Edit tour

Windows Analysis Report
hObXeMHkSShI8GL7378ICT2M.exe

Overview

General Information

Sample name:	hObXeMHkSShI8GL7378ICT2M.exe
Analysis ID:	1483179
MD5:	9e96179dbd4fa2006157a4617e270555
SHA1:	6d46e5f13b7fa00b0034a4881d07b8d5776faa10
SHA256:	7a4b5e91d0222c145a45c4c844136be284a4df98737c6dae589d65c439d0e6d2
Tags:	exe
Infos:

Detection

PureLog Stealer, RedLine, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Yara detected zgRAT

AI detected suspicious sample

Allocates memory in foreign processes

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Enables security privileges

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

hObXeMHkSShI8GL7378ICT2M.exe (PID: 7284 cmdline: "C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe" MD5: 9E96179DBD4FA2006157A4617E270555)

conhost.exe (PID: 7292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7348 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

conhost.exe (PID: 7356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.1683008996.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7348	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.RegAsm.exe.400000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
2.2.RegAsm.exe.400000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
2.2.RegAsm.exe.400000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x4a5bb:$s1: file:/// 0x4a4f3:$s2: {11111-22222-10009-11112} 0x4a54b:$s3: {11111-22222-50001-00000} 0x475a5:$s4: get_Module 0x41730:$s5: Reverse 0x42512:$s6: BlockCopy 0x4170d:$s7: ReadByte 0x4a5cd:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.hObXeMHkSShI8GL7378ICT2M.exe.250000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.hObXeMHkSShI8GL7378ICT2M.exe.250000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.hObXeMHkSShI8GL7378ICT2M.exe.250000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x73df3:$s1: file:/// 0x73d2b:$s2: {11111-22222-10009-11112} 0x73d83:$s3: {11111-22222-50001-00000} 0x70ddd:$s4: get_Module 0x6af68:$s5: Reverse 0x6bd4a:$s6: BlockCopy 0x6af45:$s7: ReadByte 0x73e05:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
Click to see the 1 entries

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.4

Timestamp:	2024-07-26T19:21:16.347532+0200
SID:	2022930
Source Port:	443
Destination Port:	49735
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.4

Timestamp:	2024-07-26T19:21:55.841273+0200
SID:	2022930
Source Port:	443
Destination Port:	55184
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: hObXeMHkSShI8GL7378ICT2M.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: hObXeMHkSShI8GL7378ICT2M.exe

ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: hObXeMHkSShI8GL7378ICT2M.exe

Joe Sandbox ML: detected

Source: hObXeMHkSShI8GL7378ICT2M.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: hObXeMHkSShI8GL7378ICT2M.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe

Code function: 0_2_00267E68 FindFirstFileExW,

0_2_00267E68

Source: RegAsm.exe, 00000002.00000002.1684595853.00000000029F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\^q equals www.youtube.com (Youtube)
Source: RegAsm.exe, 00000002.00000002.1684595853.00000000029F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: RegAsm.exe, 00000002.00000002.1684595853.00000000029F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\^q equals www.youtube.com (Youtube)
Source: RegAsm.exe, 00000002.00000002.1684595853.00000000029F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb`,^q equals www.youtube.com (Youtube)
Source: RegAsm.exe, 00000002.00000002.1684595853.00000000029F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `,^q#www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)

Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: RegAsm.exe, 00000002.00000002.1684595853.0000000002911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.s
Source: RegAsm.exe, 00000002.00000002.1684595853.0000000002911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: RegAsm.exe, 00000002.00000002.1684595853.0000000002A42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/

Source: RegAsm.exe, 00000002.00000002.1684595853.0000000002B89000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_254d4716-9

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.hObXeMHkSShI8GL7378ICT2M.exe.250000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen

Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: 0_2_002670FA	0_2_002670FA
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: 0_2_0026A719	0_2_0026A719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_027825B0	2_2_027825B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_027825A2	2_2_027825A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02780878	2_2_02780878
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02780869	2_2_02780869
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_04F210B4	2_2_04F210B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_04F23078	2_2_04F23078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_04F23069	2_2_04F23069

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe

Code function: String function: 00258900 appears 49 times

Source: hObXeMHkSShI8GL7378ICT2M.exe, 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenameOzzus.exe" vs hObXeMHkSShI8GL7378ICT2M.exe

Source: hObXeMHkSShI8GL7378ICT2M.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.hObXeMHkSShI8GL7378ICT2M.exe.250000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: classification engine

Classification label: mal100.troj.evad.winEXE@5/1@0/0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7356:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7292:120:WilError_03

Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe

Command line argument: &

0_2_0026E840

Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: hObXeMHkSShI8GL7378ICT2M.exe

ReversingLabs: Detection: 71%

Source: unknown	Process created: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe "C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe"
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textshaping.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: hObXeMHkSShI8GL7378ICT2M.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: hObXeMHkSShI8GL7378ICT2M.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: hObXeMHkSShI8GL7378ICT2M.exe

Static PE information: section name: .zzz

Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: 0_2_002580D5 push ecx; ret		0_2_002580E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_04F2A350 push esp; ret		2_2_04F2A351

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe, 00000002.00000002.1684595853.0000000002A42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE@\^Q
Source: RegAsm.exe, 00000002.00000002.1684595853.0000000002A42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE`,^Q
Source: RegAsm.exe, 00000002.00000002.1684595853.0000000002A42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2780000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4910000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7404

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe

Code function: 0_2_00267E68 FindFirstFileExW,

0_2_00267E68

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: RegAsm.exe, 00000002.00000002.1684595853.0000000002A42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe`,^q
Source: RegAsm.exe, 00000002.00000002.1684595853.0000000002A42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe
Source: RegAsm.exe, 00000002.00000002.1684595853.0000000002A42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe@\^q

Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe

Code function: 0_2_0025872E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0025872E

Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: 0_2_0025FEDA mov ecx, dword ptr fs:[00000030h]		0_2_0025FEDA
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: 0_2_00263792 mov eax, dword ptr fs:[00000030h]		0_2_00263792

Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe

Code function: 0_2_00269050 GetProcessHeap,

0_2_00269050

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: 0_2_0025888A SetUnhandledExceptionFilter,	0_2_0025888A
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: 0_2_00258945 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00258945
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: 0_2_0025872E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0025872E
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: 0_2_0025C713 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0025C713

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe

Code function: 0_2_00BD018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_00BD018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 45A000	Jump to behavior
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 462000	Jump to behavior
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 9ED008	Jump to behavior

Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: RegAsm.exe, 00000002.00000002.1684595853.0000000002B89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: RegAsm.exe, 00000002.00000002.1684595853.0000000002B89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow

Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe

Code function: 0_2_00258525 cpuid

0_2_00258525

Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: EnumSystemLocalesW,	0_2_00263015
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0026B07B
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: GetLocaleInfoW,	0_2_0026B2CE
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0026B3F7
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0026AC68
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: GetLocaleInfoW,	0_2_0026B4FD
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: GetLocaleInfoW,	0_2_0026353B
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0026B5CC
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: GetLocaleInfoW,	0_2_0026AE63
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: EnumSystemLocalesW,	0_2_0026AF0A
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: EnumSystemLocalesW,	0_2_0026AF55
Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe	Code function: EnumSystemLocalesW,	0_2_0026AFF0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe

Code function: 0_2_00258B42 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00258B42

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hObXeMHkSShI8GL7378ICT2M.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1683008996.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7348, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hObXeMHkSShI8GL7378ICT2M.exe.250000.0.unpack, type: UNPACKEDPE

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hObXeMHkSShI8GL7378ICT2M.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1683008996.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7348, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hObXeMHkSShI8GL7378ICT2M.exe.250000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	412 Process Injection	1 Masquerading	11 Input Capture	1 System Time Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	412 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
hObXeMHkSShI8GL7378ICT2M.exe	71%	ReversingLabs	Win32.Trojan.Fragtor
hObXeMHkSShI8GL7378ICT2M.exe	100%	Avira	HEUR/AGEN.1317026
hObXeMHkSShI8GL7378ICT2M.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.apache.org/licenses/LICENSE-2.0	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://api.ip.s	0%	Avira URL Cloud	safe
https://discord.com/api/v9/users/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	RegAsm.exe, 00000002.00000002.1684595853.0000000002911000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.s	RegAsm.exe, 00000002.00000002.1684595853.0000000002911000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.com/api/v9/users/	RegAsm.exe, 00000002.00000002.1684595853.0000000002A42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	RegAsm.exe, 00000002.00000002.1689580353.0000000006B32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483179
Start date and time:	2024-07-26 19:20:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hObXeMHkSShI8GL7378ICT2M.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@5/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 38 Number of non-executed functions: 51
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: hObXeMHkSShI8GL7378ICT2M.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.7280710304698665
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	hObXeMHkSShI8GL7378ICT2M.exe
File size:	573'440 bytes
MD5:	9e96179dbd4fa2006157a4617e270555
SHA1:	6d46e5f13b7fa00b0034a4881d07b8d5776faa10
SHA256:	7a4b5e91d0222c145a45c4c844136be284a4df98737c6dae589d65c439d0e6d2
SHA512:	43aa1f59512b9ea927d3fba965431f88d9e37485b54d00b9e48c3423601a0b40b359e6e6b9c5bd7418d79d17a5e3b8d8f4fa4f97bb376c3ef3d37bf368092909
SSDEEP:	12288:eem1DVVYweJUFHk8oVw/oKMlfx062I4Nt91gYgs:e7DzESHkfsoKMlfxUIJYgs
TLSH:	E2C4F11279C1C0B3D6772A350AE4D7B8AA7EF9604E719DAF77540B3E0F305C2EA21616
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a.Z.............r.......r..o....r.......r..........D...........................5.......5.......Rich............PE..L...\|*.f...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x408401
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A12A7C [Wed Jul 24 16:23:24 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	6addd02d82538c2ca23958c8c292883b

Entrypoint Preview

Instruction
call 00007F1E2CFB3D7Eh
jmp 00007F1E2CFB3469h
int3
int3
int3
int3
int3
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 0Fh
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F1E2CFB3E6Fh
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 07h
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F1E2CFB3E59h
int3
int3
int3
int3
push ebx
push esi
mov eax, dword ptr [esp+18h]
or eax, eax
jne 00007F1E2CFB360Ah
mov ecx, dword ptr [esp+14h]
mov eax, dword ptr [esp+10h]
xor edx, edx
div ecx
mov ebx, eax
mov eax, dword ptr [esp+0Ch]
div ecx
mov edx, ebx
jmp 00007F1E2CFB3633h
mov ecx, eax
mov ebx, dword ptr [esp+14h]
mov edx, dword ptr [esp+10h]
mov eax, dword ptr [esp+0Ch]
shr ecx, 1
rcr ebx, 1
shr edx, 1
rcr eax, 1
or ecx, ecx
jne 00007F1E2CFB35E6h
div ebx
mov esi, eax
mul dword ptr [esp+18h]
mov ecx, eax
mov eax, dword ptr [esp+14h]
mul esi
add edx, ecx
jc 00007F1E2CFB3600h
cmp edx, dword ptr [esp+10h]
jnbe 00007F1E2CFB35FAh
jc 00007F1E2CFB35F9h
cmp eax, dword ptr [esp+0Ch]
jbe 00007F1E2CFB35F3h
dec esi
xor edx, edx
mov eax, esi
pop esi
pop ebx
retn 0010h
int3
int3
int3
int3
int3
int3
int3
int3
push ebx
mov eax, dword ptr [esp+14h]
or eax, eax
jne 00007F1E2CFB360Ah
mov ecx, dword ptr [esp+10h]
mov eax, dword ptr [esp+0Ch]
xor edx, edx
div ecx
mov eax, dword ptr [esp+08h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2ae04	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8e000	0x1fa4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x283b8	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x28400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x282f8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x21000	0x16c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1e3b7	0x1e400	b6b08c161c5bf92ce1ba8431211d738a	False	0.5810304752066116	data	6.610879411166099	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.zzz	0x20000	0x713	0x800	b863b2e179e2d3390b1c64e6852463b6	False	0.6708984375	data	6.108932867613365	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x21000	0xa67e	0xa800	ef532f5667cc860b731c37a415dd6163	False	0.38204520089285715	OpenPGP Public Key Version 2; User ID	4.619965008761279	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2c000	0x616c4	0x60800	0f5d5243dcef2de011e1156b32705dcc	False	0.9859233322538861	data	7.990999283321883	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x8e000	0x1fa4	0x2000	e7aca2b985cb464f4615194f007ea2fd	False	0.7523193359375	data	6.509163912377112	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

WaitForSingleObject, CreateThread, VirtualAllocEx, FreeConsole, RaiseException, InitOnceBeginInitialize, InitOnceComplete, CloseHandle, GetCurrentThreadId, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, GetLastError, FreeLibraryWhenCallbackReturns, CreateThreadpoolWork, SubmitThreadpoolWork, CloseThreadpoolWork, GetModuleHandleExW, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, QueryPerformanceCounter, EncodePointer, DecodePointer, MultiByteToWideChar, WideCharToMultiByte, LCMapStringEx, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetStringTypeW, GetCPInfo, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, InitializeSListHead, CreateFileW, RtlUnwind, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleFileNameW, GetStdHandle, WriteFile, GetCommandLineA, GetCommandLineW, HeapFree, HeapAlloc, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, GetFileSizeEx, SetFilePointerEx, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetProcessHeap, SetStdHandle, HeapSize, WriteConsoleW

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 19:21:18.235683918 CEST	53	52440	1.1.1.1	192.168.2.4

Target ID:	0
Start time:	13:20:55
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hObXeMHkSShI8GL7378ICT2M.exe"
Imagebase:	0x250000
File size:	573'440 bytes
MD5 hash:	9E96179DBD4FA2006157A4617E270555
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:20:55
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:20:55
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x660000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000002.00000002.1683008996.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:20:55
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	0.3%
Signature Coverage:	1.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	38

Executed Functions

Function 00BD018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00BD00FF,00BD00EF), ref: 00BD02FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00BD030F
Wow64GetThreadContext.KERNEL32(0000009C,00000000), ref: 00BD032D
ReadProcessMemory.KERNELBASE(00000098,?,00BD0143,00000004,00000000), ref: 00BD0351
VirtualAllocEx.KERNELBASE(00000098,?,?,00003000,00000040), ref: 00BD037C
WriteProcessMemory.KERNELBASE(00000098,00000000,?,?,00000000,?), ref: 00BD03D4
WriteProcessMemory.KERNELBASE(00000098,00400000,?,?,00000000,?,00000028), ref: 00BD041F
WriteProcessMemory.KERNELBASE(00000098,?,?,00000004,00000000), ref: 00BD045D
Wow64SetThreadContext.KERNEL32(0000009C,00BE0000), ref: 00BD0499
ResumeThread.KERNELBASE(0000009C), ref: 00BD04A8

Strings

VirtualAllocEx, xrefs: 00BD028D
Load, xrefs: 00BD01CB
ress, xrefs: 00BD0217
CreateProcessA, xrefs: 00BD0241
ResumeThread, xrefs: 00BD02C9
GetThreadContext, xrefs: 00BD0267
GetP, xrefs: 00BD020F
TerminateProcess, xrefs: 00BD038B
ReadProcessMemory, xrefs: 00BD027A
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 00BD02FB
VirtualAlloc, xrefs: 00BD0254
WriteProcessMemory, xrefs: 00BD02A0
SetThreadContext, xrefs: 00BD02B3
aryA, xrefs: 00BD01D3

Memory Dump Source

Source File: 00000000.00000002.1666446228.0000000000BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_hObXeMHkSShI8GL7378ICT2M.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: a06622b0dc33a45f7ce97c7a1d9bda8f3232c04a86a811d9b038afe6c0680d61
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: C5B1F67660024AAFDB60CF68CC80BDA73E5FF88714F158165EA0CAB341D770FA418B94

Function 00263792 Relevance: 1.3, Strings: 1, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Strings

6a,, xrefs: 002637AC, 002637AF

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID:
String ID: 6a,
API String ID: 0-1499783603
Opcode ID: 3be818cf205956922cb42e2948fb7e1fdd6f2e0da355ec83d9b6a1afa0c5ae1d
Instruction ID: b4013b4a66954d14ed41fd63a486d49668484fb008c4f99413c6311c481a5151
Opcode Fuzzy Hash: 3be818cf205956922cb42e2948fb7e1fdd6f2e0da355ec83d9b6a1afa0c5ae1d
Instruction Fuzzy Hash: 82E046B2921228EBCB16DF98894498AF2FCEB48B00B510096B902D3200C270DF50CBD0

Function 0025FEDA Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8f6b386abd769ad1aa34007715f148021cb4ecf1aa09ef3fb483fba9ae76088
Instruction ID: f7c19a916d2ff4493b7062705775c8baa1517821262e8c2eb600808cdc032624
Opcode Fuzzy Hash: e8f6b386abd769ad1aa34007715f148021cb4ecf1aa09ef3fb483fba9ae76088
Instruction Fuzzy Hash: 0BC0807405054086CD159D24977236C3355E391783F54049DC94207A53D52D5C95D600

Function 002648DD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00264964
__alloca_probe_16.LIBCMT ref: 00264A25
__freea.LIBCMT ref: 00264A8C

Part of subcall function 002637C3: RtlAllocateHeap.NTDLL(00000000,00254E80,?,?,0025929A,?,?,?,?,?,00252617,00254E80,?,?,?,?), ref: 002637F5

__freea.LIBCMT ref: 00264AA1
__freea.LIBCMT ref: 00264AB1

Strings

6a,, xrefs: 002648E4

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID: 6a,
API String ID: 1423051803-1499783603
Opcode ID: 80f8a9fc7f219d4e6c774bb2cc540c28e3d12254bfdc317263e1ba179c656ce1
Instruction ID: b7e1be0e78ff160e3ccecd9f0281509afa7f35bed86ce3fe807571c39c5ce8b8
Opcode Fuzzy Hash: 80f8a9fc7f219d4e6c774bb2cc540c28e3d12254bfdc317263e1ba179c656ce1
Instruction Fuzzy Hash: BC51D272671207BFEB20AEA4DC52EBF76A9EF44314B150129FD44D7250E771CCA08BA4

Function 002631DE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,002632EB,?,?,00254E80,00000000,?,?,00263515,00000021,FlsSetValue,002747D0,002747D8,00254E80), ref: 0026329F

Strings

ext-ms-, xrefs: 00263249
api-ms-, xrefs: 00263235

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 59d0eb0dce4b611c796d76b17181c543fce9f208c33859e504aac7f41671441a
Instruction ID: e2807b0b1df68eb38f198fff27c8d958373ddd1a6e04adaa7a03017e96a419ee
Opcode Fuzzy Hash: 59d0eb0dce4b611c796d76b17181c543fce9f208c33859e504aac7f41671441a
Instruction Fuzzy Hash: EC215031A11121E7D721DF69FC58A6A3768AF027A0F200114FD09E7290D730EFE0C6D0

Function 00268914 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00268444: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 0026846F

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,0026875B,?,00000000,?,00000000,?), ref: 00268975
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,0026875B,?,00000000,?,00000000,?), ref: 002689B7

Strings

6a,, xrefs: 0026891C

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID: 6a,
API String ID: 546120528-1499783603
Opcode ID: b56244940432c0ccdd0061d8b28f54e47f5ca300022ec6468b5a9f31552b7ccc
Instruction ID: 08588e8d85f466c1835b4cfb9cb8ee93bb3433808ad7a0d9acbf48e74f412790
Opcode Fuzzy Hash: b56244940432c0ccdd0061d8b28f54e47f5ca300022ec6468b5a9f31552b7ccc
Instruction Fuzzy Hash: 615144719203468FDB20CFB5C885ABABBF4EF95304F14826FD48687251DF749996CB81

Function 0026535E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,00000000,?,002658AB,?,00000000,00000000,00000000,00000000,00000000), ref: 002653FA
GetLastError.KERNEL32(?,002658AB,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0025E210,00000000,00000000,0027A8F8,00000010), ref: 00265420

Strings

6a,, xrefs: 0026536D

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: 6a,
API String ID: 442123175-1499783603
Opcode ID: 2b7699c78e6fa36fd31e45587ba570126233488bcc4a3429ffabf3da4ebecb65
Instruction ID: 49063311f95cd4aa7eba97481d37d59e22228b94e08b9eecbcd36973a1faf212
Opcode Fuzzy Hash: 2b7699c78e6fa36fd31e45587ba570126233488bcc4a3429ffabf3da4ebecb65
Instruction Fuzzy Hash: 59218230A102299BCB15CF29DC809DDB7B9EB48302F2441EAE946D7251D6709E95CF65

Function 00270545 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002513CB: __EH_prolog3_catch.LIBCMT ref: 002513D2
Part of subcall function 002513CB: _strlen.LIBCMT ref: 002513E4

Part of subcall function 00251920: __EH_prolog3_catch.LIBCMT ref: 00251927

_Deallocate.LIBCONCRT ref: 002705FC

Strings

Own head, xrefs: 0027058B
Earth, xrefs: 002705A6

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: H_prolog3_catch$Deallocate_strlen
String ID: Earth$Own head
API String ID: 1170754441-4036566267
Opcode ID: 971e970e987ad3ea5c0956eff008cb7b77d474c755b617fcfd90b59200268c31
Instruction ID: 627a6e1d00d28f0bf3f72f6a5ca710511144d4949db50e12e2ef24fa308f19a3
Opcode Fuzzy Hash: 971e970e987ad3ea5c0956eff008cb7b77d474c755b617fcfd90b59200268c31
Instruction Fuzzy Hash: 5E219A72419342AEC700EF3C989199BFBE8BD55308F541A5EF49552142C630E66DCBA6

Function 00270649 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0025217E: _strlen.LIBCMT ref: 00252196

VirtualAllocEx.KERNELBASE(?,00000000,000004AC,00001000,00000040,0000000006:1@0000000005:@), ref: 00270693

Strings

0000000006:1@0000000005:@, xrefs: 0027065C
6a,, xrefs: 0027064F

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: AllocVirtual_strlen
String ID: 0000000006:1@0000000005:@$6a,
API String ID: 3554592677-2799131470
Opcode ID: c75bef7eb9374ac77106b85deec2d13799447cee33758fd210b75cb62d176fc3
Instruction ID: 4306879be6778f2942f8e40af76ea78bbc77d46f58babc59724b2b7660fbfea4
Opcode Fuzzy Hash: c75bef7eb9374ac77106b85deec2d13799447cee33758fd210b75cb62d176fc3
Instruction Fuzzy Hash: FA110871A21204A6DB04EBA4DC92FEE7378EF85726F10811DF905B21C1DE749D6D8A68

Function 0025FE66 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0025FE60,00000016,0025C712,?,?,EC2C6136,0025C712,?), ref: 0025FE77
TerminateProcess.KERNEL32(00000000,?,0025FE60,00000016,0025C712,?,?,EC2C6136,0025C712,?), ref: 0025FE7E
ExitProcess.KERNEL32 ref: 0025FE90

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: b19b179369e87318d29b4da94a6c63ac451ee666ed54986c5c5b54a942a27b37
Instruction ID: 28f8815178386cbb325199408a688563f20911fcdc1e4231be43d7a187e68d7e
Opcode Fuzzy Hash: b19b179369e87318d29b4da94a6c63ac451ee666ed54986c5c5b54a942a27b37
Instruction Fuzzy Hash: 94D06731410148AFCF413F69ED0E95A3F25AF44352B544024BD0999072CB3199E5DA48

Function 00268518 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00268767,0026875B,00000000), ref: 0026854A

Strings

6a,, xrefs: 00268523

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: Info
String ID: 6a,
API String ID: 1807457897-1499783603
Opcode ID: cd4056fa13bd4b5cd77a1387877b351711ca58b8767dde42341ecb08ef1631f0
Instruction ID: 5b16679e5fe93b322cfdddac4578c1ecf44109bcaf89b602ec6ff0682b13b2bb
Opcode Fuzzy Hash: cd4056fa13bd4b5cd77a1387877b351711ca58b8767dde42341ecb08ef1631f0
Instruction Fuzzy Hash: AE5168719142589ACB218E28CD84AEA7BBCEB49304F2446ADE59AC7182C7719ED58F20

Function 00256EEC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6a,, xrefs: 00256EF2

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID:
String ID: 6a,
API String ID: 0-1499783603
Opcode ID: 7301570d265ec4a523a65ea13d579c2b6260b943a2c8497f209df28dbc70bff3
Instruction ID: bb7eed0a7dd74a9dfa43018989d0837f54e1be97fd08f7dc64fdccd50023633b
Opcode Fuzzy Hash: 7301570d265ec4a523a65ea13d579c2b6260b943a2c8497f209df28dbc70bff3
Instruction Fuzzy Hash: 03318831D2011B9FCB14CF68E488DEDB7B9BF09311B944155E906A7A90E731FD68CB94

Function 002632A9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6a,, xrefs: 002632BD, 0026330E

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID:
String ID: 6a,
API String ID: 0-1499783603
Opcode ID: 4fedd26fa0e9819a273cc88b3e5da5c71884450258ad21850f853691536fe572
Instruction ID: 3d08d32ee11e8933898ea3f7b7d95537e8a48c5324b7d2685ea35dda160f1205
Opcode Fuzzy Hash: 4fedd26fa0e9819a273cc88b3e5da5c71884450258ad21850f853691536fe572
Instruction Fuzzy Hash: A201F133B202566FAB12CE6AED4595A37D7BB853203244162FD04CB294DA31CDA18AD1

Function 0026575C Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00264EA6: GetConsoleOutputCP.KERNEL32(EC2C6136,00000000,00000000,00000000), ref: 00264F09

WriteFile.KERNEL32(?,00000000,00000000,0025E210,00000000,00000000,00000000,00000000,00000000,?,0025E210,00000000,00000000,0027A8F8,00000010,00000000), ref: 002658C5
GetLastError.KERNEL32(?,0025E210,00000000,00000000,0027A8F8,00000010,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002658CF

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 7449d389dfe4e5a62fd4454dca353f409431365a941d576078ae4f56382b9e35
Instruction ID: 86139bfd2d393ec666b5b28ea1be2c3ccb2cbfe69c64537cffdde2be7d9a03d5
Opcode Fuzzy Hash: 7449d389dfe4e5a62fd4454dca353f409431365a941d576078ae4f56382b9e35
Instruction Fuzzy Hash: C961D471D2056AAFDF11CFA8C844EEEBBB9AF09314F144095E804A7252D371D9A1CFA0

Function 002513CB Relevance: 3.1, APIs: 2, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 002513D2
_strlen.LIBCMT ref: 002513E4

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: H_prolog3_catch_strlen
String ID:
API String ID: 3133806014-0
Opcode ID: 3184da69244dcc2bd11f65de90fda42702f86215b96422158414467251cdb7b3
Instruction ID: 6aab51c19f62895065f08550e79a916d5cfc621b9527645d8922799c9d8dae5e
Opcode Fuzzy Hash: 3184da69244dcc2bd11f65de90fda42702f86215b96422158414467251cdb7b3
Instruction Fuzzy Hash: 2B51C271E205158FCB20DFA8C880AADB7F1BF48325B25525AEC24EB392D770DC69CB55

Function 002639B2 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 002639FE
GetFileType.KERNELBASE(00000000), ref: 00263A10

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 905d2a96b2ecc3316d2237ccaf5b1870182c8470f753c07cd2f59f67bc2320dc
Instruction ID: ca699dd72b0c885909dbed5796edbe1c175b07cdeb224150148499fdb42ecef5
Opcode Fuzzy Hash: 905d2a96b2ecc3316d2237ccaf5b1870182c8470f753c07cd2f59f67bc2320dc
Instruction Fuzzy Hash: 47118B325247424AC730CE7E9C8D522BA94A755330B34071ED5F6C65F1C670DEE9E541

Function 00263678 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,002649CB,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 002636AC
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,002649CB,?,?,00000000,?,00000000), ref: 002636CA

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 23e5b590f82b200af7bc20df6e0f16f51b21623646018fe8d68ce901c95e0bc0
Instruction ID: bd57ee9a75a68da3455bfb8aee60d8cf9bcc41b7ba4b59ad0c71ce6c95bd4c31
Opcode Fuzzy Hash: 23e5b590f82b200af7bc20df6e0f16f51b21623646018fe8d68ce901c95e0bc0
Instruction Fuzzy Hash: 6AF07A3651011ABBCF129F91EC09EDE3F2AEF483A0F058010FE1925120CB32D9B1AF98

Function 0027062D Relevance: 3.0, APIs: 2, Instructions: 12synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00020649,00000000,00000000,00000000), ref: 00270639
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00270642

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleThreadWait
String ID:
API String ID: 1891408510-0
Opcode ID: 3a2b520e90306ae3e219e46d3cf2c3f2581db6bdf8a24c2f76282478591e4bb5
Instruction ID: ca7f6282568069830c176f4d1ba73f7123a63a2be5afcaba7d9e157a59f164f5
Opcode Fuzzy Hash: 3a2b520e90306ae3e219e46d3cf2c3f2581db6bdf8a24c2f76282478591e4bb5
Instruction Fuzzy Hash: 5EC092F4954240BEBE0017B86D0CC37351CEA413623200B007D29D20E8D9348CA08634

Function 002637C3 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00254E80,?,?,0025929A,?,?,?,?,?,00252617,00254E80,?,?,?,?), ref: 002637F5

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c6233d6f7a82240e3783bde4ed5662a56c5c5984a4b4f13bd012d5d8c3f08a10
Instruction ID: edb98af7c0ca4fe91e83aed80844c615df28083e29a8af5c15c8b1cc14879dad
Opcode Fuzzy Hash: c6233d6f7a82240e3783bde4ed5662a56c5c5984a4b4f13bd012d5d8c3f08a10
Instruction Fuzzy Hash: 43E0E57563065266EB21AE65AC04B9B7E8DAF413B1F100221FC099B4C0DB71CDE086E5

Function 00270705 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

FreeConsole.KERNELBASE(00258379,00000000,00000000,00000000,0027A770,00000014), ref: 00270705

Part of subcall function 0027062D: CreateThread.KERNELBASE(00000000,00000000,Function_00020649,00000000,00000000,00000000), ref: 00270639
Part of subcall function 0027062D: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00270642

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ConsoleCreateFreeObjectSingleThreadWait
String ID:
API String ID: 973188901-0
Opcode ID: 52e45cdcef0756c90c3dffaa33bfd3a4a3ccfb6c417d9a67a7eecd9a8cb1c5ff
Instruction ID: a4b64c28eaffa387d1b56b9da81dd080b011a78028ab983529ad235813c3c1d7
Opcode Fuzzy Hash: 52e45cdcef0756c90c3dffaa33bfd3a4a3ccfb6c417d9a67a7eecd9a8cb1c5ff
Instruction Fuzzy Hash: 3F9002A5131040C687402734BD9D11A26545A84303B10D5A0B619C0025DF6044B45920

Non-executed Functions

Function 0026B5CC Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00262790: GetLastError.KERNEL32(?,00000008,00262D8F), ref: 00262794
Part of subcall function 00262790: SetLastError.KERNEL32(00000000,00254E80,00000002,000000FF), ref: 00262836

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0026B6D8
IsValidCodePage.KERNEL32(00000000), ref: 0026B721
IsValidLocale.KERNEL32(?,00000001), ref: 0026B730
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0026B778
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0026B797

Strings

N', xrefs: 0026B685
6a,, xrefs: 0026B5D4

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: N'$6a,
API String ID: 415426439-2590016995
Opcode ID: 77f3f980cc4aecf6916104f34ec04907a3fb7827d586f0ca064c1e45ec51527a
Instruction ID: 1672a29bd19cd2d3ed18b7ec33369f6372c0fd680efd2b92e9fe8df7d5dd6a92
Opcode Fuzzy Hash: 77f3f980cc4aecf6916104f34ec04907a3fb7827d586f0ca064c1e45ec51527a
Instruction Fuzzy Hash: 22517071A20206ABDB12EFA5DC45ABE77BCFF14700F144029E915EB191EBB0D9E4CB61

Function 0026AC68 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00262790: GetLastError.KERNEL32(?,00000008,00262D8F), ref: 00262794
Part of subcall function 00262790: SetLastError.KERNEL32(00000000,00254E80,00000002,000000FF), ref: 00262836

GetACP.KERNEL32(?,?,?,?,?,?,0026133E,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0026AD29
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0026133E,?,?,?,00000055,?,-00000050,?,?), ref: 0026AD54
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0026AEB7

Strings

utf8, xrefs: 0026AE26
N', xrefs: 0026ACDF
6a,, xrefs: 0026AE6E

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: N'$6a,$utf8
API String ID: 607553120-2421541106
Opcode ID: 717f910322eb4cef71c407521390aa3eb6a4cdaa073269b5ff2cfe8d74e71dc5
Instruction ID: 92382c9fb6b0caec334b1eec2de2aee8092390f08d3c4119d736c35c9044205b
Opcode Fuzzy Hash: 717f910322eb4cef71c407521390aa3eb6a4cdaa073269b5ff2cfe8d74e71dc5
Instruction Fuzzy Hash: BA71D971A20706AADB25AF74CC46B6A73ACEF45710F144039F505E7181FB75E9E08F62

Function 0026B3F7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0026B715,00000002,00000000,?,?,?,0026B715,?,00000000), ref: 0026B490
GetLocaleInfoW.KERNEL32(?,20001004,0026B715,00000002,00000000,?,?,?,0026B715,?,00000000), ref: 0026B4B9
GetACP.KERNEL32(?,?,0026B715,?,00000000), ref: 0026B4CE

Strings

ACP, xrefs: 0026B415
OCP, xrefs: 0026B44B

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: deb1c104a461dee895f2e1332450d68eb5c2d050eacd7fd7e3e0ca131d4a72ec
Instruction ID: d3840a8b613506e0014e990ec232aaf50e8d557eda68df73c42bee4d56b6c679
Opcode Fuzzy Hash: deb1c104a461dee895f2e1332450d68eb5c2d050eacd7fd7e3e0ca131d4a72ec
Instruction Fuzzy Hash: 78218332A30102E6DB368F54C925BA773A6EF54BA4B568474E90ADB116EF32DDE0C350

Function 0026B07B Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00262790: GetLastError.KERNEL32(?,00000008,00262D8F), ref: 00262794
Part of subcall function 00262790: SetLastError.KERNEL32(00000000,00254E80,00000002,000000FF), ref: 00262836

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0026B0CF
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0026B119
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0026B1DF

Strings

6a,, xrefs: 0026B086

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID: 6a,
API String ID: 661929714-1499783603
Opcode ID: 33ce0d1ac09fdd324b403a31516cd2923cfb2939ad811741098dcedeb7f8c555
Instruction ID: 9a4f365147c509b9554335a0e631e0c5877766aeb48f987cc8cc76f656b43809
Opcode Fuzzy Hash: 33ce0d1ac09fdd324b403a31516cd2923cfb2939ad811741098dcedeb7f8c555
Instruction Fuzzy Hash: 23618F719602079FEB2A9F28CC92BBA77E8EF05300F1041B9ED09D6585EB74D9E5CB50

Function 0025C713 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00254E80), ref: 0025C80B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00254E80), ref: 0025C815
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00254E80), ref: 0025C822

Strings

6a,, xrefs: 0025C71E

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: 6a,
API String ID: 3906539128-1499783603
Opcode ID: d9f10975ad87952294ded54349b7a6a8f000360701edea0df2934c141c7a8828
Instruction ID: 723f660b1e5140b4436bf39aa50d8b8752de928a98118b2a98b3d22e1fc43a9a
Opcode Fuzzy Hash: d9f10975ad87952294ded54349b7a6a8f000360701edea0df2934c141c7a8828
Instruction Fuzzy Hash: 6D31D3749112289BCB21DF28DC8979DBBB8BF18311F5041EAE80CA7250EB709B95CF48

Function 0025872E Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0025873A
IsDebuggerPresent.KERNEL32 ref: 00258806
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0025881F
UnhandledExceptionFilter.KERNEL32(?), ref: 00258829

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 5539136cce2ffc4daed4a80ab6b17d7166fd18846cb9763005bdb0292a3265ef
Instruction ID: a0d0b706a3fb9659d40c598f41e3a70b1e358baaeae17141e2ec691503a2682c
Opcode Fuzzy Hash: 5539136cce2ffc4daed4a80ab6b17d7166fd18846cb9763005bdb0292a3265ef
Instruction Fuzzy Hash: EA31F675D1521D9BDB20EFA4D949BCDBBB8AF08301F1041AAE80CAB250EB709AD4CF45

Function 00267E68 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

6a,, xrefs: 00267F24

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID:
String ID: 6a,
API String ID: 0-1499783603
Opcode ID: adfa3f483b91ce66a9de569370d1c06829053871cd211c7d802c8b49061cfefe
Instruction ID: f75d0851c15904d190e5b625807f0053c9e0b289e271f9e2ac99ce34d0c5d2cd
Opcode Fuzzy Hash: adfa3f483b91ce66a9de569370d1c06829053871cd211c7d802c8b49061cfefe
Instruction Fuzzy Hash: DB41B1B581421DAECF20DF69DC89EAABBB9EF45304F1442D9E40DD3201EA359E958F10

Function 0026B2CE Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00262790: GetLastError.KERNEL32(?,00000008,00262D8F), ref: 00262794
Part of subcall function 00262790: SetLastError.KERNEL32(00000000,00254E80,00000002,000000FF), ref: 00262836

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0026B322

Strings

6a,, xrefs: 0026B2D9

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID: 6a,
API String ID: 3736152602-1499783603
Opcode ID: 9ee04b07554c3a3f732229b2591af15bd76336418b2bf18f3f369de1d1edd500
Instruction ID: e5f1ef78242d1cd09ad8a98752e157da1d2bb2be18221232e11187ce055c8545
Opcode Fuzzy Hash: 9ee04b07554c3a3f732229b2591af15bd76336418b2bf18f3f369de1d1edd500
Instruction Fuzzy Hash: E6219272A35207ABDF299E25DC42A7A73ACEF44314B1040BAFD05D6241EB74EDF48B50

Function 0026AE63 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00262790: GetLastError.KERNEL32(?,00000008,00262D8F), ref: 00262794
Part of subcall function 00262790: SetLastError.KERNEL32(00000000,00254E80,00000002,000000FF), ref: 00262836

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0026AEB7

Strings

utf8, xrefs: 0026AE26
N', xrefs: 0026ACDF
6a,, xrefs: 0026AE6E

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID: N'$6a,$utf8
API String ID: 3736152602-2421541106
Opcode ID: 2a6329d80223566c471041e7d2e2205e43cf78f9943c123f980fb46d19c43c84
Instruction ID: 4d1183dd7d29d8c8a1c3d9a39ca090882b3392fd4403787652304d7c50477e2f
Opcode Fuzzy Hash: 2a6329d80223566c471041e7d2e2205e43cf78f9943c123f980fb46d19c43c84
Instruction Fuzzy Hash: 7EF0FC32A20205EBC715AF78DC4AEBE73ECDF49311F10407EB606E7281DA74AD588B95

Function 00263015 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0025D528: EnterCriticalSection.KERNEL32(-00088158,?,0025FAED,00000000,0027AA38,0000000C,0025FAB4,?,?,00262FDE,?,?,0026292E,00000001,00000364,00254E80), ref: 0025D537

EnumSystemLocalesW.KERNEL32(00263008,00000001,0027AC28,0000000C,00263437,00000000), ref: 0026304D

Strings

6a,, xrefs: 00263055

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID: 6a,
API String ID: 1272433827-1499783603
Opcode ID: a6681c6279a0e53dbb49dcea2968cc7a6424275ac597c1fb03951e4fe8540a5a
Instruction ID: b7622d799063e40357a6d1bc106bf4dc7d3c0f87fbf633bfe388feda3ffe66b3
Opcode Fuzzy Hash: a6681c6279a0e53dbb49dcea2968cc7a6424275ac597c1fb03951e4fe8540a5a
Instruction Fuzzy Hash: B2F04936A20204EFD700DF98E846B9D7BB0EB85B22F10406BF815DB2A1DBB54958CF46

Function 002670FA Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,002670F5,?,?,?,?,?,?,00000000), ref: 00267327

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7c93238af9de553adf8ddaaf787ed3a3ccab1d929be41eabd7fcb56b698c618a
Instruction ID: 32ad9cc8a23aea5e298a266795ec4bd489574a97e9c52609f23f4ae46598f75c
Opcode Fuzzy Hash: 7c93238af9de553adf8ddaaf787ed3a3ccab1d929be41eabd7fcb56b698c618a
Instruction Fuzzy Hash: 89B15E31224609CFD715CF28D496B657BE0FF45368F258699F89ACF2A1C335E9A1CB40

Function 00258525 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0025853B

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: e1904938c8f6db7d3e86123c53a19754140ad81b9715cf7b774fd49cc9f38440
Instruction ID: 986f0c3b55cc7d4c77faf7d288625fe9316632b2fbeb8e1c7cc068af620106ab
Opcode Fuzzy Hash: e1904938c8f6db7d3e86123c53a19754140ad81b9715cf7b774fd49cc9f38440
Instruction Fuzzy Hash: BC5169B1D212168FDB14CF58E89A6AABBF8FB48305F24806BD801EB294D7B5DD14CF54

Function 0026A719 Relevance: 1.6, Strings: 1, Instructions: 327COMMON

Download Yara Rule

Strings

6a,, xrefs: 0026A724, 0026AA04

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID: 6a,
API String ID: 3471368781-1499783603
Opcode ID: c2f40b862bf615bca4c868a736c68a90fafd1cccccd96b13a51c61e8f365d12d
Instruction ID: 08d515a657180be17d84246a447a7b61975f762d45c3e3d8b931cd33ec6d286f
Opcode Fuzzy Hash: c2f40b862bf615bca4c868a736c68a90fafd1cccccd96b13a51c61e8f365d12d
Instruction Fuzzy Hash: 70B106355207069BDB38AF24CC92AB7B3E8EF44308F64452DE983D7580EAB4A9D5CF51

Function 0026AF55 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00262790: GetLastError.KERNEL32(?,00000008,00262D8F), ref: 00262794
Part of subcall function 00262790: SetLastError.KERNEL32(00000000,00254E80,00000002,000000FF), ref: 00262836

EnumSystemLocalesW.KERNEL32(0026B07B,00000001,00000000,?,-00000050,?,0026B6AC,00000000,?,?,?,00000055,?), ref: 0026AFC7

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 491732872b838d5e567e6d4daa68bcb78efa76d86e68f951bf1d01070a500151
Instruction ID: 3ce8649b31d3befaffaffea01d01fea45c2b138dfdc32b8877507294ab55fcff
Opcode Fuzzy Hash: 491732872b838d5e567e6d4daa68bcb78efa76d86e68f951bf1d01070a500151
Instruction Fuzzy Hash: D7110C7B6107059FDB189F39C89167ABB91FF84358B14442DE94797A40D372B993CB40

Function 0026B4FD Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00262790: GetLastError.KERNEL32(?,00000008,00262D8F), ref: 00262794
Part of subcall function 00262790: SetLastError.KERNEL32(00000000,00254E80,00000002,000000FF), ref: 00262836

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0026B297,00000000,00000000,?), ref: 0026B529

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 56a00fc3d020393aa3e4f5b04a13747678b50c09fbc83564087b2a7f2323a51f
Instruction ID: 5c30bbe291ee828418a5813ea460959db052a77cd9b2f77855a9f53193db37e2
Opcode Fuzzy Hash: 56a00fc3d020393aa3e4f5b04a13747678b50c09fbc83564087b2a7f2323a51f
Instruction Fuzzy Hash: ECF0F932920216ABDB259E34C805AFB7768EB40754F540425ED07F3150FB74FDD1C590

Function 0026AFF0 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00262790: GetLastError.KERNEL32(?,00000008,00262D8F), ref: 00262794
Part of subcall function 00262790: SetLastError.KERNEL32(00000000,00254E80,00000002,000000FF), ref: 00262836

EnumSystemLocalesW.KERNEL32(0026B2CE,00000001,?,?,-00000050,?,0026B670,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0026B03A

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 1797dfb00013f5abb90d2760cf2fb5cd70e13f1bf513f56be315713222f795a6
Instruction ID: 72d11fcfcbc15bc00f959d4de90000564d5ebbc25b31baf64819f1894d79cfce
Opcode Fuzzy Hash: 1797dfb00013f5abb90d2760cf2fb5cd70e13f1bf513f56be315713222f795a6
Instruction Fuzzy Hash: 26F046362203059FCB255F389C81B7BBF91EF80368B14842CF9058B680C371ACD2CA00

Function 0026AF0A Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00262790: GetLastError.KERNEL32(?,00000008,00262D8F), ref: 00262794
Part of subcall function 00262790: SetLastError.KERNEL32(00000000,00254E80,00000002,000000FF), ref: 00262836

EnumSystemLocalesW.KERNEL32(0026AE63,00000001,?,?,?,0026B6CE,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0026AF41

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d062736d6c1354e8aa2d786322a514b69e8890826b48f7738288397278650b83
Instruction ID: e1edebfaf8eba86271ae25f8d4d503673aec413b5ff5d6153033f0bd28d12183
Opcode Fuzzy Hash: d062736d6c1354e8aa2d786322a514b69e8890826b48f7738288397278650b83
Instruction Fuzzy Hash: B4F0553A71020657CB04AF39D889B6ABF94EFC2720B064058EE099B640C2729892CB91

Function 0026353B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00261EA4,?,20001004,00000000,00000002,?,?,002614A6), ref: 0026356F

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 908fb8171db6e0046af88b602ac10dae61d9cf5392f24b316daf62c3f3202364
Instruction ID: ddeb35e5b55dbf3a3679e2c99309695b29f3b937e4e0c3eb48711a807b293356
Opcode Fuzzy Hash: 908fb8171db6e0046af88b602ac10dae61d9cf5392f24b316daf62c3f3202364
Instruction Fuzzy Hash: 3CE04F35510218BBCF12AF65EC08A9E7F29EF497A1F544010FD0A66260CB728AB0AA94

Function 0025888A Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00008896,00258272), ref: 0025888F

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9ab50a556b021a94aa44fbc0d58b339f41e7cb257a1dbe05b0461612621f45c9
Instruction ID: e8f9a20431f3ae5dd85544dc5bd41e38eb92406403092a1966ff5f6a711e9da6
Opcode Fuzzy Hash: 9ab50a556b021a94aa44fbc0d58b339f41e7cb257a1dbe05b0461612621f45c9
Instruction Fuzzy Hash:

Function 00269050 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00269050

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 6c11b0c0ee52e50e1fef8c7b08313ed25261a5ec1a86f0da872ff54dcafc939b
Instruction ID: 488efa6ca7634c09ed11c91dcc1a296db0d1914d1adfbed709be6f8d560c0171
Opcode Fuzzy Hash: 6c11b0c0ee52e50e1fef8c7b08313ed25261a5ec1a86f0da872ff54dcafc939b
Instruction Fuzzy Hash: DAA01130A022008B83008F3ABA0E20A3BA8AA00280308002AA00CC8220EB2088A0AA80

Function 0026D5F9 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(010C05C8,010C05C8,?,7FFFFFFF,?,0026D8C9,010C05C8,010C05C8,?,010C05C8,?,?,?,?,010C05C8,?), ref: 0026D69F
__alloca_probe_16.LIBCMT ref: 0026D75A
__alloca_probe_16.LIBCMT ref: 0026D7E9
__freea.LIBCMT ref: 0026D834
__freea.LIBCMT ref: 0026D83A
__freea.LIBCMT ref: 0026D870
__freea.LIBCMT ref: 0026D876
__freea.LIBCMT ref: 0026D886

Strings

6a,, xrefs: 0026D601

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID: 6a,
API String ID: 127012223-1499783603
Opcode ID: 147a49854d829b61841e766290da14439ce076014b5874fee664d47e3abc1c04
Instruction ID: 69be809166c2b89c39e6a1a779273f11a0f6d7fc4278cd1e2e6a39471e6c95d6
Opcode Fuzzy Hash: 147a49854d829b61841e766290da14439ce076014b5874fee664d47e3abc1c04
Instruction Fuzzy Hash: 67713772F2420E9BDF219EA4DC45FAE77A9AF45314F280119EC04A7281D771DCA18BA1

Function 002579BA Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00257A03
__alloca_probe_16.LIBCMT ref: 00257A2F
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00257A6E
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00257A8B
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00257ACA
__alloca_probe_16.LIBCMT ref: 00257AE7
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00257B29
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00257B4C

Strings

6a,, xrefs: 002579C0

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID: 6a,
API String ID: 2040435927-1499783603
Opcode ID: c0bbc2ccd5d58c868b9e479c9878b69efc92ea7483243480abc1d40fd05a35c6
Instruction ID: 65cee99c9bd5d92db75cafe17db39f3016eb5327ab466e971c29384c6a48eb52
Opcode Fuzzy Hash: c0bbc2ccd5d58c868b9e479c9878b69efc92ea7483243480abc1d40fd05a35c6
Instruction Fuzzy Hash: 7351D07256420BABEF204F64EC45FAF7BA9EF40746F104525FD04A6150E770CD68CB68

Function 0025B672 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0025B791
___TypeMatch.LIBVCRUNTIME ref: 0025B89F
_UnwindNestedFrames.LIBCMT ref: 0025B9F1
CallUnexpected.LIBVCRUNTIME ref: 0025BA0C

Strings

csm, xrefs: 0025B7C8
csm, xrefs: 0025B71C
%', xrefs: 0025B788
csm, xrefs: 0025B6AF

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm$%'
API String ID: 2751267872-1470287703
Opcode ID: 5d86adc9815fc88aa827de48a20a7ae06fb87b4334eae1fc1333970ea39f18ff
Instruction ID: 4d038d164756df558631d9be520b6b348664fb0fc483cd2ca3d86f284ec3807a
Opcode Fuzzy Hash: 5d86adc9815fc88aa827de48a20a7ae06fb87b4334eae1fc1333970ea39f18ff
Instruction Fuzzy Hash: 78B16B7182020ADFCF16DFA4C8859AEBBB5FF18312F14405AED146B212D730DA69CF99

Function 002666FC Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00266975
P%, xrefs: 00266A2B

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID:
String ID: $P%
API String ID: 0-3100162476
Opcode ID: b742f590390221b67627f0ac6c707ac805a7ec43c553cbbb1e4f100636a52990
Instruction ID: 8c4e76e19737ca6c9d094466972cadb61edfd01a796e51780b4e2f64a373b980
Opcode Fuzzy Hash: b742f590390221b67627f0ac6c707ac805a7ec43c553cbbb1e4f100636a52990
Instruction Fuzzy Hash: 42B12670E24246AFDB11DFA8C888BBDBBB1FF49300F144169E844AB291C7719DA5CF61

Function 00257CE4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00257CEA
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00257CF8
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00257D09
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00257D1A

Strings

GetCurrentPackageId, xrefs: 00257CF2
GetTempPath2W, xrefs: 00257D0F
GetSystemTimePreciseAsFileTime, xrefs: 00257CFE
kernel32.dll, xrefs: 00257CE5

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: fae115b7efd16f7078e25fdf39877cf027cb867a279a820c1c02df0a58ed6e36
Instruction ID: 75c1342769c6553ac38cce44ced9c15070d49482d7f97852336984b7dcbd8aa5
Opcode Fuzzy Hash: fae115b7efd16f7078e25fdf39877cf027cb867a279a820c1c02df0a58ed6e36
Instruction Fuzzy Hash: 8EE0ECB196A251EFC7109FB8BC1F9963BE4EE0A7157108113FA09D2160E67048E4CB61

Function 0025B140 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0025B177
___except_validate_context_record.LIBVCRUNTIME ref: 0025B17F
_ValidateLocalCookies.LIBCMT ref: 0025B208
__IsNonwritableInCurrentImage.LIBCMT ref: 0025B233
_ValidateLocalCookies.LIBCMT ref: 0025B288

Strings

csm, xrefs: 0025B21D
6a,, xrefs: 0025B1F2, 0025B26F

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: 6a,$csm
API String ID: 1170836740-1036119200
Opcode ID: d1d7cd8d30827704b2da632078697a928c0c5158c79abc8a9a346c1a014f4c81
Instruction ID: ad64623d1bee242e1e1676eeb1fccd52e07c5688e9e321429da77a4dd5b661e5
Opcode Fuzzy Hash: d1d7cd8d30827704b2da632078697a928c0c5158c79abc8a9a346c1a014f4c81
Instruction Fuzzy Hash: F641B234A20209AFCF11DF68C855A9E7BB1EF45315F24C095EC18AB392D7319E29CFA5

Function 00255A01 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00255A15
AcquireSRWLockExclusive.KERNEL32(00000000,?,002549A2,?,?,00253B2B), ref: 00255A34
AcquireSRWLockExclusive.KERNEL32(00000000,?,00000000,?,002549A2,?,?,00253B2B), ref: 00255A62
TryAcquireSRWLockExclusive.KERNEL32(00000000,?,00000000,?,002549A2,?,?,00253B2B), ref: 00255ABD
TryAcquireSRWLockExclusive.KERNEL32(00000000,?,00000000,?,002549A2,?,?,00253B2B), ref: 00255AD4

Strings

6a,, xrefs: 00255A07

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID: 6a,
API String ID: 66001078-1499783603
Opcode ID: 4d4c618ee9760c792419f3e0d1ed72b13cb9e3e6f01fbbec016853954a676004
Instruction ID: 1ed210e54782266ef6efa6c124859c2b99b8282af2d7fff846990bcad8e97fab
Opcode Fuzzy Hash: 4d4c618ee9760c792419f3e0d1ed72b13cb9e3e6f01fbbec016853954a676004
Instruction Fuzzy Hash: 01413B35920A2ADFCB24DF65C4E596AB3F5FF08312B20462AEC46D7540D770F9A8CB58

Function 0025FEFC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,EC2C6136,?,?,00000000,0026F0FA,000000FF,?,0025FE8C,?,?,0025FE60,00000016), ref: 0025FF31
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0025FF43
FreeLibrary.KERNEL32(00000000,?,00000000,0026F0FA,000000FF,?,0025FE8C,?,?,0025FE60,00000016), ref: 0025FF65

Strings

mscoree.dll, xrefs: 0025FF2A
CorExitProcess, xrefs: 0025FF3B
6a,, xrefs: 0025FF11

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: 6a,$CorExitProcess$mscoree.dll
API String ID: 4061214504-4024719385
Opcode ID: 6ae6d064f04ade9b51a3a000d2cdc4f3afdb1e0627a23eb451e03d7ca6c1292a
Instruction ID: e526af323784b7aab25ad531cb4f8cf207effb308fd7b76920113bdff03bd685
Opcode Fuzzy Hash: 6ae6d064f04ade9b51a3a000d2cdc4f3afdb1e0627a23eb451e03d7ca6c1292a
Instruction Fuzzy Hash: 7901FD31A24669AFCB119F54EC0ABAEBBB8FB05B11F004125EC16E2AD0DB758950CB90

Function 00264EA6 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(EC2C6136,00000000,00000000,00000000), ref: 00264F09

Part of subcall function 00267965: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00264A82,?,00000000,-00000008), ref: 00267A11

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00265164
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 002651AC
GetLastError.KERNEL32 ref: 0026524F

Strings

6a,, xrefs: 00264EBC

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID: 6a,
API String ID: 2112829910-1499783603
Opcode ID: 4f6efde2c1727cf64bb5331368650e528b74645006f1210534fa57546a1afbed
Instruction ID: 3e41bf0b8f86c2fbbd8959cc3439cbb5a3308bba2a661ebf23711c662b7faf69
Opcode Fuzzy Hash: 4f6efde2c1727cf64bb5331368650e528b74645006f1210534fa57546a1afbed
Instruction Fuzzy Hash: 51D19AB5E106589FCF05CFA8D890AADBBB5FF49300F18816AE866E7341D730A991CF50

Function 00256617 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0025661E
std::_Lockit::_Lockit.LIBCPMT ref: 00256628
int.LIBCPMT ref: 0025663F

Part of subcall function 00252C1B: std::_Lockit::_Lockit.LIBCPMT ref: 00252C2C
Part of subcall function 00252C1B: std::_Lockit::~_Lockit.LIBCPMT ref: 00252C46

codecvt.LIBCPMT ref: 00256662
std::_Facet_Register.LIBCPMT ref: 00256679
std::_Lockit::~_Lockit.LIBCPMT ref: 00256699

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 0cecf6f93d2f7ac4269e95bc54b588524820dac1ea781532841b79b7cd9dcaa1
Instruction ID: 3471527e06ad1946ca41ce32518be99af316575d6ef172ce08ffe0975dfbbbab
Opcode Fuzzy Hash: 0cecf6f93d2f7ac4269e95bc54b588524820dac1ea781532841b79b7cd9dcaa1
Instruction Fuzzy Hash: AC11E4319206268FCB04EF64D8466AEB7B4AF44326F60040AFC05E7381DF74AE59CF88

Function 0025B304 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0025B2FB,002598C0,00255818,EC2C6136,?,?,?,?,0026EED3,000000FF), ref: 0025B312
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0025B320
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0025B339
SetLastError.KERNEL32(00000000,?,0025B2FB,002598C0,00255818,EC2C6136,?,?,?,?,0026EED3,000000FF), ref: 0025B38B

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 46943e4335a59450aa078109a595c893bc87d4d4e64dd103ad7e9774a22fac7c
Instruction ID: 1b597613f8f7072210624762081781c249750d297e696b4c17e72af366af6d18
Opcode Fuzzy Hash: 46943e4335a59450aa078109a595c893bc87d4d4e64dd103ad7e9774a22fac7c
Instruction Fuzzy Hash: AC01F53253A3126E9B252AB47C4A96A2745EB01373330037BFE20A00F0FFB20C6D9549

Function 002558D9 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00255961
RaiseException.KERNEL32(?,?,?,00254BEB,?,?,?,?,?,?,?,?,?,?,00254BEB,00000001), ref: 00255986

Part of subcall function 002592F2: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,?,00254E8E,?,0027A210,?), ref: 00259352

Part of subcall function 0025C98B: IsProcessorFeaturePresent.KERNEL32(00000017,0025C712,?,0025C681,00254E80,00000016,0025C890,?,?,?,?,?,00000000,?,?), ref: 0025C9A7

Strings

K%, xrefs: 0025597B, 0025597E
csm, xrefs: 00255915
6a,, xrefs: 002558DF

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: 6a,$csm$K%
API String ID: 1924019822-1092551451
Opcode ID: d5d63f157f7a0f61df6e84057ca805ac938017623098f25898affaf52ea17195
Instruction ID: 7a907f92eb1b322f1d1dc7dd1109ca7b4c170934db1f3b94b2e767da9d1f8820
Opcode Fuzzy Hash: d5d63f157f7a0f61df6e84057ca805ac938017623098f25898affaf52ea17195
Instruction Fuzzy Hash: BD21C131C20629DBCF24DF95C895AAEB3B5FF40722F144409EC05AB150D734AD68CBC5

Function 00255F15 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00255F1C
std::_Lockit::_Lockit.LIBCPMT ref: 00255F27
std::_Lockit::~_Lockit.LIBCPMT ref: 00255F95

Part of subcall function 00256078: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00256090

std::locale::_Setgloballocale.LIBCPMT ref: 00255F42
_Yarn.LIBCPMT ref: 00255F58

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: f18b7a798979657b23d1735fe21ecac83dd44c8d53aab6b12bf59f53fb7165fd
Instruction ID: e845cf794f593b2cfc8a8db07f6a588c036523f1a9e6569afbe8d1004eed584f
Opcode Fuzzy Hash: f18b7a798979657b23d1735fe21ecac83dd44c8d53aab6b12bf59f53fb7165fd
Instruction Fuzzy Hash: A001B175A225218BC705EF20E85967D7771BF86751B644009EC01673C2DF346E6ACF89

Function 002647D4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00264846
GetStringTypeW.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,E8458D00), ref: 002648A4
__freea.LIBCMT ref: 002648B3

Part of subcall function 002637C3: RtlAllocateHeap.NTDLL(00000000,00254E80,?,?,0025929A,?,?,?,?,?,00252617,00254E80,?,?,?,?), ref: 002637F5

Strings

6a,, xrefs: 002647DC

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: AllocateHeapStringType__alloca_probe_16__freea
String ID: 6a,
API String ID: 2035984020-1499783603
Opcode ID: f9c40312ad245e08f5e2b0fc80a0500a0174ff4b47ba0009b77e1145e5716f53
Instruction ID: af8a8a738cc8ebec4c3697aeaf86b86b41a237d27d71ecf8d350e06c95d59c53
Opcode Fuzzy Hash: f9c40312ad245e08f5e2b0fc80a0500a0174ff4b47ba0009b77e1145e5716f53
Instruction Fuzzy Hash: D431BE71E2024AABDF21AF65DC49EAF7BA5EF44720F044128FD04A7251E774CDA4DBA0

Function 00268295 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 002682BA
GetLastError.KERNEL32 ref: 002682C4
__dosmaperr.LIBCMT ref: 002682CB

Strings

6a,, xrefs: 002682A0

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ErrorFileLastModuleName__dosmaperr
String ID: 6a,
API String ID: 4076908705-1499783603
Opcode ID: 91e33c7177dad845608a70ab0f1865368ad338dd42059c3b30bcf1735484b54e
Instruction ID: c990be8005366bff9762fde4748cda66bae6b0c9328ad3aaa95d9b1b1586f596
Opcode Fuzzy Hash: 91e33c7177dad845608a70ab0f1865368ad338dd42059c3b30bcf1735484b54e
Instruction Fuzzy Hash: 78115E7191025CEBCB50DFA8EC4DBDEB7B8EF08304F1041D9E509E7240EA709A988F55

Function 0025C407 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,0025C3B8,?,?,00000000,?,?,?,0025C4E2,00000002,FlsGetValue,00273070,FlsGetValue), ref: 0025C414
GetLastError.KERNEL32(?,0025C3B8,?,?,00000000,?,?,?,0025C4E2,00000002,FlsGetValue,00273070,FlsGetValue,?,?,0025B325), ref: 0025C41E
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 0025C446

Strings

api-ms-, xrefs: 0025C42B

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: b3551b6645a834bd3ff46f5d1b5c66d41802ecfd3f682b2fb251b611fa0c8c82
Instruction ID: 0a89ce3e16647c61ec700179c21873930b3a02fa4d0dc8d29d068be7911f2382
Opcode Fuzzy Hash: b3551b6645a834bd3ff46f5d1b5c66d41802ecfd3f682b2fb251b611fa0c8c82
Instruction Fuzzy Hash: C7E01230254349BAEF201F55ED0AF693A559F00B81F208060FD4CE44E1E77299B49685

Function 0025B41B Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0025B4E2
___AdjustPointer.LIBCMT ref: 0025B505
___AdjustPointer.LIBCMT ref: 0025B5A1

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 06232095c6ea6bfecd0242da060c3f3644fc8b44e4d3ae9873a1f678c117594d
Instruction ID: 6d2296b45ea100617a47dcbe757eb37fcfa937674c70caae291ed72cc19d88d9
Opcode Fuzzy Hash: 06232095c6ea6bfecd0242da060c3f3644fc8b44e4d3ae9873a1f678c117594d
Instruction Fuzzy Hash: F251E472A212029FDF2A8F14D851B7AB7A4EF00313F64412DED0657691E771EDB8CB98

Function 00267C25 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00267965: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00264A82,?,00000000,-00000008), ref: 00267A11

GetLastError.KERNEL32 ref: 00267C89
__dosmaperr.LIBCMT ref: 00267C90
GetLastError.KERNEL32(?,?,?,?), ref: 00267CCA
__dosmaperr.LIBCMT ref: 00267CD1

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: ef81f6af07c6306f090722fad240cec022726902362b9838fe1877beea60d0a3
Instruction ID: 047f02512f50ac892014371f663739e00769412fd69e277c3629494a31de0182
Opcode Fuzzy Hash: ef81f6af07c6306f090722fad240cec022726902362b9838fe1877beea60d0a3
Instruction Fuzzy Hash: 0E21D771628606AFDB20AF75E981C6AB7A9FF04368710452AFD1997151E730ECF09FD0

Function 0025F734 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f6ed43db293cb8497c35f8e3d8e6bc978b16d367930e21aabd9895c20d81f06
Instruction ID: 22c42d8b00e2dd0b9b7c5bd06450fd218db6eaf2365f135a7c7b1ffe92744578
Opcode Fuzzy Hash: 5f6ed43db293cb8497c35f8e3d8e6bc978b16d367930e21aabd9895c20d81f06
Instruction Fuzzy Hash: AF21C271220206AFDB90AF74DE80C6AB7A9EF08366B218535FD15D7140EB70EC68CB94

Function 00268BBB Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00268BC3

Part of subcall function 00267965: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00264A82,?,00000000,-00000008), ref: 00267A11

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00268BFB
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00268C1B

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 1311f04b4c24ce94288ab906b30575e554e6cab0ba85ea1ec0817261703812b6
Instruction ID: 0186217f972a4dd519b4b1cd949006597e25b3901f5451b668ddb5492271a5f4
Opcode Fuzzy Hash: 1311f04b4c24ce94288ab906b30575e554e6cab0ba85ea1ec0817261703812b6
Instruction Fuzzy Hash: 8D1104E1922515BEAB252BB56C8DC7F7BACDE453D83100A15FA06D1201FE608DE18571

Function 00251F5B Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00251F67
int.LIBCPMT ref: 00251F7A

Part of subcall function 00252C1B: std::_Lockit::_Lockit.LIBCPMT ref: 00252C2C
Part of subcall function 00252C1B: std::_Lockit::~_Lockit.LIBCPMT ref: 00252C46

std::_Facet_Register.LIBCPMT ref: 00251FAD
std::_Lockit::~_Lockit.LIBCPMT ref: 00251FC3

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: a2619327b497ee0cbaf0c44208e6d062d494ebc7431e137e969b910219b9f3bb
Instruction ID: 557fb3032f6b25f2bd12bd3c1c29114d4cee3416926356b4985ac7d859c1f209
Opcode Fuzzy Hash: a2619327b497ee0cbaf0c44208e6d062d494ebc7431e137e969b910219b9f3bb
Instruction Fuzzy Hash: 3C01F772924115ABCB14FBA4D8059AD77ACDF80765B20010AFC0197291EB30EE69CFC8

Function 0026D1BE Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0026C0F8,00000000,00000001,00000000,00000000,?,002652A3,00000000,00000000,00000000), ref: 0026D1D5
GetLastError.KERNEL32(?,0026C0F8,00000000,00000001,00000000,00000000,?,002652A3,00000000,00000000,00000000,00000000,00000000,?,0026582A,?), ref: 0026D1E1

Part of subcall function 0026D1A7: CloseHandle.KERNEL32(FFFFFFFE,0026D1F1,?,0026C0F8,00000000,00000001,00000000,00000000,?,002652A3,00000000,00000000,00000000,00000000,00000000), ref: 0026D1B7

___initconout.LIBCMT ref: 0026D1F1

Part of subcall function 0026D169: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0026D198,0026C0E5,00000000,?,002652A3,00000000,00000000,00000000,00000000), ref: 0026D17C

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,0026C0F8,00000000,00000001,00000000,00000000,?,002652A3,00000000,00000000,00000000,00000000), ref: 0026D206

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 73b5e9b3136933a566d7537c6d1e1bd8b9e8ddd2809ec1e22b1bcc1e6294704f
Instruction ID: 75021d7130742b4bf8b920b24e17c62a1114d1614616b16c427a936f5300471a
Opcode Fuzzy Hash: 73b5e9b3136933a566d7537c6d1e1bd8b9e8ddd2809ec1e22b1bcc1e6294704f
Instruction Fuzzy Hash: 5BF01C3A910259BBCF222F95EC1C99A3F66EF0A3A0B454055FE1C85530CA32C8B0EB90

Function 0025DCF0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 357COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 0025DDF8

Strings

@4', xrefs: 0025E123
6a,, xrefs: 0025DCF8

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: Info
String ID: 6a,$@4'
API String ID: 1807457897-3564056633
Opcode ID: 1205777df759a705bd87ba764e017e12bd7d84dcb1aa6120d8bc11e16a01703a
Instruction ID: 425d36de0406b3b020fd595bd0d4ba7623e60f319f286d4c1341e5530c392e1c
Opcode Fuzzy Hash: 1205777df759a705bd87ba764e017e12bd7d84dcb1aa6120d8bc11e16a01703a
Instruction Fuzzy Hash: CBD1AE7191030A9FDB25DFB4C881BEEBBF5BF08300F144529E895AB292D771AD99CB14

Function 00265EE5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132fileCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00265F35
ReadFile.KERNEL32(?,?,00001000,?,00000000,00265C7E,00000001,00000000,?,00000000,?,?,00000000,?,?,00266101), ref: 00265FBB

Strings

6a,, xrefs: 00265EF4

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: FileReadUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: 6a,
API String ID: 1834446548-1499783603
Opcode ID: 74449f2c7ec33b3bb3abf8d0364787eb1c5d73312ed5e8d4da5b5baf3e6f5814
Instruction ID: adba8b0d0f4f32e134fe76b085455d317161734d2fcb2fa6eb59e827149d3c02
Opcode Fuzzy Hash: 74449f2c7ec33b3bb3abf8d0364787eb1c5d73312ed5e8d4da5b5baf3e6f5814
Instruction Fuzzy Hash: A741DF31A10255AFCF21DF28CD88BE9BBB5BF48304F1081A9E58997141D7B5DEE18F90

Function 0025BA17 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0025BA3C

Strings

MOC, xrefs: 0025BA4E
RCC, xrefs: 0025BA56

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: e68a1c3767b5a468cb2c27594a3f49046ae2de5609defee04ac333cf2010bdba
Instruction ID: 7d391a6e1a39ae218e5700f5c5c2a023f9c707cbcb2498360df6dd327077e811
Opcode Fuzzy Hash: e68a1c3767b5a468cb2c27594a3f49046ae2de5609defee04ac333cf2010bdba
Instruction Fuzzy Hash: 1F41587191020AAFCF16CF98CC81AEEBBB5FF08305F188059FD04A6265D3759964DB54

Function 00265522 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,00000000,?,00000000,00265899,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0025E210), ref: 0026560B
GetLastError.KERNEL32(00265899,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0025E210,00000000,00000000,0027A8F8,00000010,00000000), ref: 0026563B

Strings

6a,, xrefs: 00265531

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: 6a,
API String ID: 442123175-1499783603
Opcode ID: feb8602432742418e6e0c382cd59f1422ae3f254e8632162a4b7bcef7a7e6623
Instruction ID: 6755de4ac26306c55d3b766f6a736b6e69d29db3c8c6c51d101c153f9cb12afe
Opcode Fuzzy Hash: feb8602432742418e6e0c382cd59f1422ae3f254e8632162a4b7bcef7a7e6623
Instruction Fuzzy Hash: 88317271B10629AFDB14CF69DC85BE973A9EB44300F5440A9E906D7290DA70EED4CF64

Function 0026453D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00264594
__freea.LIBCMT ref: 002645FA

Strings

6a,, xrefs: 00264545

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID: 6a,
API String ID: 1635606685-1499783603
Opcode ID: 0dcad0dc16b12cae889e15a4a5e2d931b6ba889f88c48a98afe38e8ea3830e44
Instruction ID: 2fb146062b78b2b7dd8347db3fadfb73d5fe28ae981a7457bf8056ac3546e9e3
Opcode Fuzzy Hash: 0dcad0dc16b12cae889e15a4a5e2d931b6ba889f88c48a98afe38e8ea3830e44
Instruction Fuzzy Hash: D221E472920156ABDF20AFA5DC45DAF7BB4EF44720F540628FC11AB291D730CDA4CB90

Function 00265439 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000,?,00265884,?,00000000,00000000,00000000,00000000,00000000), ref: 002654E3
GetLastError.KERNEL32(?,00265884,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0025E210,00000000,00000000,0027A8F8,00000010), ref: 00265509

Strings

6a,, xrefs: 00265448

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: 6a,
API String ID: 442123175-1499783603
Opcode ID: bb6af4b1d01ecb633bc07335077c72396c039f25e08091685c60f8fe95b1ee46
Instruction ID: 7b5f3d78812b5fbdd8126f4c026d1ed6b83692ff41e46fc39517c01a6a1f902f
Opcode Fuzzy Hash: bb6af4b1d01ecb633bc07335077c72396c039f25e08091685c60f8fe95b1ee46
Instruction Fuzzy Hash: 9E21D231A102289BCF24CF19DC85AE9B3BAFF48305F5044AAE90AD7250DB30DDD5CAA0

Function 002580C7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00258978
___raise_securityfailure.LIBCMT ref: 00258A60

Strings

6a,, xrefs: 00258A41

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 6a,
API String ID: 3761405300-1499783603
Opcode ID: b0cb2cf19e24711d6b9503dde2b7f2be23146e692a579d2211e5a6fdc36ad237
Instruction ID: 5e54ec6a3ad2c294f5f057aba90fce40711a88ae55f58ac6b66f7fb8b14bef0c
Opcode Fuzzy Hash: b0cb2cf19e24711d6b9503dde2b7f2be23146e692a579d2211e5a6fdc36ad237
Instruction Fuzzy Hash: D221E7B4D62202DBD714CF19FD4AA543BA5BB48314F30812BEA18DB3A0EBB19C84CF45

Function 002522C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 002522CF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00252307

Part of subcall function 00256013: _Yarn.LIBCPMT ref: 00256032
Part of subcall function 00256013: _Yarn.LIBCPMT ref: 00256056

Strings

bad locale name, xrefs: 00252315

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 197579d3930a0715293464fa32dc3f22b7e5655c6fc99379bc3400920b8a94d5
Instruction ID: 3d0df8755686f4148d63e78eab131294dbae91c78f0814d7eee4c073c49e9ec0
Opcode Fuzzy Hash: 197579d3930a0715293464fa32dc3f22b7e5655c6fc99379bc3400920b8a94d5
Instruction Fuzzy Hash: E1F01D71515B509E83309F7A8481447FBE4BE2D2113908A6EE4DEC3A11D730A558CFA9

Function 00257D29 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,002578EB,?,00000000,00000000,?,002578AA,?,?,00000000,?,00255A8B,?,?,00000000), ref: 00257D61
GetSystemTimeAsFileTime.KERNEL32(?,EC2C6136,?,?,0026F0DD,000000FF,?,002578EB,?,00000000,00000000,?,002578AA,?,?,00000000), ref: 00257D65

Strings

6a,, xrefs: 00257D3B

Memory Dump Source

Source File: 00000000.00000002.1666253803.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1666224326.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666294499.0000000000271000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666321351.000000000027C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1666373342.00000000002DE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_hObXeMHkSShI8GL7378ICT2M.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Precise
String ID: 6a,
API String ID: 743729956-1499783603
Opcode ID: 70ee487713739515031f4da9c0ea36e6cbd6b53932a3a305e37ddf53c6411bf3
Instruction ID: ab1184cfea64db2a98f2b3536695fb1c76e44f2cf13ba36c823f59e1bc56dcd2
Opcode Fuzzy Hash: 70ee487713739515031f4da9c0ea36e6cbd6b53932a3a305e37ddf53c6411bf3
Instruction Fuzzy Hash: D6F0A036959554EBCB118F54FC05B69B7A8EB08B10F104227EC1293390CB75A800CB94

Analysis Process: RegAsm.exePID: 7348, Parent PID: 7284COMMON

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	476
Total number of Limit Nodes:	33

Executed Functions

Function 04F24D25 Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04F24E42

Memory Dump Source

Source File: 00000002.00000002.1688615675.0000000004F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f20000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e1d714a596895c44192b90cfabc538ced64661aa6b9705b451fc73604c632838
Instruction ID: e863d57a0e832e4699c5e0c28776d2f69757925b8d84600c3f20bd2c2a59846d
Opcode Fuzzy Hash: e1d714a596895c44192b90cfabc538ced64661aa6b9705b451fc73604c632838
Instruction Fuzzy Hash: A151C2B1D003599FDB14CFA9C984ADEBBB5FF48314F24812AE418AB210D775A986CF91

Function 04F24150 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04F24E42

Memory Dump Source

Source File: 00000002.00000002.1688615675.0000000004F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f20000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 58afb51ab63a7091fd102a38326ee89f007d7621f52f5db9ce7a47f31d75678a
Instruction ID: a8ae97292dfb22074db2fe06e7e26ac5801c86985b04e61f8c2e32b991158bd0
Opcode Fuzzy Hash: 58afb51ab63a7091fd102a38326ee89f007d7621f52f5db9ce7a47f31d75678a
Instruction Fuzzy Hash: BE51C1B1D00319AFDB14CF99C984ADEBBB5BF48314F24812AE418AB214D7B0A845CF91

Function 04F242A4 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04F273C1

Memory Dump Source

Source File: 00000002.00000002.1688615675.0000000004F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f20000_RegAsm.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 6f23f23ba29a36c3d3fc0dbe069732a4a8ed054b9d0bd5b66c0adaf292d02ff1
Instruction ID: 9704ab73f4a33099978e7bd5fd2ea887f70a2f3f93fe5421484291dcc0190fa0
Opcode Fuzzy Hash: 6f23f23ba29a36c3d3fc0dbe069732a4a8ed054b9d0bd5b66c0adaf292d02ff1
Instruction Fuzzy Hash: F64149B5A00215DFDB04DF99C948AABBBF5FF88314F24C459E519AB321D374B841CBA0

Function 027876A0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02788F91

Memory Dump Source

Source File: 00000002.00000002.1684382511.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2780000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 55d48d5845d2e3ac4e728753387ae2e078fbda894f51569a70ceffc4004b268a
Instruction ID: 04a94bb2720f1e679074f4c20f1f687e6b421e67ff031f0dc6273be62005cd69
Opcode Fuzzy Hash: 55d48d5845d2e3ac4e728753387ae2e078fbda894f51569a70ceffc4004b268a
Instruction Fuzzy Hash: A741F1B1C0061DCFDB24DFA9C844B9EBBF5BF45304F20806AD408AB254DB756946CF91

Function 0278DF78 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0278E539,00000800,00000000,00000000), ref: 0278E74A

Memory Dump Source

Source File: 00000002.00000002.1684382511.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2780000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: dc5080dea0335494c4277d0b98090acf6f3e58a25b1cd6616a8c733eb5dce629
Instruction ID: f496a1b722b3ea4d92e826fd2e0ad185f466c9bde5b58d49ba123e4dda4d5b31
Opcode Fuzzy Hash: dc5080dea0335494c4277d0b98090acf6f3e58a25b1cd6616a8c733eb5dce629
Instruction Fuzzy Hash: 091112B69002099FEB20DF9AC944ADEFBF4EB89324F14842AE559B7210C375A544CFA4

Function 04F6E1B1 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32(?,00000000), ref: 04F6E222

Memory Dump Source

Source File: 00000002.00000002.1688857824.0000000004F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f60000_RegAsm.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 31b82bae3ddda698efe159bd6263c739770717e0b1a750887b04434b945fc616
Instruction ID: 0d11c516b95a67918985684985ac9bf0fcf31c0d82c3810ab577474631e51eb3
Opcode Fuzzy Hash: 31b82bae3ddda698efe159bd6263c739770717e0b1a750887b04434b945fc616
Instruction Fuzzy Hash: 721133B6C002498FDB10CF9AC444ADEBBF5EF88320F10842AD869A7250D338A546CFA1

Function 04F6E1B8 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32(?,00000000), ref: 04F6E222

Memory Dump Source

Source File: 00000002.00000002.1688857824.0000000004F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f60000_RegAsm.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: baa58bbd7bc07c63b1faa8e24881ccbf3062c0bd6104f453a7b4529d71b34b02
Instruction ID: 54ec23ddafeaaa6f31660fafb67081108c05389ee41173491d6b1c3db467940b
Opcode Fuzzy Hash: baa58bbd7bc07c63b1faa8e24881ccbf3062c0bd6104f453a7b4529d71b34b02
Instruction Fuzzy Hash: 691123B6C002498FDB14CF9AC844BDEFBF5EB88320F14C42AD869A7240D338A545CFA1

Function 04F24F72 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,04F24F60,?,?,?,?), ref: 04F24FD5

Memory Dump Source

Source File: 00000002.00000002.1688615675.0000000004F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f20000_RegAsm.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 75fb4fa5aa8f8fe4e86c64b735bc44276a74e6996b1e0014507f89be18fcf517
Instruction ID: 0e7e6e1b2879a3ebe7ef1d78117e76add7c660a8f1754c66212fb33a5271e0b0
Opcode Fuzzy Hash: 75fb4fa5aa8f8fe4e86c64b735bc44276a74e6996b1e0014507f89be18fcf517
Instruction Fuzzy Hash: FE1103B5800258DFDB10CF99D585BDEBBF4EB88324F10851AD958A7700C379A985CFA1

Function 04F2418C Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,04F24F60,?,?,?,?), ref: 04F24FD5

Memory Dump Source

Source File: 00000002.00000002.1688615675.0000000004F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f20000_RegAsm.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 51491c3dab91d2abd223d64649d3924ea9c6a4c892d640828ebc462e9c7fcd96
Instruction ID: eb328a069cee657003cf1372a11c4a45bc5589bcce99e4d35a1022b46f11a10c
Opcode Fuzzy Hash: 51491c3dab91d2abd223d64649d3924ea9c6a4c892d640828ebc462e9c7fcd96
Instruction Fuzzy Hash: 3C11F5B5900258DFDB10CF99C545BDEBBF4EB88324F10841AE954A7300D374B944CFA5

Function 0278E458 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0278E4BE

Memory Dump Source

Source File: 00000002.00000002.1684382511.0000000002780000.00000040.00000800.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2780000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1f0dc275edbfa07e5bbfd691aa8d6aeb293f0cf59dc68893ffe2dabfcfef1fac
Instruction ID: f57b349f0ba660ec686d6614428a76112673afa5ea669534ab7c299b34a1d007
Opcode Fuzzy Hash: 1f0dc275edbfa07e5bbfd691aa8d6aeb293f0cf59dc68893ffe2dabfcfef1fac
Instruction Fuzzy Hash: 1D1110B6D002498FCB10DF9AC444ADEFBF4AB88328F10842AE468A7210C374A545CFA1

Function 04F69F94 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000018,00000001,?), ref: 04F6FC95

Memory Dump Source

Source File: 00000002.00000002.1688857824.0000000004F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f60000_RegAsm.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6c9cd6d7f09a133e62589ae9238009c1897600a446d61c76784ec4f238d5fd86
Instruction ID: 4ff6cfd5e7480a988577320223015457ff1a7b64c41c1e958af581a21dbe4117
Opcode Fuzzy Hash: 6c9cd6d7f09a133e62589ae9238009c1897600a446d61c76784ec4f238d5fd86
Instruction Fuzzy Hash: 7B1106B6800348DFDB10CF9AD545BDEBBF8EB48324F108419E955A7300D374A944CFA5

Function 04F6FC31 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000018,00000001,?), ref: 04F6FC95

Memory Dump Source

Source File: 00000002.00000002.1688857824.0000000004F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f60000_RegAsm.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3c4988faa234adbc8fb111f727377ee92280e0b32b5b63e27915743e03388073
Instruction ID: accee7ce1f261028088c5d219979d1eacdefa24f87f15c09566b12b035717a8a
Opcode Fuzzy Hash: 3c4988faa234adbc8fb111f727377ee92280e0b32b5b63e27915743e03388073
Instruction Fuzzy Hash: 9E1100B6800248DFDB10CF9AD985BDEBBF8EB48324F10881AD958B7210C374A584CFA1

Function 00BBD4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1683689672.0000000000BBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bbd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f532f5b2b4888917b4268c86aac9b148db068e1da300b7a25959c9e80091c375
Instruction ID: 85e7403e216b814fea2cecabcfea2df0030c501dd2103e76a70824a8bf30c84c
Opcode Fuzzy Hash: f532f5b2b4888917b4268c86aac9b148db068e1da300b7a25959c9e80091c375
Instruction Fuzzy Hash: D1212571500200DFCB15DF14D9C0B66BFA5FBA8318F2486A9D9094B256D37AD856CAA2

Function 0273D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1684148008.000000000273D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0273D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_273d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ebc2c0a8dd6424b87f9721f5b2c63c99cb039ff9c3479c1bfdb248ba0d20fc1
Instruction ID: 0bddb8c9b225145bf38ae7de4541dad738fe0f6992e7bc90cb87a109afac1f88
Opcode Fuzzy Hash: 0ebc2c0a8dd6424b87f9721f5b2c63c99cb039ff9c3479c1bfdb248ba0d20fc1
Instruction Fuzzy Hash: 5D2126B1504204EFDB26DF14DAC0B27BBA5FB88314F24C66DE8495B257C736D446CA61

Function 0273D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1684148008.000000000273D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0273D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_273d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a49d33aa1bd1afa4865449afb1fa376015dcb8c1a14584f306974ac7eca327
Instruction ID: 85803cf5c1a401b975140f8946e07dd6ca49bf0c4bef82501a638ece154cdcd9
Opcode Fuzzy Hash: 40a49d33aa1bd1afa4865449afb1fa376015dcb8c1a14584f306974ac7eca327
Instruction Fuzzy Hash: DE2134B1604200DFDB26DF24D9C4B26BFA5FB84B14F20C56DD84A4B257C33AD447CA61

Function 0273D007 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1684148008.000000000273D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0273D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_273d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1322337873049426af25d286277dcbad3a17c4a72ccb278f9b3d5d691f9f0db5
Instruction ID: 63b263949f46ba8826f8a5ff4606764667e716f7100d03d33899c499ee14a4b0
Opcode Fuzzy Hash: 1322337873049426af25d286277dcbad3a17c4a72ccb278f9b3d5d691f9f0db5
Instruction Fuzzy Hash: 8E218E755093C08FCB13CF24D994715BF71EB46614F28C5DAD8898F667C33A980ACB62

Function 00BBD4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1683689672.0000000000BBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bbd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction ID: 4f299bdd82f7a96a5ae41475022701b832e4349e6a7c0843e57dd1059fb9e024
Opcode Fuzzy Hash: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction Fuzzy Hash: 3011D676504240CFCB15CF14D5C4B66BFB1FBA4318F24C6A9D9094B616C33AD856CB91

Function 0273D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1684148008.000000000273D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0273D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_273d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17de7163a1e12a4c5df783ee0f29f24f6994aba7d146e6d7d26c00eb2d5c80d5
Instruction ID: 531674381a2f446f3312f6565a8d7b4f8dce2b537f5e58f1597882b59c2761a8
Opcode Fuzzy Hash: 17de7163a1e12a4c5df783ee0f29f24f6994aba7d146e6d7d26c00eb2d5c80d5
Instruction Fuzzy Hash: 4F119D75504280DFDB16CF14D5C4B16FFA1FB84328F28C6AED8494B656C33AD45ACB61

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hObXeMHkSShI8GL7378ICT2M.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

UDP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Windows Analysis Report
hObXeMHkSShI8GL7378ICT2M.exe

Function 00BD018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 002648DD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 202
COMMON

Function 002631DE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00268914 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177
COMMON

Function 0026535E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80
fileCOMMONLIBRARYCODE

Function 00270545 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78
COMMON

Function 00270649 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
memoryCOMMON

Function 0025FE66 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00268518 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 147
COMMON

Function 00256EEC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108
COMMON

Function 002632A9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57
COMMONLIBRARYCODE

Function 0026575C Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Function 002513CB Relevance: 3.1, APIs: 2, Instructions: 134
COMMON

Function 002639B2 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00263678 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE