ac62706d66f3c859d49b9af9dd5025b2e260f090eef5e19278ac3afcd40eed0
Opcode Fuzzy Hash: d372317bf2f8714a4376f52f3bcc36ae960c4e2d282c22e250191418f1b71559
Instruction Fuzzy Hash: 0B5159B0900349DFDB14DFAAD548B9EBBF1EF48314F208469E419A73A0DB74A984CF65

Function 0270AE30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0270B086

Strings

0V, xrefs: 0270AFE3
0V, xrefs: 0270AFBE

Memory Dump Source

Source File: 00000003.00000002.1880319435.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2700000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID: 0V$0V
API String ID: 4139908857-4216712621
Opcode ID: 8a663a6755432f0d371095bfaaacaa5078aab8f00998aea34eb78f409945dc15
Instruction ID: 8114febfd4d9c00c38b7cce39a99dc2890d4fe767cf7f3c9a9f92e874d78f2c7
Opcode Fuzzy Hash: 8a663a6755432f0d371095bfaaacaa5078aab8f00998aea34eb78f409945dc15
Instruction Fuzzy Hash: BE7113B0A00B45CFDB24DF29D18575ABBF1FB88304F00892DD58A97A90D775E94ACB90

Function 06420598 Relevance: 1.7, Strings: 1, Instructions: 462COMMON

Download Yara Rule

Strings

jlPj, xrefs: 0642059C

Memory Dump Source

Source File: 00000003.00000002.1886778396.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6420000_RegAsm.jbxd

Similarity

API ID:
String ID: jlPj
API String ID: 0-600715053
Opcode ID: 18d2eb810ddd2e4fe0b6471332464424bca3c673d6143c4f83f0f9ef71c85343
Instruction ID: a2e00ddd79071c8711e253b05275e9abfa956d5971e2b42bb02f322811f9099e
Opcode Fuzzy Hash: 18d2eb810ddd2e4fe0b6471332464424bca3c673d6143c4f83f0f9ef71c85343
Instruction Fuzzy Hash: 6D02AD30B402298FDB55AF64C954A2EBBF2FF85704F604859D5029F3A1CFB6ED468B81

Function 02705935 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 027059F1

Memory Dump Source

Source File: 00000003.00000002.1880319435.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2700000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f5544c138bc00914dc01fc2b135d91adc623c3582c3ff5e6a0aaadd93febbf56
Instruction ID: 79e503a5813c2e883dc61122e894b6198efd8c6c9436da93541e7f292eb481ee
Opcode Fuzzy Hash: f5544c138bc00914dc01fc2b135d91adc623c3582c3ff5e6a0aaadd93febbf56
Instruction Fuzzy Hash: 0941E0B0D00619CFDB24CFA9C98469DBBF5BF44304F24816AD409BB251DB75698ACF90

Function 02704248 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 027059F1

Memory Dump Source

Source File: 00000003.00000002.1880319435.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2700000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4fe0f129e68c97b33b68ff5da5e2d9e2c75d3ca212f225a77fd940e478966195
Instruction ID: 05bf1b93fbaf96e0da470b07b6a57c1292c4a712a1c83639a8530ff2db624f97
Opcode Fuzzy Hash: 4fe0f129e68c97b33b68ff5da5e2d9e2c75d3ca212f225a77fd940e478966195
Instruction Fuzzy Hash: BA41E0B0D00619CBDB24CFAAC884B9DBBF5FF44304F64816AD409BB250DB75698ACF90

Function 0270D2F9 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0270D387

Memory Dump Source

Source File: 00000003.00000002.1880319435.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2700000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 51fd30ab728ec3dfc342c84ec1da8a7ecdf7af5ced052eb16b7a69c0305e8b10
Instruction ID: 01296a25b154c89fc378e23459efb6424f793696ebe3acf096a0157f222275c3
Opcode Fuzzy Hash: 51fd30ab728ec3dfc342c84ec1da8a7ecdf7af5ced052eb16b7a69c0305e8b10
Instruction Fuzzy Hash: FE21E3B5900258DFDB10CFAAD585AEEFFF4EB48324F14842AE918A7350C374A944CFA4

Function 0270D300 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0270D387

Memory Dump Source

Source File: 00000003.00000002.1880319435.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2700000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d65ce28458083b72e90a9e781b1571cf6bf818b856c2e236a26a1f2d72b19230
Instruction ID: 21ee3beb4a9fe7b68b22d6cdd88d2993e015f89bd793dc61bd0be8d14051d68a
Opcode Fuzzy Hash: d65ce28458083b72e90a9e781b1571cf6bf818b856c2e236a26a1f2d72b19230
Instruction Fuzzy Hash: B021E0B5900348DFDB10CFAAD984ADEFBF4EB48320F14842AE918A7250C374A944CFA4

Function 0270B2A0 Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0270B101,00000800,00000000,00000000), ref: 0270B312

Memory Dump Source

Source File: 00000003.00000002.1880319435.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2700000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6ae52d02fa611780dfafba62e1e4a665aef711f7d4d9c8a533d78a40646208d5
Instruction ID: 05b26f956a313fdc900489a7f3bd46206c834001ec9e85140ff5a55d2fc416bc
Opcode Fuzzy Hash: 6ae52d02fa611780dfafba62e1e4a665aef711f7d4d9c8a533d78a40646208d5
Instruction Fuzzy Hash: 751126B6900249CFDB14CFAAC984ADEFBF4EB88324F10842ED419A7250C775A645CFA5

Function 074F59E0 Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E58,?,?,074F5946), ref: 074F5A4E

Memory Dump Source

Source File: 00000003.00000002.1888297708.00000000074F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_74f0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c2beb7681f27683a39e1671fe6d40ddede0a224d393b7c298c53c5521cc4cfaa
Instruction ID: c20b340c6fbd6b77e2844c6fc764afd1a5c1691dd5854915e3605d46756c153d
Opcode Fuzzy Hash: c2beb7681f27683a39e1671fe6d40ddede0a224d393b7c298c53c5521cc4cfaa
Instruction Fuzzy Hash: D61123B6D012598FDB10CFAAD844ADEFBF4EF88324F14842AD519A7310C775A545CFA1

Function 0270A870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0270B101,00000800,00000000,00000000), ref: 0270B312

Memory Dump Source

Source File: 00000003.00000002.1880319435.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2700000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 474d3ad3fd9a735858b924d24883836d67f70ccc6323f3d12cbeba3bc76c822a
Instruction ID: d6145a5bf19c82bd03c30864325cb4128d170ab14577726ab82fd05cef3a0cee
Opcode Fuzzy Hash: 474d3ad3fd9a735858b924d24883836d67f70ccc6323f3d12cbeba3bc76c822a
Instruction Fuzzy Hash: FA1103B6900249DFDB10CF9AC584A9EFBF4EB48324F10842AD419B7250C375A645CFA4

Function 074F556C Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E58,?,?,074F5946), ref: 074F5A4E

Memory Dump Source

Source File: 00000003.00000002.1888297708.00000000074F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_74f0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fbd2c095c806fa846c846634317881fefa76c045c343e269a68748499cdff04e
Instruction ID: ec0e35dee6be2cac5e4d2b97853ad7585cd426e297ddd7f773c819cd631978cf
Opcode Fuzzy Hash: fbd2c095c806fa846c846634317881fefa76c045c343e269a68748499cdff04e
Instruction Fuzzy Hash: B81120B6D007498BCB20CF9AC444ADEFBF4EB88324F14842AD919A7310C379A955CFA0

Function 0270B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0270B086

Memory Dump Source

Source File: 00000003.00000002.1880319435.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2700000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6e00be7d2a5e752173d707d3d688687f764f3cb0b1f2eebacba8f52f311eef25
Instruction ID: a4d2349f5dbd3ae92026d22cf16e55750f71a7ecf306ef69a38dabafe0cd98c0
Opcode Fuzzy Hash: 6e00be7d2a5e752173d707d3d688687f764f3cb0b1f2eebacba8f52f311eef25
Instruction Fuzzy Hash: 8D1102B6D00349CFDB10CF9AC544ADEFBF4EB48224F10846AD469B7210C375A649CFA1

Function 06421BA0 Relevance: 1.4, Instructions: 1441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886778396.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6420000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 622ea5629adf01e8fa25215d70102b1277d662a0b55ef556ae35649464997049
Instruction ID: 8df5d672f980c395b3a5e9c2141e035cddd98858cec9112fa37cd25dbc296d17
Opcode Fuzzy Hash: 622ea5629adf01e8fa25215d70102b1277d662a0b55ef556ae35649464997049
Instruction Fuzzy Hash: 77C22E70B401199FDB55DB64C850EAEBBB2FF88700F118099E606AB3A1DB71EE85CF51

Function 06443DE0 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06443F25

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 8d593eb55191a2225feed74ee8ac730762087d21fe020d6e07391d4f25722c3f
Instruction ID: f985257e2c71a815f42b3f05e3f0314e361f90ef9af2a8b3732bce660ee6450e
Opcode Fuzzy Hash: 8d593eb55191a2225feed74ee8ac730762087d21fe020d6e07391d4f25722c3f
Instruction Fuzzy Hash: C231F2327452504FCB16AB78A85546E7BE6DFCA21031548ABE405CB7A1DE35EC0BC7A1

Function 064484D8 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

4'^q, xrefs: 064485B1

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 5556184c0098521d1a88d83acbf1c1b3b08607e59a52f61eaa5cda75cc1d29ef
Instruction ID: cce4eb2a2c115060cfd9f6ebae930b6a9b98d9c376bd2b7153f9ce8d466cbccc
Opcode Fuzzy Hash: 5556184c0098521d1a88d83acbf1c1b3b08607e59a52f61eaa5cda75cc1d29ef
Instruction Fuzzy Hash: 5A317C35B002098FCF49EB79A5595AE76E3ABC8210750443AE50BCB385EF35ED46C7E2

Function 064484C8 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

4'^q, xrefs: 064485B1

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: e4805b48df25085a3519e407171109b6a9f212f304388787cdf873bcb36233da
Instruction ID: ffe7fdbd736386825fcd4139def1c97f31d5a8c8c550e1d589810efd8234976c
Opcode Fuzzy Hash: e4805b48df25085a3519e407171109b6a9f212f304388787cdf873bcb36233da
Instruction Fuzzy Hash: 42218F317002058FCB49AB78A56957E3AE3ABC8200750443EE507DB385EF35ED46C792

Function 0644B358 Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0644B399

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 87c440feb02603da5f8aaf18224335cad5d42592d40c034a225625eb0e76210c
Instruction ID: d864621164e1ab4bce81b6be085c5c5a565495d07710215b305250272c7280ec
Opcode Fuzzy Hash: 87c440feb02603da5f8aaf18224335cad5d42592d40c034a225625eb0e76210c
Instruction Fuzzy Hash: BC01DF34906249AFCF14EFB4F8954ACBFB2FF45200B1001AAE4069B391DB301F89DB61

Function 06443EC8 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06443F25

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 804ab883aa849c89fbc16415d6af5b69fa8c999b6e08ab4796f6f940312e62fd
Instruction ID: 30c5360565c059c0d62ebd23ad3f3cf093dedcba6a60e973a9e9d01f25426f8e
Opcode Fuzzy Hash: 804ab883aa849c89fbc16415d6af5b69fa8c999b6e08ab4796f6f940312e62fd
Instruction Fuzzy Hash: 41F036313401014FC618E769D49596EB7E7DBC9350354492DE4198B768EF60FD4A87A1

Function 0644B368 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0644B399

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: ec35cc4d3a20141a3c95b5f2470502da57225830d407f3cd4f82ca5cdf7a1a23
Instruction ID: 958d8e3bf6617e612576b24b74e4306170b2183e6855789fd1ac8aa8000ba4f5
Opcode Fuzzy Hash: ec35cc4d3a20141a3c95b5f2470502da57225830d407f3cd4f82ca5cdf7a1a23
Instruction Fuzzy Hash: 3BF04F30A02209EFCF54EFB8E59955CBBF2FB84300B1045A9D40A9B754DF305E88DB51

Function 06423933 Relevance: .7, Instructions: 705COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886778396.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6420000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e104865d3ef11637ee14f76504900e89489fe7abd643ef919c1bcbe54289251c
Instruction ID: 72aa05b4b9456caa198cb266293f3505ab192f0e945e8b09986a9e26304bf3a2
Opcode Fuzzy Hash: e104865d3ef11637ee14f76504900e89489fe7abd643ef919c1bcbe54289251c
Instruction Fuzzy Hash: E7522634B402159FCB44CF69C994EAEBBF6FF89704F10809AE606DB3A1DA71ED458B50

Function 064200D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886778396.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6420000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11401cf9cb5482dfed235a30fb1a03c4165252f2ca1047a78f3c91a43b32ccec
Instruction ID: 0d87c3482aa5ddcee13b7cdce2d1f89899a2e1c49d5cd2f61df5b714516faedd
Opcode Fuzzy Hash: 11401cf9cb5482dfed235a30fb1a03c4165252f2ca1047a78f3c91a43b32ccec
Instruction Fuzzy Hash: 834289307406298FCB65AF689550A2EBBF2FBC5704B50495CD5039F3A1CFB6ED068B86

Function 06420610 Relevance: .5, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886778396.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6420000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b67401f0a78d01334cb6dc545edebd3484d05cee33ce4dabd150475609eecbb
Instruction ID: d660800f67e3f0f18d8585daa1a9f68601a971b21aded51976ca4f12ac7b87ce
Opcode Fuzzy Hash: 3b67401f0a78d01334cb6dc545edebd3484d05cee33ce4dabd150475609eecbb
Instruction Fuzzy Hash: 2F02BC30B402258FDB55AB64C954A2EBBF6FF89B04F604459D5029F3A1CFB6EC468B81

Function 06420688 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886778396.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6420000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e491abd4259e55521c2f2016feba41234608979c5ea9a02c9d5684c7749d56
Instruction ID: 34934cc9b59f48eb5fa1d8b6dfde6997e6991d02ca363d29a217252f91f071b9
Opcode Fuzzy Hash: 22e491abd4259e55521c2f2016feba41234608979c5ea9a02c9d5684c7749d56
Instruction Fuzzy Hash: 26E1BE30B402258FEB459B64C954A2A7BF6FF89B04F60445AE5029F3A1CF76EC46CB91

Function 06420700 Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886778396.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6420000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3240cdb185617272ef78e07a2f6b420b3c6098d16a870419932008026256bfae
Instruction ID: 17343b73df475963e417fe2329671cd6a77a2ce1f01f47d690a9062db9beb6dd
Opcode Fuzzy Hash: 3240cdb185617272ef78e07a2f6b420b3c6098d16a870419932008026256bfae
Instruction Fuzzy Hash: DED19F30B402259FEB459B64C958B2A7BF6FF89B04F60405AE5028B3A1CF76DC46CB91

Function 064200BB Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886778396.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6420000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b99968fdc8c2bac8d8c98e2e49a67021c0c4c0eaecddb42d39ac9de864abf319
Instruction ID: 6086c9e565cfcc9453c12ec101a94f8ec6b4a331774fb81120fb68bc6b71d95c
Opcode Fuzzy Hash: b99968fdc8c2bac8d8c98e2e49a67021c0c4c0eaecddb42d39ac9de864abf319
Instruction Fuzzy Hash: 3FC19F30B402159FEB459B64C958B6A7BF6FF89B04F608056E602DB3A1CF76DC42CB91

Function 06444AFF Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd7e9bac95a1082089204cf93aab489764281f0c1d8d367983f1a3528aeb6ac
Instruction ID: 3fe86649b19393798f93a65ef921fcd861e59eb430e5b4ea763e5ff0da639790
Opcode Fuzzy Hash: 4fd7e9bac95a1082089204cf93aab489764281f0c1d8d367983f1a3528aeb6ac
Instruction Fuzzy Hash: DDC17C34B00605CFDB45DF69C585AAABBF2FF88301B1585AAE506DB366DB30EC45CB60

Function 06447D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce611a3b7bb4c4bce2f2c7f46acb4bf5c2ab36d682fc73aa13ed56b85660d756
Instruction ID: 2dea7f5675777698c26819d766e76d1fbeb25dbc6c4349b53759f52e0a57da73
Opcode Fuzzy Hash: ce611a3b7bb4c4bce2f2c7f46acb4bf5c2ab36d682fc73aa13ed56b85660d756
Instruction Fuzzy Hash: 485156B1E00258CFEB55DFA9C981BDEBBF6AF48300F24852AD415AB350DB349846CF80

Function 064459C8 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f444446b88eb82f6cd073c5819e492f7004bb1baff43d2193fe418a6d47b0509
Instruction ID: 8278c12dcfa72880cba9a89b6863a9779781d4b1b450250a8466d255030920f8
Opcode Fuzzy Hash: f444446b88eb82f6cd073c5819e492f7004bb1baff43d2193fe418a6d47b0509
Instruction Fuzzy Hash: EA517935A00606CFDB15DF59C8809AAFBF2FF88310B15C9AAE5599B365D731F805CB90

Function 06447D4C Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6580954193e3b1e88160c0dae2a474eadf697f4e91f1eb14194b2725e83e52f0
Instruction ID: c56c3ebf5f3fd25b20ab93882d26c17a147931fda3134ae56099568b47fa57d9
Opcode Fuzzy Hash: 6580954193e3b1e88160c0dae2a474eadf697f4e91f1eb14194b2725e83e52f0
Instruction Fuzzy Hash: FC5169B1D00258DFEB55DFA9C985BDEBBF5AF48304F24852AE405AB380DB749846CF80

Function 06445579 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13a328091e2de9a07773d52d1621713b818d22f9cf3364764448d7b394f306b2
Instruction ID: 91e0fea4c7152bc06e34ee738793f0566cc39e3cc894f6e4f9b44c635e13b4ef
Opcode Fuzzy Hash: 13a328091e2de9a07773d52d1621713b818d22f9cf3364764448d7b394f306b2
Instruction Fuzzy Hash: 53318D75B012109FCB0ADF38D88496EBFB2BF89301B00846AE906CB365DB31DD05CB90

Function 06445588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3cd87bc97da3ce925e37e69e6f0c13148eae8b43278c670ce87252bc3584ce2
Instruction ID: 7e11081e3ce5ac97ba3c7d5105ef35dae1d2f02cefc7e6c1fb2f1c7d872b7528
Opcode Fuzzy Hash: e3cd87bc97da3ce925e37e69e6f0c13148eae8b43278c670ce87252bc3584ce2
Instruction Fuzzy Hash: 91315A35B016149FDB19DF38D88496EBBB2FF89340B50846AE906CB365DB31ED05CB90

Function 064487A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc898972f022c2a26112aecb85e06f4c1cca6d9da6f821f7d63df30fd9063c42
Instruction ID: 32f2cdbf7112c0a44f747b9677feb6562d20eac07f22c0441491f1401022a107
Opcode Fuzzy Hash: dc898972f022c2a26112aecb85e06f4c1cca6d9da6f821f7d63df30fd9063c42
Instruction Fuzzy Hash: B54102B1D01248DFDB54DFAAD951ADEFBF6AF88310F20802AE415BB250DB30A945CF90

Function 06448795 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfcc10bc8aa372b80c39d67ec1d75f57ef3e98c4402200a24d92e5a8e1a7ed6e
Instruction ID: b45e73d699d81d59a35ff843ecd089bc2ebce4ea55495e1d363884461cd8aa5f
Opcode Fuzzy Hash: cfcc10bc8aa372b80c39d67ec1d75f57ef3e98c4402200a24d92e5a8e1a7ed6e
Instruction Fuzzy Hash: 2F3113B1D002489FDB14DFAAC995ADEBFF6AF88300F24802AE405BB250DB359945CF90

Function 0642360B Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886778396.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6420000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9cec580529e045100bb0e41998639a1e2f514a9962203218fda9aa3cd73c7ef
Instruction ID: 92e6f203c43202ec67ec58aff91b5ca4d7c2ba33fbc517cdd6f39c660c2a1142
Opcode Fuzzy Hash: d9cec580529e045100bb0e41998639a1e2f514a9962203218fda9aa3cd73c7ef
Instruction Fuzzy Hash: 49215C35B400159FCB54DF69C884DAABBB2FF88714F5180A5E90A9B3A5DA31EC05CB10

Function 064230FB Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886778396.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6420000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e0b515448453e40b47229f84da9b7bfddd9d6d7587ecd0dfcd214fc072b3b83
Instruction ID: 83bb17c2355788f04c4cb60a9972b3d59b8d846b026204dd25ddad0913e54dfa
Opcode Fuzzy Hash: 9e0b515448453e40b47229f84da9b7bfddd9d6d7587ecd0dfcd214fc072b3b83
Instruction Fuzzy Hash: 93216035B40014AFCB54DF69D984EAABBB2FF88714F5180A5E9159B3B6CB31EC05CB50

Function 06448A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c509245795e34cc2550eba0aa2db39efcb8f7ec27e80f27946bd81224e74f263
Instruction ID: 33600a25498b631f05925c8c310b23406dcff6f5680785d67b8633618bcc2b0c
Opcode Fuzzy Hash: c509245795e34cc2550eba0aa2db39efcb8f7ec27e80f27946bd81224e74f263
Instruction Fuzzy Hash: C63112B1D01298DFDB14DFA9D895BDEBBF5AF48310F24842AE405B7240CB34A945CB90

Function 00C9D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1878340563.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af0009a1b73e5c7d148d686684d5b568ed15a8740fb9c9fdd65617d349e18e8d
Instruction ID: a0d8474415536a0f4d0b4ede495a54058cbb6167b4a67050a5b6890caf4b3e50
Opcode Fuzzy Hash: af0009a1b73e5c7d148d686684d5b568ed15a8740fb9c9fdd65617d349e18e8d
Instruction Fuzzy Hash: 39216A71100200DFDF00DF04C9C8B26BF65FB94314F20C169E90A6F216C336E856CBA2

Function 06448F42 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66a16c410f5ef6f372a4a14eb2a59d195a0fe4a4e676848ad5015139dcba40e
Instruction ID: 54e0300d9b6216928684cd62e66138ead664cf62f6ea90abfe5c0d84d0a92c15
Opcode Fuzzy Hash: c66a16c410f5ef6f372a4a14eb2a59d195a0fe4a4e676848ad5015139dcba40e
Instruction Fuzzy Hash: 4E21FEB4D0524ADFDB40DFA8D4816EEBBB1EB48301F2040AAE515A7351D7349A82CF90

Function 00EED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1879193335.0000000000EED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_eed000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0bb524cd42a0941907a2d4add9c112f816a952755e0af5c8a61f9018ec9381
Instruction ID: cf76afde69e2c3de8af002cf72cd38f5b70b7b6601e07add18034eaadbf2249c
Opcode Fuzzy Hash: db0bb524cd42a0941907a2d4add9c112f816a952755e0af5c8a61f9018ec9381
Instruction Fuzzy Hash: 95210471608288DFCB14DF15DDC4B26BFA6FB84318F28C56DD8095B256C33AD847CA61

Function 06448A8C Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 631b4cbec4bcbce6aaeaa5628309892b2a270745bb601d57b43ee241d06c0b8c
Instruction ID: 5b53cdbf194850188b202ee4ff5ff17955960c1e33aea903b15c989f173928c6
Opcode Fuzzy Hash: 631b4cbec4bcbce6aaeaa5628309892b2a270745bb601d57b43ee241d06c0b8c
Instruction Fuzzy Hash: 9C2126B1D00298DFDB14DFA9C895BDEBFF9AB08310F24842AE405BB340CB759945CB94

Function 06446E90 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddde788d31639e700828e0bbbbd196dfcc9afadcd070add9720d84138b919930
Instruction ID: 9664aebc7ae74a70a760a2bec002975602846cc5310c542e00cde25993324905
Opcode Fuzzy Hash: ddde788d31639e700828e0bbbbd196dfcc9afadcd070add9720d84138b919930
Instruction Fuzzy Hash: D81129636081D41FCB534AA99C51AAA3FE8DB4A121B1D4197F9C4D7342C019C91597B0

Function 00EED005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1879193335.0000000000EED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_eed000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28e825ba22a0c256512cf52dc43d5d49fe1f8b141f09a9212473cd82ac64e43f
Instruction ID: 93ebf0fc8fad7bed78e7c0e9839e65951041cdab9aba222be897fd1c23188d61
Opcode Fuzzy Hash: 28e825ba22a0c256512cf52dc43d5d49fe1f8b141f09a9212473cd82ac64e43f
Instruction Fuzzy Hash: 372171755093C48FDB02CF24D994715BF71EB46218F28C5EAD8498B657C33A980ACB62

Function 0644BC5F Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c55e0ce996102b693e3d7598f0999aa9e3f0e5b3cda2590888218ce00979c7d
Instruction ID: 0fa56eff95389a874802e079016c09e205a5fb8bc37400c414a5b42f7c4d0671
Opcode Fuzzy Hash: 5c55e0ce996102b693e3d7598f0999aa9e3f0e5b3cda2590888218ce00979c7d
Instruction Fuzzy Hash: 981108312012045FCBA5AB78E85997EBBE7EFC1250B144429E107C77D0CE30BD4E97A5

Function 00C9D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1878340563.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction ID: fcecab0aa14c4f643a6a1267812d81dcc586604c51195c1ed15c6a8b71ce258f
Opcode Fuzzy Hash: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction Fuzzy Hash: 2A110372404280CFCF02CF00D9C4B16BF71FB94324F24C6A9D80A1B616C33AE95ACBA1

Function 0644C499 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53d7959ec7a1b65eda87742a42c1d3e1262b15f4047ae4596047b63cf44ab62
Instruction ID: 780cf5ef5b366cdb3021a4b1942975414e666f9aef9a2c88f95d6914766a0d0f
Opcode Fuzzy Hash: f53d7959ec7a1b65eda87742a42c1d3e1262b15f4047ae4596047b63cf44ab62
Instruction Fuzzy Hash: CA0104302056058FD321EF74E40866B7BE3EFC5315F108A2AE04687789CF749D0E8BA1

Function 06448350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a6978214c39755ff169e87e8a44b1117d77ea03f8f45e2ae57f3349f895d398
Instruction ID: 4f4e743e160a6ff0ab1e550c8944b912ad5ba556138d26c3d71731ccb35e609a
Opcode Fuzzy Hash: 9a6978214c39755ff169e87e8a44b1117d77ea03f8f45e2ae57f3349f895d398
Instruction Fuzzy Hash: 91017131B102199FDF10DEA9AC45ABFFBBAEBC4651B14803BE504D3340DF31A91587A1

Function 0644BC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce70ab05524d27def81edd7e2b8ef7bc9216f084e5441d4d6feacf12659dc313
Instruction ID: ea7aa4f2a8ed3e4f85709422af2b2995254ba642cb08b524e518da6499b5bd6b
Opcode Fuzzy Hash: ce70ab05524d27def81edd7e2b8ef7bc9216f084e5441d4d6feacf12659dc313
Instruction Fuzzy Hash: 1101B1312001014F8AA4BB78E55952EBBE3FFC0250B444828E1078B7D4DE30BD8E9795

Function 00C9DB09 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1878340563.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a4858a9999e073ee1dbb49b6af59beed36726a0391ed737505c4305f76cc994
Instruction ID: fdac553bf9d7fb4fb6f2896c459a8afb3836bbd55bd7938bcfbf4c699c0d157a
Opcode Fuzzy Hash: 3a4858a9999e073ee1dbb49b6af59beed36726a0391ed737505c4305f76cc994
Instruction Fuzzy Hash: 220126310093409BEF108F2ACD88B67FFD8DF41725F18C92AED1A6B286C638D880D671

Function 0644E8B0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74fe4af94a2f62b18d8773f5bd8b8db90ed3c7324ff8e92217d962fb1844d28d
Instruction ID: 725f5ca7fa3aa2e462f0a613a055ee87655f56c6ab4f71d5f80b18c9774f72ce
Opcode Fuzzy Hash: 74fe4af94a2f62b18d8773f5bd8b8db90ed3c7324ff8e92217d962fb1844d28d
Instruction Fuzzy Hash: C601D6346053489FCB12AB78DC1486A7FBAEF86300B1484EAE501CB362DA32DD05D791

Function 0644FF50 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe1cb685ae63ff25830e893b2fe3a58232c7c6fb0a0df7afc7c5bcdba81092cd
Instruction ID: fda25ab984ada828dce798e4cd99b52dc39beddfd721aa15e591f7552257771c
Opcode Fuzzy Hash: fe1cb685ae63ff25830e893b2fe3a58232c7c6fb0a0df7afc7c5bcdba81092cd
Instruction Fuzzy Hash: 4C011675E002599FDB44DFA9E8046EDBBF2FB89311F14912BE414B3350E7344959CBA4

Function 0644C4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 556a5421c9e1208d767dd202a32e526470fe987ed9080c00f5b97e1a10a256ac
Instruction ID: 5e0dea5c6f099fcf4a9a417fd33e283c42ea10b80c9326878fe6647be06adf00
Opcode Fuzzy Hash: 556a5421c9e1208d767dd202a32e526470fe987ed9080c00f5b97e1a10a256ac
Instruction Fuzzy Hash: 9C019A302016058FD324EFB4E40862ABBE3EBC9315F108A28D15B87788CF74A90E9B91

Function 06445508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa80fd44cbceddd267a77c593a9e5760496753ecd57bb7ff21021d845adf30e1
Instruction ID: b5811c128455390694abc85a3d7f15edaf6aa803b110289782c9198544df0400
Opcode Fuzzy Hash: aa80fd44cbceddd267a77c593a9e5760496753ecd57bb7ff21021d845adf30e1
Instruction Fuzzy Hash: 10018130A11712CFEFAEAA39A506637B7F7BF84205754883EE4068671CDE75E485CB90

Function 0644C170 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 342ed40ca359fb4006bb21e74e6c483d164075324300ae08b4b221b075c9f2ff
Instruction ID: 69d8f685cd979167a96ddc6254c2adfe21cdabf05f6596d63d96108a778ad15c
Opcode Fuzzy Hash: 342ed40ca359fb4006bb21e74e6c483d164075324300ae08b4b221b075c9f2ff
Instruction Fuzzy Hash: 7801D131106B059FD331EF61F808562BBFAFB89300700C61AE48B86650CB30A94ECFA4

Function 0644ADE9 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d38cec468661ba4e889196c52bb4dfe5159187e27aee5f3eb61714789ca8854
Instruction ID: c7e1af5016143cfbe8e302681680753918194f5ff709e48d643b9924d9d9075f
Opcode Fuzzy Hash: 1d38cec468661ba4e889196c52bb4dfe5159187e27aee5f3eb61714789ca8854
Instruction Fuzzy Hash: AFF082312052416FC7112B69B899AAFBFEAEBCB764B04406DF10AC7283CA615C4987B5

Function 06448F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 502e7c2db4a1f81e97b44c14cd394bc5c52a1eeaeb0914cfdd70553a80c37566
Instruction ID: d0b902f2a29775795672f37902c4d2317ea03aa9ba954e61924efcd47e4c8ba1
Opcode Fuzzy Hash: 502e7c2db4a1f81e97b44c14cd394bc5c52a1eeaeb0914cfdd70553a80c37566
Instruction Fuzzy Hash: 4801C0B4D0525AEFDB44EFA9D9456AEBBF2FB48301F1080AAA815B3350E7745A41CF90

Function 00C9DB08 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1878340563.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f17e849d76ca6ba9d705ad8229fd86ab823661d67d282a16a6b57ad6ed126c5
Instruction ID: 83dcf8142d5b48d1baa970370b35d3d49c860e93b5a4d2d3fff52730d5dcf713
Opcode Fuzzy Hash: 3f17e849d76ca6ba9d705ad8229fd86ab823661d67d282a16a6b57ad6ed126c5
Instruction Fuzzy Hash: 6BF0C2720043809BEB108E16CC88B62FFA8EF50735F18C45AED085B286C2799880CA70

Function 0644FF60 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd9f579fdab099ff6f8c8f976ce502a1f6885477698af388309b85efe69ac9c0
Instruction ID: 3e1388b1160e3bb9e3f9da1560172e9d8f2531ee0fffaf406b4f3e570fa8dbfd
Opcode Fuzzy Hash: bd9f579fdab099ff6f8c8f976ce502a1f6885477698af388309b85efe69ac9c0
Instruction Fuzzy Hash: C3F01475E042188BDB44DFAAE844AEDBBF5AB8D310F00912AE404B7350DB345948CBA4

Function 0644ACB8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01e7a724b1ba11d03ff464200af10b9c136f40a665dc891e9a8cf64971f19439
Instruction ID: 0eec0cfa699c2961ffe873d9a1d65b979b672f81f5947b0d365a81670a325d42
Opcode Fuzzy Hash: 01e7a724b1ba11d03ff464200af10b9c136f40a665dc891e9a8cf64971f19439
Instruction Fuzzy Hash: A4F059712081A21FC32227396C190BE3FA6E9C3651308009BE142C7295CA14494AD3E5

Function 0644C110 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553280fe9e2a0ec523fb5a5816061b71ed374607f30c41441cdd43352b8398d0
Instruction ID: 78fed92e442161c556d7d479906ace09a3049bf8fe843ab7ac6d74f9bea37c5f
Opcode Fuzzy Hash: 553280fe9e2a0ec523fb5a5816061b71ed374607f30c41441cdd43352b8398d0
Instruction Fuzzy Hash: 1AF02B3114A7D44FC332D739F81969B7FF6DF82214B04045AE182CB253CA615D4887A1

Function 06446EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46939df6144623a67b905f5b8b0fa1237838e927f94b82a84d52065ebab7e139
Instruction ID: c530fe48c462588b5bffd70ee4eb209a81a7f50a05b8fd4262e98d9628b55883
Opcode Fuzzy Hash: 46939df6144623a67b905f5b8b0fa1237838e927f94b82a84d52065ebab7e139
Instruction Fuzzy Hash: C1F012662041E83F8B514E9A5C15CFB7FEDDB8E2617084156FE98D2241C429C921ABB0

Function 064467C8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9986d473a0a02ea3685758dcbb7b27af355a2dd08ca87a9b3881d787f32a50aa
Instruction ID: e26e2bb0faab4bbaf375a944cb958db893243d5a66d4d453bec0c1cb6c3d59cb
Opcode Fuzzy Hash: 9986d473a0a02ea3685758dcbb7b27af355a2dd08ca87a9b3881d787f32a50aa
Instruction Fuzzy Hash: 79F02E31B413008FD7219BA8E806F92BFE1AB42311F128227F210CF2E2D3B1E80A8740

Function 06448340 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4e5583596d37251b18c9dbe0e757a9d2f62a3cf3cf5cc5e4943f1e52d659c07
Instruction ID: 0b8f2e5ba115ef35eccdbb7d79d896c4044b0577080a78b68b134589f95b2de6
Opcode Fuzzy Hash: a4e5583596d37251b18c9dbe0e757a9d2f62a3cf3cf5cc5e4943f1e52d659c07
Instruction Fuzzy Hash: E0F08232B142195BCF11BA69AC45AAFBFF9EBC5261F19443BE554D3200EB31E401C792

Function 06448FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d0f9e5f8b7796e7393a059af4ea893ca2f9832690b1b01dd4ecde3294397d34
Instruction ID: bfee64d819ed9f7263285e0e8cae1bca2aa8ce96d50efed92e60012e298faa67
Opcode Fuzzy Hash: 4d0f9e5f8b7796e7393a059af4ea893ca2f9832690b1b01dd4ecde3294397d34
Instruction Fuzzy Hash: 62F0CDB0C09159DFEB00DFA0D8465AEBFB1FB5A201F0041D7E402E7351E7398A02CB40

Function 064454F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a4c9ba79db2603dbf634c84b1e887409f045bcd4dbf58571bc65bbab28c962
Instruction ID: 73a1a3c09d68b1e4e1f7f9bc8cd65177779a017b79c0b7f8e859a532c0cd9a49
Opcode Fuzzy Hash: 90a4c9ba79db2603dbf634c84b1e887409f045bcd4dbf58571bc65bbab28c962
Instruction Fuzzy Hash: 3BF024319007018FEFA9DA75E50277BFBB2BF80314F08C86ED04642A28CA74E485CF40

Function 0644ADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88a6962867c4b82b968effdd9c2112d8758bdc1bde09b82da2e4cd90d2f26039
Instruction ID: c5a63129b271c2d5e9cafc75bc556da22c1d2f4677666a64cbb3e75f07486a2c
Opcode Fuzzy Hash: 88a6962867c4b82b968effdd9c2112d8758bdc1bde09b82da2e4cd90d2f26039
Instruction Fuzzy Hash: 49E092312001126FC7202A5AB449A9EBAEAEBCA361B00403CF20EC3282CA715C0957A9

Function 0644C180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00be3cf288d5f07f915a430e060e9089660bcd0481e1666084b56b5a0f282998
Instruction ID: 6cbcdd75255fafd9470ae2e6b5f5552c6f1cb56bb222b42d7bc2c655f8431ed9
Opcode Fuzzy Hash: 00be3cf288d5f07f915a430e060e9089660bcd0481e1666084b56b5a0f282998
Instruction Fuzzy Hash: 8AF09035502B018FD735DF66E408512BBF6FB88301B00C62EE54B82A50DB70A949CF84

Function 0644CC38 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea8c69431beb2376ebf4fbc415de3d9f5c8c471178009c9df1f31f28ffee41e1
Instruction ID: ec3e13819530de5398d22b0ab544b6eaf089f2d1cfd7e2bed6409b8d4d3c2d98
Opcode Fuzzy Hash: ea8c69431beb2376ebf4fbc415de3d9f5c8c471178009c9df1f31f28ffee41e1
Instruction Fuzzy Hash: D1E0D83321B2506FD612AB14F8419DABF52D783751B005162E106CB746DA300D4D87F2

Function 0644B500 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3adbc6e1e06688af344fa55198fe0de2a8fbe6a37777ab5cf6f35ae184c4ebb5
Instruction ID: 972b023767cc5f864bda4fc74504c9c3a7e536c29151665f1aed604e43217301
Opcode Fuzzy Hash: 3adbc6e1e06688af344fa55198fe0de2a8fbe6a37777ab5cf6f35ae184c4ebb5
Instruction Fuzzy Hash: 5BF03935D0120CFFCB11DFB4EA488CDBFB9EB44200F1042A6E805E3284EA315B49DB91

Function 0644C120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4866ae2ce414fbcea181f7ccfe8cc8cdcf25345dcb45438f442556f71ebbafd
Instruction ID: 113a3e179f52125d7a77c0affa47168b2f467b9973bcff75cc14cd136f06ebab
Opcode Fuzzy Hash: b4866ae2ce414fbcea181f7ccfe8cc8cdcf25345dcb45438f442556f71ebbafd
Instruction Fuzzy Hash: 63E0A030201B514FC731E72DE50979E7BE6DF85314F040429E24687742CBA1A8098795

Function 0644CE88 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ab95281351eea442d23e03272722a3170c37fae060feca434cea9dd7bc67ee1
Instruction ID: 32786e91f52835cf18a3142acb60ea2e3340ee43b86e95a2992b5edbbb6828b4
Opcode Fuzzy Hash: 4ab95281351eea442d23e03272722a3170c37fae060feca434cea9dd7bc67ee1
Instruction Fuzzy Hash: 98E0207101A380FFE712B324F4469A67F76DB433107051056E8468FA45E7304E85C3F1

Function 06445698 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0c90a0c06ed7c9c50f69d8bbd8bccd3e64ec7dfd4dc7a03e44b91e21f000487
Instruction ID: 712924570988c33ff672abaed53cc0c9ab57fb96eea59a8c4064401f65b0603b
Opcode Fuzzy Hash: d0c90a0c06ed7c9c50f69d8bbd8bccd3e64ec7dfd4dc7a03e44b91e21f000487
Instruction Fuzzy Hash: ADE06DB210D2019FD305DB24E8448967BE4EB91210B01C86FE48187241E731E841CBA5

Function 0644E8F8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d92ec4e0c4c9b45683114aafe19e67eab7b34594845b4bb6be4a22a03ca169e
Instruction ID: 7fd0742c167ac4ab12e5d0d1259bf09434a99720bf7845b4352e6fe28a35d7c0
Opcode Fuzzy Hash: 3d92ec4e0c4c9b45683114aafe19e67eab7b34594845b4bb6be4a22a03ca169e
Instruction Fuzzy Hash: 45E0123A116248AFD7029B54DC40CA73F7DEF89A5431440C6F5418F172C6229D21DBB1

Function 0644E280 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9dd03133d02489751a0e87f3b573fb55efa658c143d5062a5930c7df4cc683
Instruction ID: 8ce66fb54845ae7c7a110e2f3ee74c1f714c0ac85bc90f0ea8406149204b20f8
Opcode Fuzzy Hash: 8a9dd03133d02489751a0e87f3b573fb55efa658c143d5062a5930c7df4cc683
Instruction Fuzzy Hash: E9E0D83100A7415FDB11FB14FC42995B7A2F746700B010045D8065F2AADB744E4997E5

Function 0644E1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ce8bb0e465d69aef88032fef9a294e1d238dc273282965988c225031bf89ed
Instruction ID: fe9b80d39ba8184c33db1aab7990c5a49d95fe8079de46939ea65469ec19fa2e
Opcode Fuzzy Hash: 26ce8bb0e465d69aef88032fef9a294e1d238dc273282965988c225031bf89ed
Instruction Fuzzy Hash: B1E0D871A45244FFCB11DB64E80159E7BB1DB82200B2441D6D405D72D1D6300F149B92

Function 0644AC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46f0abee62faae8234ab73249c149a8e038370e0bfba7f38082e24d2bcbaed58
Instruction ID: afd5501d3fc6437f7644cb3568a96ad90ab793507dca3d989b3ae5ed099cd05e
Opcode Fuzzy Hash: 46f0abee62faae8234ab73249c149a8e038370e0bfba7f38082e24d2bcbaed58
Instruction Fuzzy Hash: 5ED05E3130012A5B8A25276AF45C4AE7BEBEBC6672704012AE60BC3340CF656D4A97D9

Function 0644B510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 338a47da66077b27a524a19062e813752261c4ea159b15bba0e9b06504c236f6
Instruction ID: 81b9dd52b24c6482ee4f7877676498eecffcc72891bc2142895ed873902ffd10
Opcode Fuzzy Hash: 338a47da66077b27a524a19062e813752261c4ea159b15bba0e9b06504c236f6
Instruction Fuzzy Hash: 5AE09275E0120CEFCB50DFE4E9448DDBBB9EB48201F1082AAD909A3240EB306B59DF80

Function 0644E210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f937a3ccd4ddf9c8f497b6bc94804bc6f6d6aba77d05d213359f300675b61fea
Instruction ID: 2234d001fd07fe0e43ae4bf2e3d95d52ab32b31e3f92c203e9574050752188ee
Opcode Fuzzy Hash: f937a3ccd4ddf9c8f497b6bc94804bc6f6d6aba77d05d213359f300675b61fea
Instruction Fuzzy Hash: 43D05EB1A0120CFFCB40EFA8E90195DB7FAEB85304B2041A9D409E7380EB316F04AB91

Function 0644F8EA Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d127c09dcb189608872720ed6c90a4091dbabf0e03f9bb1ee13bea045dfaf3
Instruction ID: 4961adf6bfb3660679b20643cd06bf6bd16ad4c606bca7fb7f8335922b152cdc
Opcode Fuzzy Hash: f4d127c09dcb189608872720ed6c90a4091dbabf0e03f9bb1ee13bea045dfaf3
Instruction Fuzzy Hash: 0EC012727001200B06A4A66CB02507E66E7D3C82E3395003BF60EC3388EE618C4A5386

Function 06443721 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0505c4fe2605bd977a4fc3d9f8a4915a45d542def409201db7cdeb0a59742cd9
Instruction ID: 551f22d74623b3c26a6b7c77d9e18cd0f014aac3e29ccea44c79be6ffdd41d97
Opcode Fuzzy Hash: 0505c4fe2605bd977a4fc3d9f8a4915a45d542def409201db7cdeb0a59742cd9
Instruction Fuzzy Hash: E7C08C7058E3808FC3024790380ED503E30ABA2B40F030083E2628F093D2950628C676

Function 0644DFD1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6ca14af5f4ee25ed7b262cdb08752b00cd9c327b3aa69366795c3e55459400d
Instruction ID: 1c98d14204a27e5caee3356d4f3afcd4e5d4fdc1d0658016fc4b650dc625203b
Opcode Fuzzy Hash: c6ca14af5f4ee25ed7b262cdb08752b00cd9c327b3aa69366795c3e55459400d
Instruction Fuzzy Hash: 48C09B3158B7D45FDB060771DD0D8853F25AF5372571710C7E3418D0B7D6120085CB91

Non-executed Functions

Function 0644E2C7 Relevance: 46.6, Strings: 37, Instructions: 391COMMON

Download Yara Rule

Strings

D6j, xrefs: 0644E3C2
D6j, xrefs: 0644E456
D6j, xrefs: 0644E4A3
D6j, xrefs: 0644E720
D6j, xrefs: 0644E431
D6j, xrefs: 0644E819
D6j, xrefs: 0644E608
D6j, xrefs: 0644E51B
D6j, xrefs: 0644E6D0
D6j, xrefs: 0644E4CB
D6j, xrefs: 0644E748
D6j, xrefs: 0644E844
D6j, xrefs: 0644E47B
D6j, xrefs: 0644E2E4
D6j, xrefs: 0644E770
D6j, xrefs: 0644E56B
D6j, xrefs: 0644E543
D6j, xrefs: 0644E353
D6j, xrefs: 0644E4F3
D6j, xrefs: 0644E32E
D6j, xrefs: 0644E6F8
D6j, xrefs: 0644E3E7
D6j, xrefs: 0644E378
D6j, xrefs: 0644E309
D6j, xrefs: 0644E5E3
D6j, xrefs: 0644E86F
D6j, xrefs: 0644E7C3
D6j, xrefs: 0644E593
D6j, xrefs: 0644E630
D6j, xrefs: 0644E658
D6j, xrefs: 0644E7EE
D6j, xrefs: 0644E39D
D6j, xrefs: 0644E6A8
D6j, xrefs: 0644E798
D6j, xrefs: 0644E5BB
D6j, xrefs: 0644E40C
D6j, xrefs: 0644E680

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j
API String ID: 0-3780336332
Opcode ID: 3b8af41741e9e94ce7ba3ad32aff8adf20b68e0aec605b70d274135fee6cb837
Instruction ID: 8bf06f7680a44da7509d0161605a08b0bee2843984a19223d3fc6cce55d5a79e
Opcode Fuzzy Hash: 3b8af41741e9e94ce7ba3ad32aff8adf20b68e0aec605b70d274135fee6cb837
Instruction Fuzzy Hash: 61D1AF32300701AFDB056AA5DC53A6DE653FBC6300B504438E1064FBAEDF75AD5E93A6

Function 0644E2D8 Relevance: 46.6, Strings: 37, Instructions: 383COMMON

Download Yara Rule

Strings

D6j, xrefs: 0644E3C2
D6j, xrefs: 0644E456
D6j, xrefs: 0644E4A3
D6j, xrefs: 0644E720
D6j, xrefs: 0644E431
D6j, xrefs: 0644E819
D6j, xrefs: 0644E608
D6j, xrefs: 0644E51B
D6j, xrefs: 0644E6D0
D6j, xrefs: 0644E4CB
D6j, xrefs: 0644E748
D6j, xrefs: 0644E844
D6j, xrefs: 0644E47B
D6j, xrefs: 0644E2E4
D6j, xrefs: 0644E770
D6j, xrefs: 0644E56B
D6j, xrefs: 0644E543
D6j, xrefs: 0644E353
D6j, xrefs: 0644E4F3
D6j, xrefs: 0644E32E
D6j, xrefs: 0644E6F8
D6j, xrefs: 0644E3E7
D6j, xrefs: 0644E378
D6j, xrefs: 0644E309
D6j, xrefs: 0644E5E3
D6j, xrefs: 0644E86F
D6j, xrefs: 0644E7C3
D6j, xrefs: 0644E593
D6j, xrefs: 0644E630
D6j, xrefs: 0644E658
D6j, xrefs: 0644E7EE
D6j, xrefs: 0644E39D
D6j, xrefs: 0644E6A8
D6j, xrefs: 0644E798
D6j, xrefs: 0644E5BB
D6j, xrefs: 0644E40C
D6j, xrefs: 0644E680

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j
API String ID: 0-3780336332
Opcode ID: 3f6b234967c7fa8601088a3cf64ad17e747ac851dc2f6a8da1f57214cdc8caba
Instruction ID: be381910733df8f145a29822ea5c35f9a54c79a47e2fe7f2c345ff53b4cc1815
Opcode Fuzzy Hash: 3f6b234967c7fa8601088a3cf64ad17e747ac851dc2f6a8da1f57214cdc8caba
Instruction Fuzzy Hash: D9D1A031300701AFDA057AA5DC53A6DE253BBCA300B904438E1064FBAEDF75AD5E9396

Function 0644CC7F Relevance: 16.4, Strings: 13, Instructions: 152COMMON

Download Yara Rule

Strings

D6j, xrefs: 0644CCE6
D6j, xrefs: 0644CE33
D6j, xrefs: 0644CD55
D6j, xrefs: 0644CD0B
D6j, xrefs: 0644CC9C
D6j, xrefs: 0644CD30
D6j, xrefs: 0644CE58
D6j, xrefs: 0644CE0E
D6j, xrefs: 0644CD7A
D6j, xrefs: 0644CCC1
D6j, xrefs: 0644CD9F
D6j, xrefs: 0644CDE9
D6j, xrefs: 0644CDC4

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j
API String ID: 0-2047240224
Opcode ID: 32b01f3085514b634fc9eb118d633e19581cf79c912e486744a35f920a8f9d43
Instruction ID: 2afa8c901e7e35828ad0cfddebf84f98a64324fa8f29b32f3c92b38eabee901c
Opcode Fuzzy Hash: 32b01f3085514b634fc9eb118d633e19581cf79c912e486744a35f920a8f9d43
Instruction Fuzzy Hash: 8A41B5323007016FDA056EA5DC4262DE653FBC6300B504538E20A4FB9ADF76AD5A83A7

Function 0644CC90 Relevance: 16.4, Strings: 13, Instructions: 143COMMON

Download Yara Rule

Strings

D6j, xrefs: 0644CCE6
D6j, xrefs: 0644CE33
D6j, xrefs: 0644CD55
D6j, xrefs: 0644CD0B
D6j, xrefs: 0644CC9C
D6j, xrefs: 0644CD30
D6j, xrefs: 0644CE58
D6j, xrefs: 0644CE0E
D6j, xrefs: 0644CD7A
D6j, xrefs: 0644CCC1
D6j, xrefs: 0644CD9F
D6j, xrefs: 0644CDE9
D6j, xrefs: 0644CDC4

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j
API String ID: 0-2047240224
Opcode ID: d4020d3ac68a787e6b233c01f7d534ce419bb2d282db261c1ab68d17f854ee0b
Instruction ID: 21af1a81117db6e6d75f5caf7fe7b9e325df948d226f39d8370cc67cb4d0c795
Opcode Fuzzy Hash: d4020d3ac68a787e6b233c01f7d534ce419bb2d282db261c1ab68d17f854ee0b
Instruction Fuzzy Hash: 3F41A4323007016FDA057EA5DC4762DE653FBCA300B504938E20A4FB9ADF75AD5A8796

Function 0644CED1 Relevance: 10.1, Strings: 8, Instructions: 106COMMON

Download Yara Rule

Strings

D6j, xrefs: 0644CFEF
D6j, xrefs: 0644CF11
D6j, xrefs: 0644CF36
D6j, xrefs: 0644CF80
D6j, xrefs: 0644CFCA
D6j, xrefs: 0644CF5B
D6j, xrefs: 0644CFA5
D6j, xrefs: 0644CEEC

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j
API String ID: 0-2315863240
Opcode ID: 03a2af2bafc51964fd06e882a96a0bd552fa2c3f949f48058fb64a9d49fad338
Instruction ID: b5c43b187e04788dcf74fb9f2da613c8251f508e6ad7f5a5499baebe9d036f5f
Opcode Fuzzy Hash: 03a2af2bafc51964fd06e882a96a0bd552fa2c3f949f48058fb64a9d49fad338
Instruction Fuzzy Hash: E731B7327403016FDB016EA59C42A7DF657FBC6300B904538F10A4FB9ADF75AD5983A6

Function 0644CEE0 Relevance: 10.1, Strings: 8, Instructions: 93COMMON

Download Yara Rule

Strings

D6j, xrefs: 0644CFEF
D6j, xrefs: 0644CF11
D6j, xrefs: 0644CF36
D6j, xrefs: 0644CF80
D6j, xrefs: 0644CFCA
D6j, xrefs: 0644CF5B
D6j, xrefs: 0644CFA5
D6j, xrefs: 0644CEEC

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: D6j$D6j$D6j$D6j$D6j$D6j$D6j$D6j
API String ID: 0-2315863240
Opcode ID: 76dfd7b83719ad65c728e6ec0e728ccfd381b76cba1a0ef1f0a6b6b34d8f5399
Instruction ID: e3898ed039c940ca1d061b0b8d25b60bd3de416c21db298104f95f48e538fd77
Opcode Fuzzy Hash: 76dfd7b83719ad65c728e6ec0e728ccfd381b76cba1a0ef1f0a6b6b34d8f5399
Instruction Fuzzy Hash: A021A5327003016FDB056EA5DC43A2DE653FBC6700B904538E20A4FB9ECF75AD9983A6

Function 0644C968 Relevance: 8.8, Strings: 7, Instructions: 89COMMON

Download Yara Rule

Strings

D6j, xrefs: 0644C9AD
D6j, xrefs: 0644CA51
D6j, xrefs: 0644CA7A
D6j, xrefs: 0644C9FF
D6j, xrefs: 0644C9D6
D6j, xrefs: 0644C984
D6j, xrefs: 0644CA28

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: D6j$D6j$D6j$D6j$D6j$D6j$D6j
API String ID: 0-1746523011
Opcode ID: 3ea391ec9958eb2e93cf9a4408905268bb3b742c351f5e4288fa65b876f76e4b
Instruction ID: 570bfe4c2a32214cdc8b758ebfb29945238460a5c5adcc4081487dedf8657872
Opcode Fuzzy Hash: 3ea391ec9958eb2e93cf9a4408905268bb3b742c351f5e4288fa65b876f76e4b
Instruction Fuzzy Hash: C431C0323056826FDF012BA0ED4696D7B63FB863007105538F1068F6A9CFB05E9E8792

Function 0644C978 Relevance: 8.8, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

D6j, xrefs: 0644C9AD
D6j, xrefs: 0644CA51
D6j, xrefs: 0644CA7A
D6j, xrefs: 0644C9FF
D6j, xrefs: 0644C9D6
D6j, xrefs: 0644C984
D6j, xrefs: 0644CA28

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: D6j$D6j$D6j$D6j$D6j$D6j$D6j
API String ID: 0-1746523011
Opcode ID: 2c196c9fc5a5314e386dbb4d99527bd72af8473a0f119ecd4bbdb593322928e9
Instruction ID: ea798b59849076b8cca16e326c9e004776019e1775db7b44f5ae158f50cb9984
Opcode Fuzzy Hash: 2c196c9fc5a5314e386dbb4d99527bd72af8473a0f119ecd4bbdb593322928e9
Instruction Fuzzy Hash: B1218B32300642AFDF052BE4DD4696DBB63FB863007505438E1068F7A9CFB15E9E8B92

Function 0644ED10 Relevance: 7.9, Strings: 6, Instructions: 381COMMON

Download Yara Rule

Strings

(_^q, xrefs: 0644F0F9
(_^q, xrefs: 0644EF79
(_^q, xrefs: 0644ED7A
(_^q, xrefs: 0644EDF9
(_^q, xrefs: 0644F07A
(_^q, xrefs: 0644EEFA

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q$(_^q$(_^q
API String ID: 0-2896069617
Opcode ID: 942bc5cb87e55e5edc0e8196639c90c60168f8d3d218db184b4b9311c34e4d96
Instruction ID: 441e492b6eb78a7f4dbf17a54a13aa100603fa42042e76dc525e859dd3e194d3
Opcode Fuzzy Hash: 942bc5cb87e55e5edc0e8196639c90c60168f8d3d218db184b4b9311c34e4d96
Instruction Fuzzy Hash: A1D1FD34B042449FDB55AF78C4155AE7BB2FFC6310F2481AAE906CB382DA31DE06CB91

Function 0644D538 Relevance: 7.6, Strings: 6, Instructions: 84COMMON

Download Yara Rule

Strings

D6j, xrefs: 0644D5C3
D6j, xrefs: 0644D579
D6j, xrefs: 0644D554
D6j, xrefs: 0644D59E
D6j, xrefs: 0644D60D
D6j, xrefs: 0644D5E8

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: D6j$D6j$D6j$D6j$D6j$D6j
API String ID: 0-3168718324
Opcode ID: 6b7c68a29beee7d26b667add870a057d4cddbb075961bb479564873bddb53514
Instruction ID: 4c79a4414c0c0d8e11a4d1b4968f761d1a1c05f84a91df6e56b42d9847f38525
Opcode Fuzzy Hash: 6b7c68a29beee7d26b667add870a057d4cddbb075961bb479564873bddb53514
Instruction Fuzzy Hash: EB21F8327043406FDA016AA5AC42A6DE757EBC6704B504538F1064FB9ACF726D9D83A2

Function 0644D548 Relevance: 7.6, Strings: 6, Instructions: 73COMMON

Download Yara Rule

Strings

D6j, xrefs: 0644D5C3
D6j, xrefs: 0644D579
D6j, xrefs: 0644D554
D6j, xrefs: 0644D59E
D6j, xrefs: 0644D60D
D6j, xrefs: 0644D5E8

Memory Dump Source

Source File: 00000003.00000002.1886802091.0000000006440000.00000040.00000800.00020000.00000000.sdmp, Offset: 06440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6440000_RegAsm.jbxd

Similarity

API ID:
String ID: D6j$D6j$D6j$D6j$D6j$D6j
API String ID: 0-3168718324
Opcode ID: 7c7126daf4054cd6ea7d395c536a38d25f5c40e6d8a89236339673e9829233ac
Instruction ID: 45bd4313b7ba4789d3d0e177c579a4a061db6369ebdef23689e9d84ec04c285d
Opcode Fuzzy Hash: 7c7126daf4054cd6ea7d395c536a38d25f5c40e6d8a89236339673e9829233ac
Instruction Fuzzy Hash: D311A5327003016FDA056EA9DC52A2DE657FBC6700F504538E1064FB99DF72AD9983A6

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FkJbps6Srrl6lOQ9M_l8dpw2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Users\user\AppData\Local\Temp\TmpBEEC.tmp

C:\Users\user\AppData\Local\Temp\TmpBEFD.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
FkJbps6Srrl6lOQ9M_l8dpw2.exe

Function 00B1018D Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 0050534E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00507849 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Function 0051554F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 78
COMMON

Function 00515653 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
memoryCOMMON

Function 00501FC8 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 005086C8 Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Function 0050B74D Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 004F13CB Relevance: 3.1, APIs: 2, Instructions: 134
COMMON

Function 005082CA Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 00505AA3 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 005057E8 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Function 00515637 Relevance: 3.0, APIs: 2, Instructions: 12
synchronizationthreadCOMMON

Function 0050B351 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Function 004F6F32 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre