Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
surfex.exe

Overview

General Information

Sample name:surfex.exe
Analysis ID:1577531
MD5:1f4b0637137572a1fb34aaa033149506
SHA1:c209c9a60a752bc7980a3d9d53daf4b4b32973a9
SHA256:60c645c0a668c13ad36d2d5b67777dedf992e392e652e7f0519f21d658254648
Tags:18521511316185215113209bulletproofexeRedLineStealeruser-abus3reports
Infos:

Detection

RedLine
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
.NET source code contains very large array initializations
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Installs new ROOT certificates
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops certificate files (DER)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • surfex.exe (PID: 7412 cmdline: "C:\Users\user\Desktop\surfex.exe" MD5: 1F4B0637137572A1FB34AAA033149506)
    • conhost.exe (PID: 7420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • RegAsm.exe (PID: 7512 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
    • RegAsm.exe (PID: 7520 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
RedLine StealerRedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "185.218.125.157:21441", "Bot Id": "TG@CVV88888", "Authorization Header": "7e02e4a11bbfb75ade695ae80e1693a0"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.1384266730.0000000003665000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_RedLineYara detected RedLine StealerJoe Security
    00000004.00000002.2633603062.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_RedLineYara detected RedLine StealerJoe Security
      Process Memory Space: surfex.exe PID: 7412JoeSecurity_RedLineYara detected RedLine StealerJoe Security
        Process Memory Space: RegAsm.exe PID: 7520JoeSecurity_RedLineYara detected RedLine StealerJoe Security

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          0.2.surfex.exe.3665570.0.raw.unpackJoeSecurity_RedLineYara detected RedLine StealerJoe Security
            4.2.RegAsm.exe.400000.0.unpackJoeSecurity_RedLineYara detected RedLine StealerJoe Security
              0.2.surfex.exe.3665570.0.unpackJoeSecurity_RedLineYara detected RedLine StealerJoe Security

                Sigma Signatures

                ⊘No Sigma rule has matched

                Suricata Signatures

                ⊘No Suricata rule has matched

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Antivirus / Scanner detection for submitted sample
                Source: surfex.exeAvira: detected
                Found malware configuration
                Source: 00000000.00000002.1384266730.0000000003665000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: RedLine {"C2 url": "185.218.125.157:21441", "Bot Id": "TG@CVV88888", "Authorization Header": "7e02e4a11bbfb75ade695ae80e1693a0"}
                Multi AV Scanner detection for submitted file
                Source: surfex.exeReversingLabs: Detection: 68%
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.7% probability
                Source: surfex.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: surfex.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                Source: Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: RegAsm.exe, 00000004.00000002.2636262302.0000000005504000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: c:\56zm\xzd9\obj\Releas\Zaq1.pdbpdb source: surfex.exe
                Source: Binary string: C:\Windows\System.ServiceModel.pdb source: RegAsm.exe, 00000004.00000002.2633721942.0000000000B87000.00000004.00000010.00020000.00000000.sdmp
                Source: Binary string: System.ServiceModel.pdb source: RegAsm.exe, 00000004.00000002.2636262302.00000000054F7000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: RegAsm.exe, 00000004.00000002.2633840690.0000000000D71000.00000004.00000020.00020000.00000000.sdmp

                Networking

                barindex
                C2 URLs / IPs found in malware configuration
                Source: Malware configuration extractorURLs: 185.218.125.157:21441
                Source: global trafficTCP traffic: 192.168.2.9:49707 -> 185.218.125.157:21441
                Source: Joe Sandbox ViewASN Name: QUICKPACKETUS QUICKPACKETUS
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: unknownTCP traffic detected without corresponding DNS query: 185.218.125.157
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9i
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Ent
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id1
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id10
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id10LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id10Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id10Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id11
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id11LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id11Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id11Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id12
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id12LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id12Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id12Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id13
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id13LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id13Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id13Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id14
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id14LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id14Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id14Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id15
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id15LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id15Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id15Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id16
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id16LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id16Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id16Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id17
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id17LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id17Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id17Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id18
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id18LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id18Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id18Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id19
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id19LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id19Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id19Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id1LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id1Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id1Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id2
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id20
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id20LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id20Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id20Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id21
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id21LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id21Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id21Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id22
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id22LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id22Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id22Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id23
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id23LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id23Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id23Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id24
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id24LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id24Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id24Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id2LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id2Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id2Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id3
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id3LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id3Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id3Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id4
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id4LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id4Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id4Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id5
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id5LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id5Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id5Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id6
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id6LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id6Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id6Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id7
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id7LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id7Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id7Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id8
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id8LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id8Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id8Responsex
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id9
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id9LR
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id9Response
                Source: RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id9Responsex
                Source: surfex.exe, 00000000.00000002.1384266730.0000000003665000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2633603062.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://api.ip.sb/ip
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Temp\Tmp88CB.tmpJump to dropped file
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Temp\Tmp8949.tmpJump to dropped file

                System Summary

                barindex
                .NET source code contains very large array initializations
                Source: surfex.exe, MoveAngles.csLarge array initialization: MoveAngles: array initializer size 308224
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 4_2_0294DC744_2_0294DC74
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 4_2_065067D84_2_065067D8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 4_2_0650A3E84_2_0650A3E8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 4_2_06503F504_2_06503F50
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 4_2_0650A3D84_2_0650A3D8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 4_2_06506FF84_2_06506FF8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 4_2_06506FE84_2_06506FE8
                Source: surfex.exe, 00000000.00000000.1378540597.0000000000340000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameVQP.exeD vs surfex.exe
                Source: surfex.exe, 00000000.00000002.1384266730.0000000003698000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBipolar.exe8 vs surfex.exe
                Source: surfex.exe, 00000000.00000002.1383524196.000000000082E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs surfex.exe
                Source: surfex.exeBinary or memory string: OriginalFilenameVQP.exeD vs surfex.exe
                Source: surfex.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: surfex.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: classification engineClassification label: mal100.troj.evad.winEXE@6/5@0/1
                Source: C:\Users\user\Desktop\surfex.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\surfex.exe.logJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMutant created: NULL
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7420:120:WilError_03
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Temp\Tmp88CB.tmpJump to behavior
                Source: surfex.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: surfex.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Program Files (x86)\desktop.iniJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: surfex.exeReversingLabs: Detection: 68%
                Source: unknownProcess created: C:\Users\user\Desktop\surfex.exe "C:\Users\user\Desktop\surfex.exe"
                Source: C:\Users\user\Desktop\surfex.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Users\user\Desktop\surfex.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                Source: C:\Users\user\Desktop\surfex.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                Source: C:\Users\user\Desktop\surfex.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
                Source: C:\Users\user\Desktop\surfex.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
                Source: C:\Users\user\Desktop\surfex.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: aclayers.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc_os.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dwrite.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: msvcp140_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wshext.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: appxsip.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: opcservices.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: esdsip.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dpapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sxs.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: scrrun.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: linkinfo.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32Jump to behavior
                Source: Google Chrome.lnk.4.drLNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                Source: surfex.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                Source: surfex.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                Source: surfex.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: RegAsm.exe, 00000004.00000002.2636262302.0000000005504000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: c:\56zm\xzd9\obj\Releas\Zaq1.pdbpdb source: surfex.exe
                Source: Binary string: C:\Windows\System.ServiceModel.pdb source: RegAsm.exe, 00000004.00000002.2633721942.0000000000B87000.00000004.00000010.00020000.00000000.sdmp
                Source: Binary string: System.ServiceModel.pdb source: RegAsm.exe, 00000004.00000002.2636262302.00000000054F7000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: RegAsm.exe, 00000004.00000002.2633840690.0000000000D71000.00000004.00000020.00020000.00000000.sdmp
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 4_2_0650ECF2 push eax; ret 4_2_0650ED01
                Source: surfex.exeStatic PE information: section name: .text entropy: 7.996095896093537

                Persistence and Installation Behavior

                barindex
                Installs new ROOT certificates
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 BlobJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeMemory allocated: 2460000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeMemory allocated: 2660000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeMemory allocated: 4660000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 2940000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 2B20000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 2960000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\surfex.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\Desktop\surfex.exe TID: 7508Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7524Thread sleep time: -55000s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeLast function: Thread delayed
                Source: C:\Users\user\Desktop\surfex.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: RegAsm.exe, 00000004.00000002.2633840690.0000000000D71000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
                Source: RegAsm.exe, 00000004.00000002.2636262302.0000000005504000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll~
                Source: C:\Users\user\Desktop\surfex.exeMemory allocated: page read and write | page guardJump to behavior

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Allocates memory in foreign processes
                Source: C:\Users\user\Desktop\surfex.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and writeJump to behavior
                Contains functionality to inject code into remote processes
                Source: C:\Users\user\Desktop\surfex.exeCode function: 0_2_0266248D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,0_2_0266248D
                Injects a PE file into a foreign processes
                Source: C:\Users\user\Desktop\surfex.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5AJump to behavior
                Writes to foreign memory regions
                Source: C:\Users\user\Desktop\surfex.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000Jump to behavior
                Source: C:\Users\user\Desktop\surfex.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000Jump to behavior
                Source: C:\Users\user\Desktop\surfex.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000Jump to behavior
                Source: C:\Users\user\Desktop\surfex.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44E000Jump to behavior
                Source: C:\Users\user\Desktop\surfex.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 816008Jump to behavior
                Source: C:\Users\user\Desktop\surfex.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
                Source: C:\Users\user\Desktop\surfex.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
                Source: C:\Users\user\Desktop\surfex.exeQueries volume information: C:\Users\user\Desktop\surfex.exe VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                Source: surfex.exe, 00000000.00000002.1383524196.0000000000862000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: avp.exe
                Source: surfex.exe, 00000000.00000002.1383524196.0000000000862000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AVP.exe

                Stealing of Sensitive Information

                barindex
                Yara detected RedLine Stealer
                Source: Yara matchFile source: 0.2.surfex.exe.3665570.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.surfex.exe.3665570.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000000.00000002.1384266730.0000000003665000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.2633603062.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: surfex.exe PID: 7412, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 7520, type: MEMORYSTR

                Remote Access Functionality

                barindex
                Yara detected RedLine Stealer
                Source: Yara matchFile source: 0.2.surfex.exe.3665570.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.surfex.exe.3665570.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000000.00000002.1384266730.0000000003665000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.2633603062.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: surfex.exe PID: 7412, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 7520, type: MEMORYSTR

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
                DLL Side-Loading                		411
                Process Injection                		1
                Masquerading                		OS Credential Dumping11
                Security Software Discovery                		Remote Services1
                Archive Collected Data                		1
                Encrypted Channel                		Exfiltration Over Other Network MediumAbuse Accessibility Features
                CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
                DLL Side-Loading                		1
                Disable or Modify Tools                		LSASS Memory31
                Virtualization/Sandbox Evasion                		Remote Desktop ProtocolData from Removable Media1
                Non-Standard Port                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)31
                Virtualization/Sandbox Evasion                		Security Account Manager1
                File and Directory Discovery                		SMB/Windows Admin SharesData from Network Shared Drive1
                Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook411
                Process Injection                		NTDS12
                System Information Discovery                		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
                Obfuscated Files or Information                		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                Install Root Certificate                		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
                Software Packing                		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                DLL Side-Loading                		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                surfex.exe68%ReversingLabsByteCode-MSIL.Trojan.Jalapeno
                surfex.exe100%AviraTR/AD.RedLineSteal.yzflb

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                185.218.125.157:214410%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                ⊘No contacted domains info

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                185.218.125.157:21441true
                • Avira URL Cloud: safe
                		unknown

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                http://tempuri.org/Entity/Id24LRRegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                  		high
                  http://tempuri.org/Entity/Id20LRRegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                    		high
                    http://tempuri.org/Entity/Id12ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      http://tempuri.org/Entity/Id15ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        http://tempuri.org/RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://tempuri.org/Entity/Id2ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://tempuri.org/Entity/Id21ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://tempuri.org/Entity/Id9RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://tempuri.org/Entity/Id8RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://tempuri.org/Entity/Id5RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://tempuri.org/Entity/Id4RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://tempuri.org/Entity/Id17LRRegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://tempuri.org/Entity/Id7RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          http://tempuri.org/Entity/Id6RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            http://tempuri.org/Entity/Id9LRRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              http://tempuri.org/Entity/Id10ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                http://tempuri.org/Entity/Id19ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://tempuri.org/Entity/Id13LRRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://tempuri.org/Entity/Id1LRRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequenceRegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://tempuri.org/Entity/Id5LRRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://tempuri.org/EntRegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://tempuri.org/Entity/Id6ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://tempuri.org/Entity/Id7ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://tempuri.org/Entity/Id15ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://tempuri.org/Entity/Id1ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://tempuri.org/Entity/Id6ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://api.ip.sb/ipsurfex.exe, 00000000.00000002.1384266730.0000000003665000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2633603062.0000000000402000.00000040.00000400.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://tempuri.org/Entity/Id23ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://tempuri.org/Entity/Id21LRRegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://tempuri.org/Entity/Id5ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://tempuri.org/Entity/Id14ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://tempuri.org/Entity/Id9ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://tempuri.org/Entity/Id20ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://tempuri.org/Entity/Id20RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://tempuri.org/Entity/Id21RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://tempuri.org/Entity/Id22RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://tempuri.org/Entity/Id23RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://tempuri.org/Entity/Id24RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://tempuri.org/Entity/Id24ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://tempuri.org/Entity/Id1ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequestedRegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://tempuri.org/Entity/Id8ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://tempuri.org/Entity/Id18LRRegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://tempuri.org/Entity/Id14LRRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://tempuri.org/Entity/Id6LRRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://tempuri.org/Entity/RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://schemas.xmlsoap.org/ws/2004/08/addressingRegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://tempuri.org/Entity/Id10LRRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://tempuri.org/Entity/Id3ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://tempuri.org/Entity/Id2LRRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://tempuri.org/Entity/Id10RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://tempuri.org/Entity/Id11RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://tempuri.org/Entity/Id12RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            http://tempuri.org/Entity/Id16ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://tempuri.org/Entity/Id13RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://tempuri.org/Entity/Id14RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://tempuri.org/Entity/Id15RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    http://tempuri.org/Entity/Id16RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://tempuri.org/Entity/Id12ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        http://tempuri.org/Entity/Id17RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          http://tempuri.org/Entity/Id17ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            http://tempuri.org/Entity/Id18RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              http://tempuri.org/Entity/Id5ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                http://tempuri.org/Entity/Id19RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dnsRegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    http://tempuri.org/Entity/Id10ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      http://tempuri.org/Entity/Id8ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        http://tempuri.org/Entity/Id22LRRegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          http://tempuri.org/Entity/Id18ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            http://schemas.xmlsoap.org/soap/envelope/RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              http://tempuri.org/Entity/Id19LRRegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                http://tempuri.org/Entity/Id23ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  http://tempuri.org/Entity/Id22ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    http://tempuri.org/Entity/Id15LRRegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      http://tempuri.org/Entity/Id19ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        http://tempuri.org/Entity/Id7LRRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          http://tempuri.org/Entity/Id11LRRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              http://tempuri.org/Entity/Id17ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                http://tempuri.org/Entity/Id20ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  http://tempuri.org/Entity/Id3LRRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9iRegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      http://tempuri.org/Entity/Id13ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        http://tempuri.org/Entity/Id4ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          http://tempuri.org/Entity/Id21ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            http://schemas.xmlsoap.org/ws/2005/05/identity/right/possesspropertyRegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgementRegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                http://tempuri.org/Entity/Id23LRRegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  http://tempuri.org/Entity/Id7ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		high
                                                                                                                                                                                                    http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymousRegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      		high
                                                                                                                                                                                                      http://tempuri.org/Entity/Id11ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        		high
                                                                                                                                                                                                        http://tempuri.org/Entity/Id2ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          		high
                                                                                                                                                                                                          http://tempuri.org/Entity/Id11ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                            		high
                                                                                                                                                                                                            http://tempuri.org/Entity/Id22ResponseRegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              		high
                                                                                                                                                                                                              http://tempuri.org/Entity/Id1RegAsm.exe, 00000004.00000002.2634444607.0000000002CAF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E39000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002C56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002ED6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F25000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D9B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002F74000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000002D4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                		high
                                                                                                                                                                                                                http://tempuri.org/Entity/Id13ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  		high
                                                                                                                                                                                                                  http://tempuri.org/Entity/Id16ResponsexRegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                    		high
                                                                                                                                                                                                                    http://tempuri.org/Entity/Id16LRRegAsm.exe, 00000004.00000002.2634444607.0000000003012000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2634444607.0000000003061000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                      		high

                                                                                                                                                                                                                      World Map of Contacted IPs

                                                                                                                                                                                                                      • No. of IPs < 25%
                                                                                                                                                                                                                      • 25% < No. of IPs < 50%
                                                                                                                                                                                                                      • 50% < No. of IPs < 75%
                                                                                                                                                                                                                      • 75% < No. of IPs

                                                                                                                                                                                                                      Public IPs

                                                                                                                                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                                      185.218.125.157
                                                                                                                                                                                                                      		unknownGermany
                                                                                                                                                                                                                      		46261QUICKPACKETUStrue

                                                                                                                                                                                                                      General Information

                                                                                                                                                                                                                      Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                                      Analysis ID:1577531
                                                                                                                                                                                                                      Start date and time:2024-12-18 15:07:29 +01:00
                                                                                                                                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                                                                                                                                      Overall analysis duration:0h 4m 47s
                                                                                                                                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                                                                                                                                      Report type:full
                                                                                                                                                                                                                      Cookbook file name:default.jbs
                                                                                                                                                                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                                      Number of analysed new started processes analysed:10
                                                                                                                                                                                                                      Number of new started drivers analysed:0
                                                                                                                                                                                                                      Number of existing processes analysed:0
                                                                                                                                                                                                                      Number of existing drivers analysed:0
                                                                                                                                                                                                                      Number of injected processes analysed:0
                                                                                                                                                                                                                      Technologies:
                                                                                                                                                                                                                      • HCA enabled
                                                                                                                                                                                                                      • EGA enabled
                                                                                                                                                                                                                      • AMSI enabled
                                                                                                                                                                                                                      Analysis Mode:default
                                                                                                                                                                                                                      Analysis stop reason:Timeout
                                                                                                                                                                                                                      Sample name:surfex.exe
                                                                                                                                                                                                                      Detection:MAL
                                                                                                                                                                                                                      Classification:mal100.troj.evad.winEXE@6/5@0/1
                                                                                                                                                                                                                      EGA Information:
                                                                                                                                                                                                                      • Successful, ratio: 100%
                                                                                                                                                                                                                      HCA Information:
                                                                                                                                                                                                                      • Successful, ratio: 99%
                                                                                                                                                                                                                      • Number of executed functions: 79
                                                                                                                                                                                                                      • Number of non-executed functions: 13
                                                                                                                                                                                                                      Cookbook Comments:
                                                                                                                                                                                                                      • Found application associated with file extension: .exe

                                                                                                                                                                                                                      Warnings

                                                                                                                                                                                                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                                                                                                                                                                                      • Excluded IPs from analysis (whitelisted): 4.245.163.56
                                                                                                                                                                                                                      • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                                      • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                                      • VT rate limit hit for: surfex.exe

                                                                                                                                                                                                                      Simulations

                                                                                                                                                                                                                      Behavior and APIs

                                                                                                                                                                                                                      ⊘No simulations

                                                                                                                                                                                                                      Joe Sandbox View / Context

                                                                                                                                                                                                                      IPs

                                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                      185.218.125.157YBO7mSI3Ul.exeGet hashmaliciousRedLineBrowse

                                                                                                                                                                                                                        Domains

                                                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                                                        ASNs

                                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                        QUICKPACKETUSc2.htaGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                        • 193.26.115.21
                                                                                                                                                                                                                        armv5l.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                        • 23.133.3.186
                                                                                                                                                                                                                        elitebotnet.mpsl.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                                                        • 23.133.3.168
                                                                                                                                                                                                                        loligang.x86.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                        • 185.225.234.108
                                                                                                                                                                                                                        c2.htaGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                        • 193.26.115.21
                                                                                                                                                                                                                        c2.htaGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                        • 193.26.115.21
                                                                                                                                                                                                                        EeSNugjFh5.batGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 193.26.115.21
                                                                                                                                                                                                                        https://webradiojaguar.net/FNB-POP.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 172.82.129.154
                                                                                                                                                                                                                        c2.htaGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                        • 193.26.115.21
                                                                                                                                                                                                                        Play_VM-NowCRQW.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                        • 172.82.129.154

                                                                                                                                                                                                                        JA3 Fingerprints

                                                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                                                        Dropped Files

                                                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                                                        Created / dropped Files

                                                                                                                                                                                                                        C:\Users\Public\Desktop\Google Chrome.lnk

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 08:16:16 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):2104
                                                                                                                                                                                                                        Entropy (8bit):3.4563179169755576
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:48:8S9dYT5H0lRYrnvPdAKRkdAGdAKRFdAKRz:8SIx7
                                                                                                                                                                                                                        MD5:A2EA156492FE026929AEF7FBAF822CAA
                                                                                                                                                                                                                        SHA1:27A79DCB903536F3626E24D4D92C2C37141B2BF6
                                                                                                                                                                                                                        SHA-256:3FE976A7F0B76423AB7E51D9F4B3643231FDF7997EA7E754F45DA6D9EE0303FB
                                                                                                                                                                                                                        SHA-512:E6E5F0A5FDADA05E5966AF33B21D3F69E07A42024DF530D22AC164DCCC9C1B086B9A9BB52C8B9B26C6ADFF436CEF00EE44822BAF48BB9BC298837FB2492DE403
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                        Preview:L..................F.@.. ......,....3...l....X.&&... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.IEW.I....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEW.F....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VEW.F....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VEW.F.............................A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.L .chrome.exe..F......CW.VEW.I..........................l...c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\surfex.exe.log

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\surfex.exe
                                                                                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):42
                                                                                                                                                                                                                        Entropy (8bit):4.0050635535766075
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3:QHXMKa/xwwUy:Q3La/xwQ
                                                                                                                                                                                                                        MD5:84CFDB4B995B1DBF543B26B86C863ADC
                                                                                                                                                                                                                        SHA1:D2F47764908BF30036CF8248B9FF5541E2711FA2
                                                                                                                                                                                                                        SHA-256:D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
                                                                                                                                                                                                                        SHA-512:485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Reputation:high, very likely benign file
                                                                                                                                                                                                                        Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Tmp88CB.tmp

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):2662
                                                                                                                                                                                                                        Entropy (8bit):7.8230547059446645
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
                                                                                                                                                                                                                        MD5:1420D30F964EAC2C85B2CCFE968EEBCE
                                                                                                                                                                                                                        SHA1:BDF9A6876578A3E38079C4F8CF5D6C79687AD750
                                                                                                                                                                                                                        SHA-256:F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
                                                                                                                                                                                                                        SHA-512:6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Reputation:moderate, very likely benign file
                                                                                                                                                                                                                        Preview:0..b...0.."..*.H..............0...0.....*.H..............0...0.....*.H............0...0...*.H.......0...p.,|.(.............mW.....$|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%..*.X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...|B.d..kr.=G.g.v..f.d.C.?..*.0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Tmp8949.tmp

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):2662
                                                                                                                                                                                                                        Entropy (8bit):7.8230547059446645
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
                                                                                                                                                                                                                        MD5:1420D30F964EAC2C85B2CCFE968EEBCE
                                                                                                                                                                                                                        SHA1:BDF9A6876578A3E38079C4F8CF5D6C79687AD750
                                                                                                                                                                                                                        SHA-256:F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
                                                                                                                                                                                                                        SHA-512:6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Reputation:moderate, very likely benign file
                                                                                                                                                                                                                        Preview:0..b...0.."..*.H..............0...0.....*.H..............0...0.....*.H............0...0...*.H.......0...p.,|.(.............mW.....$|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%..*.X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...|B.d..kr.=G.g.v..f.d.C.?..*.0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):2251
                                                                                                                                                                                                                        Entropy (8bit):7.645088805856235
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:48:S7SjQDUW8LzvLzhNDlpMT3pmIcUSmwprWggmzCl05fpGmETeJaIv4:ASUD0TzhNT6fcUSmwprWm0GfJ3z4
                                                                                                                                                                                                                        MD5:F5CB60C9F53DBE487550AC3178FBA7FB
                                                                                                                                                                                                                        SHA1:B40BBF106C76F015514EFF58B1F1470FD4CBD7E6
                                                                                                                                                                                                                        SHA-256:7C6BB885ACDA675190C630E57BBDA0442A7D2BB5EBE78CE9A1AC113F5D64E8C2
                                                                                                                                                                                                                        SHA-512:C05F8EB725D1469B87FD18DD31E944C21B4F5FD84756A58CA4B21BC5BA7E85FA15E747E8187CFE9C23B6E74705B6741BAD2D3A389B18C0FEE93B8AE74FA7F68E
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........'...............P...............{41744BE4-11C5-494C-A213-BA0CE944938E}.....................RSA1..................v..XU~l2_.......vj....b.... ..&...X.Y...=q...).....`.1.0..~......5DL. ..S>.......<..y...*?YOA.... eb.QD..B..<.!..'J..+.'...4fu.z./....]@.y.b...o...).j'......0}B.*j..R..-..2.....'=...@....s....;. .v=..;...\$...G....2S....al.ZQ.Q...w...aXzW.....................z..O........P ..M.bjH.S.K....,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... ...T.)...(\.B.a..y-.(.....QZ...s7.............. .....I..._y......&.5\n..B..>. ...P...i\vK]h-.=.C0...h;..|,..E.:...b"`lq._i...'...U.......f....z.d.b..*l....(~o.;.....q( ....p..r....q..A...R.x.....>...iDY.C.B...........v.*........3k..>......7.=.....[K5..E.NqeV.Jag.K..... ....<&.\.a..z..D_Fi.3.._..R{%..~..XW....g.{!.....G..:.o...`.....nq%.C....ZQ"F. ...u_......m>..5....F.0....n...K...^ ..f.Gn....t9.....J.U..........XVvWR..U'2|.;.....4.~....!u.{$...k>_.G...O_..|.3...K......9=.2..]....u1.....

                                                                                                                                                                                                                        Static File Info

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        File type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                        Entropy (8bit):7.989033763427159
                                                                                                                                                                                                                        TrID:
                                                                                                                                                                                                                        • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                                                                                                                                                                                        • Win32 Executable (generic) a (10002005/4) 49.78%
                                                                                                                                                                                                                        • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                                                                                                                                                        • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                                                                                                                                        • DOS Executable Generic (2002/1) 0.01%
                                                                                                                                                                                                                        File name:surfex.exe
                                                                                                                                                                                                                        File size:317'952 bytes
                                                                                                                                                                                                                        MD5:1f4b0637137572a1fb34aaa033149506
                                                                                                                                                                                                                        SHA1:c209c9a60a752bc7980a3d9d53daf4b4b32973a9
                                                                                                                                                                                                                        SHA256:60c645c0a668c13ad36d2d5b67777dedf992e392e652e7f0519f21d658254648
                                                                                                                                                                                                                        SHA512:4fd27293437b8bf77d15d993da2b0e75c9fba93bd5f94dad439a3e2e4c16c444f6a32543271f1d2ad79c220354b23301e544765ca392fc156267a89338452e86
                                                                                                                                                                                                                        SSDEEP:6144:Zm1G61auNh8PDtyJvsHP+iVQmoc2RZ4cm++pBESrvD6ClOC:6GaxO5rHPkmojzAr6C8
                                                                                                                                                                                                                        TLSH:126423D72DAF4656CE6E9FB754712004108D39226FC322E6F0AE586F3B6C55E84B0A3D
                                                                                                                                                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7o.f................................. ........@.. .......................@............`................................

                                                                                                                                                                                                                        File Icon

                                                                                                                                                                                                                        Icon Hash:00928e8e8686b000

                                                                                                                                                                                                                        Static PE Info

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Entrypoint:0x44efce
                                                                                                                                                                                                                        Entrypoint Section:.text
                                                                                                                                                                                                                        Digitally signed:false
                                                                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                                                                        Subsystem:windows cui
                                                                                                                                                                                                                        Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                                                                        DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                        Time Stamp:0x66C86F37 [Fri Aug 23 11:15:03 2024 UTC]
                                                                                                                                                                                                                        TLS Callbacks:
                                                                                                                                                                                                                        CLR (.Net) Version:
                                                                                                                                                                                                                        OS Version Major:4
                                                                                                                                                                                                                        OS Version Minor:0
                                                                                                                                                                                                                        File Version Major:4
                                                                                                                                                                                                                        File Version Minor:0
                                                                                                                                                                                                                        Subsystem Version Major:4
                                                                                                                                                                                                                        Subsystem Version Minor:0
                                                                                                                                                                                                                        Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                                                                                                                                                        Entrypoint Preview

                                                                                                                                                                                                                        Instruction
                                                                                                                                                                                                                        jmp dword ptr [00402000h]
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                        add byte ptr [eax], al

                                                                                                                                                                                                                        Data Directories

                                                                                                                                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x4ef7c0x4f.text
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x500000x5e0.rsrc
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x520000xc.reloc
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x4ee440x1c.text
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                        Sections

                                                                                                                                                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                        .text0x20000x4cfd40x4d000cbd5d241232a937003daa032701256cdFalse0.993896484375data7.996095896093537IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                        .rsrc0x500000x5e00x600d4088ec87242a60f1273a4380deae966False0.4368489583333333data4.148168320019589IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                        .reloc0x520000xc0x2007476045ea2e1d33a034524dd3f9b1bb4False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                        Resources

                                                                                                                                                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                        RT_VERSION0x500a00x350data0.43985849056603776
                                                                                                                                                                                                                        RT_MANIFEST0x503f00x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5469387755102041

                                                                                                                                                                                                                        Imports

                                                                                                                                                                                                                        DLLImport
                                                                                                                                                                                                                        mscoree.dll_CorExeMain

                                                                                                                                                                                                                        Network Behavior

                                                                                                                                                                                                                        Network Port Distribution

                                                                                                                                                                                                                        TCP Packets

                                                                                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                        Dec 18, 2024 15:08:43.440026999 CET4970721441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:08:43.559642076 CET2144149707185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:08:43.559772968 CET4970721441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:08:43.727916956 CET4970721441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:08:43.847784042 CET2144149707185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:08:45.729409933 CET2144149707185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:08:45.729527950 CET4970721441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:08:46.230369091 CET4970721441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:08:51.484071970 CET4971021441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:08:51.603598118 CET2144149710185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:08:51.603745937 CET4971021441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:08:51.604424000 CET4971021441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:08:51.724087000 CET2144149710185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:08:53.760962963 CET2144149710185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:08:53.761192083 CET4971021441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:08:53.761548996 CET4971021441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:08:58.767908096 CET4971121441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:08:58.887556076 CET2144149711185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:08:58.887722015 CET4971121441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:08:58.888799906 CET4971121441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:08:59.008260965 CET2144149711185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:01.075428009 CET2144149711185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:01.075812101 CET4971121441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:01.076935053 CET4971121441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:06.092375994 CET4971221441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:06.212094069 CET2144149712185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:06.212203979 CET4971221441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:06.212510109 CET4971221441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:06.332325935 CET2144149712185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:08.402425051 CET2144149712185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:08.402595997 CET4971221441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:08.402904987 CET4971221441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:13.420273066 CET4971321441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:13.540085077 CET2144149713185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:13.540185928 CET4971321441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:13.540509939 CET4971321441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:13.661287069 CET2144149713185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:15.780684948 CET2144149713185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:15.780817986 CET4971321441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:15.784630060 CET4971321441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:20.795639038 CET4971421441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:20.915241957 CET2144149714185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:20.915365934 CET4971421441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:20.915685892 CET4971421441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:21.035252094 CET2144149714185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:23.137145042 CET2144149714185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:23.137213945 CET4971421441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:23.137447119 CET4971421441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:28.154829979 CET4971621441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:28.274672985 CET2144149716185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:28.274888992 CET4971621441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:28.275285959 CET4971621441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:28.394875050 CET2144149716185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:30.479592085 CET2144149716185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:30.479780912 CET4971621441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:30.479949951 CET4971621441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:35.483935118 CET4971721441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:35.603574991 CET2144149717185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:35.603737116 CET4971721441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:35.620699883 CET4971721441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:35.740336895 CET2144149717185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:37.782433033 CET2144149717185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:37.782526016 CET4971721441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:37.782798052 CET4971721441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:42.798254967 CET4971821441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:42.918301105 CET2144149718185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:42.918436050 CET4971821441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:42.919213057 CET4971821441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:43.040357113 CET2144149718185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:45.152811050 CET2144149718185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:45.152951956 CET4971821441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:45.153156996 CET4971821441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:50.226567984 CET4971921441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:50.347568035 CET2144149719185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:50.347687960 CET4971921441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:50.350332975 CET4971921441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:50.469953060 CET2144149719185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:52.498087883 CET2144149719185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:52.498168945 CET4971921441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:52.498397112 CET4971921441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:57.514719009 CET4972021441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:57.636367083 CET2144149720185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:57.636558056 CET4972021441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:57.637403011 CET4972021441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:57.757251978 CET2144149720185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:59.870657921 CET2144149720185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:09:59.870794058 CET4972021441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:09:59.871069908 CET4972021441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:10:04.873624086 CET4972121441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:10:04.993874073 CET2144149721185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:10:04.994072914 CET4972121441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:10:05.025217056 CET4972121441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:10:05.144876957 CET2144149721185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:10:07.168890953 CET2144149721185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:10:07.169195890 CET4972121441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:10:07.169423103 CET4972121441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:10:12.186258078 CET4972221441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:10:12.305913925 CET2144149722185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:10:12.306035042 CET4972221441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:10:12.306345940 CET4972221441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:10:12.425860882 CET2144149722185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:10:14.488379955 CET2144149722185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:10:14.488441944 CET4972221441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:10:14.488650084 CET4972221441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:10:19.521166086 CET4972321441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:10:19.640818119 CET2144149723185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:10:19.640934944 CET4972321441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:10:19.643534899 CET4972321441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:10:19.764132977 CET2144149723185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:10:21.903701067 CET2144149723185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:10:21.903799057 CET4972321441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:10:21.904107094 CET4972321441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:10:26.921451092 CET4972421441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:10:27.041063070 CET2144149724185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:10:27.041215897 CET4972421441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:10:27.041570902 CET4972421441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:10:27.161353111 CET2144149724185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:10:29.219188929 CET2144149724185.218.125.157192.168.2.9
                                                                                                                                                                                                                        Dec 18, 2024 15:10:29.219286919 CET4972421441192.168.2.9185.218.125.157
                                                                                                                                                                                                                        Dec 18, 2024 15:10:29.443725109 CET4972421441192.168.2.9185.218.125.157

                                                                                                                                                                                                                        Statistics

                                                                                                                                                                                                                        CPU Usage

                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                        Memory Usage

                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                        High Level Behavior Distribution

                                                                                                                                                                                                                        Click to dive into process behavior distribution

                                                                                                                                                                                                                        Behavior

                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                        System Behavior

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:0
                                                                                                                                                                                                                        Start time:09:08:24
                                                                                                                                                                                                                        Start date:18/12/2024
                                                                                                                                                                                                                        Path:C:\Users\user\Desktop\surfex.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\surfex.exe"
                                                                                                                                                                                                                        Imagebase:0x2f0000
                                                                                                                                                                                                                        File size:317'952 bytes
                                                                                                                                                                                                                        MD5 hash:1F4B0637137572A1FB34AAA033149506
                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1384266730.0000000003665000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:1
                                                                                                                                                                                                                        Start time:09:08:25
                                                                                                                                                                                                                        Start date:18/12/2024
                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                        Imagebase:0x7ff70f010000
                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:3
                                                                                                                                                                                                                        Start time:09:08:25
                                                                                                                                                                                                                        Start date:18/12/2024
                                                                                                                                                                                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                        Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                        Imagebase:0x370000
                                                                                                                                                                                                                        File size:65'440 bytes
                                                                                                                                                                                                                        MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:4
                                                                                                                                                                                                                        Start time:09:08:25
                                                                                                                                                                                                                        Start date:18/12/2024
                                                                                                                                                                                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                        Imagebase:0x7e0000
                                                                                                                                                                                                                        File size:65'440 bytes
                                                                                                                                                                                                                        MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000004.00000002.2633603062.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        Disassembly

                                                                                                                                                                                                                        Reset < >

                                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                                          Execution Coverage:27.9%
                                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                                                                                          Signature Coverage:25.8%
                                                                                                                                                                                                                          Total number of Nodes:31
                                                                                                                                                                                                                          Total number of Limit Nodes:1
                                                                                                                                                                                                                          execution_graph 314 24a0988 319 24a04e4 314->319 316 24a09d3 318 24a0a2d 316->318 323 24a04fc 316->323 320 24a0b48 GetConsoleWindow 319->320 322 24a0bb3 320->322 322->316 324 24a0e60 VirtualProtectEx 323->324 326 24a0eeb 324->326 326->318 339 24a0979 340 24a0988 339->340 341 24a04e4 GetConsoleWindow 340->341 342 24a09d3 341->342 343 24a04fc VirtualProtectEx 342->343 344 24a0a2d 342->344 343->344 345 24a0c90 348 24a0cbd 345->348 346 24a0eab VirtualProtectEx 347 24a0eeb 346->347 348->346 349 24a0e3d 348->349 327 266248d 328 26624c5 327->328 328->328 329 26625d3 CreateProcessA VirtualAlloc Wow64GetThreadContext ReadProcessMemory VirtualAllocEx 328->329 332 2662692 TerminateProcess 328->332 329->328 330 26626a2 WriteProcessMemory 329->330 331 26626e7 330->331 333 26626ec WriteProcessMemory 331->333 334 2662729 WriteProcessMemory Wow64SetThreadContext ResumeThread 331->334 332->329 333->331 335 24a0b41 336 24a0b48 GetConsoleWindow 335->336 338 24a0bb3 336->338

                                                                                                                                                                                                                          Callgraph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          • Opacity -> Relevance
                                                                                                                                                                                                                          • Disassembly available
                                                                                                                                                                                                                          callgraph 0 Function_024A0848 1 Function_024A00C8 2 Function_024A0140 3 Function_024A0B41 4 Function_02662B6B 5 Function_02662BEB 6 Function_024A0444 7 Function_026628E8 8 Function_024A08D9 9 Function_026621F5 10 Function_02662AF3 11 Function_024A045C 12 Function_024A0052 13 Function_024A0450 14 Function_024A04D0 15 Function_02662B7B 16 Function_024A00D4 17 Function_024A08E8 18 Function_024A0468 19 Function_026622C2 20 Function_024A0060 21 Function_026627CC 22 Function_02662B4B 23 Function_026622CB 24 Function_02662BCB 25 Function_024A04E4 26 Function_024A00E4 27 Function_024A0BE4 28 Function_024A0979 28->25 29 Function_024A04FC 28->29 32 Function_024A04F0 28->32 39 Function_024A0508 28->39 30 Function_024A00F0 31 Function_024A0070 33 Function_0266225C 34 Function_02662B5B 35 Function_026628DB 36 Function_02662BDB 37 Function_024A0474 38 Function_024A0988 38->25 38->29 38->32 38->39 40 Function_024A010C 41 Function_024A048D 42 Function_024A0100 43 Function_024A0080 44 Function_024A0480 45 Function_024A0006 46 Function_02662B2B 47 Function_02662BAB 48 Function_024A0518 49 Function_024A0F18 50 Function_024A0499 51 Function_024A011C 52 Function_026627B0 53 Function_024A049D 54 Function_024A0090 55 Function_024A0C90 56 Function_024A0491 57 Function_02662B3B 58 Function_02662BBB 59 Function_024A0495 60 Function_024A04A9 61 Function_02662B02 62 Function_024A012C 63 Function_024A04AD 64 Function_024A00A0 65 Function_024A04A1 66 Function_0266248D 67 Function_02662B0B 68 Function_02662B8B 69 Function_024A04A5 70 Function_024A00BC 71 Function_02662111 72 Function_024A00B0 73 Function_024A04B1 74 Function_02662B1B 75 Function_02662B9B 76 Function_024A04B5

                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                          Function 0266248D Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282threadinjectionmemoryCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,026623FF,026623EF), ref: 026625FC
                                                                                                                                                                                                                          • VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0266260F
                                                                                                                                                                                                                          • Wow64GetThreadContext.KERNEL32(00000308,00000000), ref: 0266262D
                                                                                                                                                                                                                          • ReadProcessMemory.KERNELBASE(00000304,?,02662443,00000004,00000000), ref: 02662651
                                                                                                                                                                                                                          • VirtualAllocEx.KERNELBASE(00000304,?,?,00003000,00000040), ref: 0266267C
                                                                                                                                                                                                                          • TerminateProcess.KERNELBASE(00000304,00000000), ref: 0266269B
                                                                                                                                                                                                                          • WriteProcessMemory.KERNELBASE(00000304,00000000,?,?,00000000,?), ref: 026626D4
                                                                                                                                                                                                                          • WriteProcessMemory.KERNELBASE(00000304,00400000,?,?,00000000,?,00000028), ref: 0266271F
                                                                                                                                                                                                                          • WriteProcessMemory.KERNELBASE(00000304,?,?,00000004,00000000), ref: 0266275D
                                                                                                                                                                                                                          • Wow64SetThreadContext.KERNEL32(00000308,024D0000), ref: 02662799
                                                                                                                                                                                                                          • ResumeThread.KERNELBASE(00000308), ref: 026627A8
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.1384242704.0000000002662000.00000040.00000800.00020000.00000000.sdmp, Offset: 02662000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_2662000_surfex.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
                                                                                                                                                                                                                          • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
                                                                                                                                                                                                                          • API String ID: 2440066154-1257834847
                                                                                                                                                                                                                          • Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
                                                                                                                                                                                                                          • Instruction ID: 1dea4f9923421510dcd353eaf19576ef93eb4327d46877acf6a30357f1800947
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F1B1D67664024AAFDB60CF68CC80BDA77A5FF88714F158524EA0CAB341D774FA51CB94
                                                                                                                                                                                                                          Function 024A0C90 Relevance: 1.7, APIs: 1, Instructions: 201COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 22 24a0c90-24a0cd1 25 24a0cd3-24a0ce1 22->25 27 24a0ce7-24a0d01 25->27 28 24a0e45-24a0ea3 25->28 27->28 29 24a0d07-24a0d12 27->29 32 24a0eab-24a0ee9 VirtualProtectEx 28->32 29->28 31 24a0d18-24a0d23 29->31 31->25 33 24a0d25-24a0d2a 31->33 34 24a0eeb 32->34 35 24a0ef0-24a0f09 32->35 36 24a0d2d-24a0d32 33->36 34->35 36->28 37 24a0d38-24a0d45 36->37 37->28 38 24a0d4b-24a0d57 37->38 40 24a0d59-24a0d5f 38->40 41 24a0d60-24a0d65 38->41 40->41 41->28 42 24a0d6b-24a0d72 41->42 42->28 43 24a0d78-24a0d7e 42->43 43->28 44 24a0d84-24a0d91 43->44 44->36 45 24a0d93-24a0da2 44->45 46 24a0da8 45->46 47 24a0e3d-24a0e44 45->47 48 24a0dab-24a0db2 46->48 49 24a0dbc-24a0dc1 48->49 50 24a0db4-24a0dbb 48->50 49->28 51 24a0dc7-24a0dd3 49->51 50->49 52 24a0ddc-24a0de1 51->52 53 24a0dd5-24a0ddb 51->53 52->28 54 24a0de3-24a0dea 52->54 53->52 54->28 55 24a0dec-24a0df2 54->55 55->28 56 24a0df4-24a0e0c 55->56 57 24a0e0e-24a0e15 56->57 58 24a0e16-24a0e22 56->58 57->58 58->28 59 24a0e24-24a0e37 58->59 59->47 59->48
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • VirtualProtectEx.KERNELBASE(?,03663590,?,?,?,?,?,?,2C8300BD,718AD5F1,?,024A0A2D,?,00000040,?), ref: 024A0EDC
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.1384094039.00000000024A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_24a0000_surfex.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ProtectVirtual
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 544645111-0
                                                                                                                                                                                                                          • Opcode ID: 277ca324607d66a9445b49eebb3861a588dc1c8de310d3732546063c10ae6a78
                                                                                                                                                                                                                          • Instruction ID: cef1d4bff1da2885d6afef8ead9cd3effc12a89bfbedb2c5851fb400b861e7cf
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 277ca324607d66a9445b49eebb3861a588dc1c8de310d3732546063c10ae6a78
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: ED710472D142668FCB10CFA9C8907EEFFF1BF54204F1495AAD468EB252C3759841CBA0
                                                                                                                                                                                                                          Function 024A04FC Relevance: 1.6, APIs: 1, Instructions: 56COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 60 24a04fc-24a0ee9 VirtualProtectEx 63 24a0eeb 60->63 64 24a0ef0-24a0f09 60->64 63->64
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • VirtualProtectEx.KERNELBASE(?,03663590,?,?,?,?,?,?,2C8300BD,718AD5F1,?,024A0A2D,?,00000040,?), ref: 024A0EDC
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.1384094039.00000000024A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_24a0000_surfex.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ProtectVirtual
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 544645111-0
                                                                                                                                                                                                                          • Opcode ID: 10e6c35b8743ef6d903ffc036c1fb26f032ff1f813f32a362ddebfba1539f074
                                                                                                                                                                                                                          • Instruction ID: 68584a4f5a35c762e49e7cecf1b44457949781af7f47125edce4fc2e9689601d
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 10e6c35b8743ef6d903ffc036c1fb26f032ff1f813f32a362ddebfba1539f074
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0721EDB591025DAFCB10DF9AD884BDEFBB4FF09310F10812AEA18A7340C374A954CBA1
                                                                                                                                                                                                                          Function 024A04E4 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 66 24a04e4-24a0bb1 GetConsoleWindow 69 24a0bba-24a0bd7 66->69 70 24a0bb3-24a0bb9 66->70 70->69
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetConsoleWindow.KERNELBASE(?,?,?,?,2C8300BD,718AD5F1,?,024A09D3), ref: 024A0BA4
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.1384094039.00000000024A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_24a0000_surfex.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ConsoleWindow
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2863861424-0
                                                                                                                                                                                                                          • Opcode ID: 35009f40f009efb54dd7941fae0564964fbde18a01d328655bf804854fb3b013
                                                                                                                                                                                                                          • Instruction ID: 3a990da568b44c93162cecb285e8cffc1be56a25e04aa2abbba606bb89045c36
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 35009f40f009efb54dd7941fae0564964fbde18a01d328655bf804854fb3b013
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9E1130B59003498FDB20DF9AC544BDEFBF4EB48328F20846AD519A7340D378A944CFA0
                                                                                                                                                                                                                          Function 024A0B41 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 73 24a0b41-24a0b7f 75 24a0b87-24a0bb1 GetConsoleWindow 73->75 76 24a0bba-24a0bd7 75->76 77 24a0bb3-24a0bb9 75->77 77->76
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetConsoleWindow.KERNELBASE(?,?,?,?,2C8300BD,718AD5F1,?,024A09D3), ref: 024A0BA4
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.1384094039.00000000024A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_24a0000_surfex.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ConsoleWindow
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2863861424-0
                                                                                                                                                                                                                          • Opcode ID: c7730a3ea6087398ea92fa2e9fe3662cff6e67441b60291caf5d13fc06d04d3b
                                                                                                                                                                                                                          • Instruction ID: c16d761c99d8103b4e0a47e177ab05f5eb3ed646ca482bc117094241557f858a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c7730a3ea6087398ea92fa2e9fe3662cff6e67441b60291caf5d13fc06d04d3b
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E21122B58003498FDB20CF9AC584BDEBBF4EB48324F20845AD519A7350D378A944CFA0

                                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                                          Execution Coverage:7%
                                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                                                                                          Signature Coverage:0%
                                                                                                                                                                                                                          Total number of Nodes:32
                                                                                                                                                                                                                          Total number of Limit Nodes:3
                                                                                                                                                                                                                          execution_graph 25957 294d0b8 25958 294d0fe 25957->25958 25962 294d298 25958->25962 25965 294d289 25958->25965 25959 294d1eb 25968 294c9a0 25962->25968 25966 294c9a0 DuplicateHandle 25965->25966 25967 294d2c6 25965->25967 25966->25967 25967->25959 25969 294d300 DuplicateHandle 25968->25969 25970 294d2c6 25969->25970 25970->25959 25971 294ad38 25974 294ae30 25971->25974 25972 294ad47 25975 294ae64 25974->25975 25976 294ae41 25974->25976 25975->25972 25976->25975 25977 294b068 GetModuleHandleW 25976->25977 25978 294b095 25977->25978 25978->25972 25979 2944668 25980 2944684 25979->25980 25981 2944696 25980->25981 25983 29447a0 25980->25983 25984 29447c5 25983->25984 25988 29448b0 25984->25988 25992 29448a1 25984->25992 25989 29448d7 25988->25989 25990 29449b4 25989->25990 25996 2944248 25989->25996 25994 29448b0 25992->25994 25993 29449b4 25993->25993 25994->25993 25995 2944248 CreateActCtxA 25994->25995 25995->25993 25997 2945940 CreateActCtxA 25996->25997 25999 2945a03 25997->25999

                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                          Function 06503F50 Relevance: .5, Instructions: 522COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 646 6503f50-6503f84 649 6503f92-6503fa5 646->649 650 6503f86-6503f8f 646->650 651 6504215-6504219 649->651 652 6503fab-6503fae 649->652 650->649 654 650421b-650422b 651->654 655 650422e-6504238 651->655 656 6503fb0-6503fb5 652->656 657 6503fbd-6503fc9 652->657 654->655 656->657 658 6504253-6504299 657->658 659 6503fcf-6503fe1 657->659 666 65042a8-65042d0 658->666 667 650429b-65042a5 658->667 663 6503fe7-650403a 659->663 664 650414d-650415b 659->664 696 650404a 663->696 697 650403c-6504048 call 6503c88 663->697 670 65041e0-65041e2 664->670 671 6504161-650416f 664->671 688 6504425-6504443 666->688 689 65042d6-65042ef 666->689 667->666 676 65041f0-65041fc 670->676 677 65041e4-65041ea 670->677 674 6504171-6504176 671->674 675 650417e-650418a 671->675 674->675 675->658 681 6504190-65041bf 675->681 687 65041fe-650420f 676->687 679 65041ec 677->679 680 65041ee 677->680 679->676 680->676 700 65041d0-65041de 681->700 701 65041c1-65041ce 681->701 687->651 687->652 704 6504445-6504467 688->704 705 65044ae-65044b8 688->705 706 65042f5-650430b 689->706 707 6504406-650441f 689->707 698 650404c-650405c 696->698 697->698 714 6504077-6504079 698->714 715 650405e-6504075 698->715 700->651 701->700 727 65044b9-650450a 704->727 728 6504469-6504485 704->728 706->707 725 6504311-650435f 706->725 707->688 707->689 717 65040c2-65040c4 714->717 718 650407b-6504089 714->718 715->714 722 65040d2-65040e2 717->722 723 65040c6-65040d0 717->723 718->717 732 650408b-650409d 718->732 736 65040e4-65040f2 722->736 737 650410d-6504110 722->737 723->722 735 650411b-6504127 723->735 774 6504361-6504387 725->774 775 6504389-65043ad 725->775 763 650452a-6504568 727->763 764 650450c-6504528 727->764 739 65044a9-65044ac 728->739 742 65040a3-65040a7 732->742 743 650409f-65040a1 732->743 735->687 752 650412d-6504148 735->752 749 65040f4-6504103 736->749 750 6504105-6504108 736->750 795 6504113 call 65048b8 737->795 796 6504113 call 65048a8 737->796 739->705 744 6504493-6504496 739->744 751 65040ad-65040bc 742->751 743->751 744->727 754 6504498-65044a8 744->754 745 6504119 745->735 749->735 750->651 751->717 761 6504239-650424c 751->761 752->651 754->739 761->658 764->763 774->775 784 65043df-65043f8 775->784 785 65043af-65043c6 775->785 788 6504403-6504404 784->788 789 65043fa 784->789 792 65043d2-65043dd 785->792 793 65043c8-65043cb 785->793 788->707 789->788 792->784 792->785 793->792 795->745 796->745
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 2740e53401ea8a65db1a6edd28e66af6a9f1f0d031e4c7c1610c08aef9c11bc0
                                                                                                                                                                                                                          • Instruction ID: 8b053c0e5b9571e27a2715b157140733f92523d82c29b06d419de4e33eb4d702
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2740e53401ea8a65db1a6edd28e66af6a9f1f0d031e4c7c1610c08aef9c11bc0
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D6125D34B00205DFEB54DF69C494AAEBBF6BF88600B158569D906EB3A5DF31DC41CB90
                                                                                                                                                                                                                          Function 065067D8 Relevance: .4, Instructions: 411COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 797 65067d8-65067f0 799 65067f2-65067fb 797->799 800 650682a-6506849 797->800 801 650684c-65068cd 799->801 802 65067fd-650680d 799->802 812 6506ae0-6506b04 801->812 813 65068d3-65068df 801->813 805 6506815-6506817 802->805 806 6506821-6506827 805->806 807 6506819-650681e 805->807 806->800 818 6506c31-6506c35 812->818 819 6506b0a-6506b0e 812->819 814 65068e5-65068fc 813->814 815 6506c6f-6506c79 813->815 814->812 827 6506902-6506946 814->827 821 6506c6b-6506c6c 815->821 822 6506c7b-6506caa 815->822 825 6506c63-6506c6a 818->825 826 6506c37-6506c3b 818->826 823 6506b14-6506b1a 819->823 824 6506bcc-6506bd2 819->824 836 6506cc4-6506cdb 822->836 837 6506cac-6506cc3 822->837 828 6506b33-6506bbc 823->828 829 6506b1c-6506b20 823->829 831 6506bd4-6506c1a 824->831 832 6506c25-6506c2e 824->832 825->821 826->825 830 6506c3d-6506c5e 826->830 852 6506956 827->852 853 6506948-6506954 call 6503c88 827->853 828->832 874 6506bbe-6506bca 828->874 829->824 834 6506b26-6506b2d 829->834 830->825 842 6506c60 830->842 831->832 834->824 834->828 842->825 856 6506958-6506968 852->856 853->856 861 65069a7-65069eb 856->861 862 650696a-6506971 856->862 878 65069fb 861->878 879 65069ed-65069f9 call 6503c88 861->879 863 6506973-6506989 862->863 864 650698b-6506992 862->864 865 6506995-6506997 863->865 864->865 865->861 868 6506999-650699d 865->868 868->861 870 650699f-65069a2 868->870 873 6506ad6-6506ada 870->873 873->812 873->813 874->832 880 65069fd-6506a0d 878->880 879->880 884 6506a13-6506a19 880->884 885 6506a0f-6506a11 880->885 886 6506a21-6506a23 884->886 885->886 887 6506ad3 886->887 888 6506a29-6506a2f 886->888 887->873 889 6506a35-6506ab9 888->889 890 6506ac7-6506ad0 888->890 889->890 899 6506abb-6506abe 889->899 899->890
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 1596f7260baa52c8b4bd0810f51e05b6556d9d501c6be0a7e6856cc42b194a18
                                                                                                                                                                                                                          • Instruction ID: a2a4b40a7096abbb41474c1bb7fde3d2aa88e891e0c34074cefca49e5ad4caf9
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1596f7260baa52c8b4bd0810f51e05b6556d9d501c6be0a7e6856cc42b194a18
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B9F1BF74A002099FEB54DF68D890B9EBBF2FF88300F158569E505EB2A1DB30ED55CB91
                                                                                                                                                                                                                          Function 0650A3D8 Relevance: .3, Instructions: 296COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 994 650a3d8-650a413 995 650a415 994->995 996 650a41a-650a453 994->996 995->996 1051 650a456 call 650ac60 996->1051 1052 650a456 call 650ac80 996->1052 1053 650a456 call 650acb8 996->1053 998 650a45c-650a467 1054 650a469 call 650e8b0 998->1054 1055 650a469 call 650e8f8 998->1055 1056 650a469 call 650e89f 998->1056 999 650a46f-650a7bc 1046 650a7c8-650a83e 999->1046 1051->998 1052->998 1053->998 1054->999 1055->999 1056->999
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 3485489c1d091a8fa0cb2be7ebd6b1171fca644d97aa8f7f7fe8937f06b7a1d9
                                                                                                                                                                                                                          • Instruction ID: f3b755b55d89be6f3a56478f9e5ee041eb5a8271b979bf5d2b6d4c2cf272527d
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3485489c1d091a8fa0cb2be7ebd6b1171fca644d97aa8f7f7fe8937f06b7a1d9
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BAD1D474D00218CFDB58EFB4D854A9DBBB2FF8A301F1085A9D51AAB254DB31998ACF11
                                                                                                                                                                                                                          Function 0650A3E8 Relevance: .3, Instructions: 289COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 1057 650a3e8-650a413 1058 650a415 1057->1058 1059 650a41a-650a453 1057->1059 1058->1059 1114 650a456 call 650ac60 1059->1114 1115 650a456 call 650ac80 1059->1115 1116 650a456 call 650acb8 1059->1116 1061 650a45c-650a467 1117 650a469 call 650e8b0 1061->1117 1118 650a469 call 650e8f8 1061->1118 1119 650a469 call 650e89f 1061->1119 1062 650a46f-650a7bc 1109 650a7c8-650a83e 1062->1109 1114->1061 1115->1061 1116->1061 1117->1062 1118->1062 1119->1062
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 4b8ebef83ca2cc599a9b6ee3d704b36d2b4c587447c60c189511c98a26a945de
                                                                                                                                                                                                                          • Instruction ID: 2fdb26d82de5684bc9a7bbfaeb8c5162b434eb6beb2d4faca4c711b0d16d98a8
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4b8ebef83ca2cc599a9b6ee3d704b36d2b4c587447c60c189511c98a26a945de
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 25D1C334E00218CFDB58EFB4D85469DBBB2FF8A301F1081A9D50AAB254DB31998ADF11
                                                                                                                                                                                                                          Function 0294AE30 Relevance: 1.7, APIs: 1, Instructions: 197COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetModuleHandleW.KERNELBASE(00000000), ref: 0294B086
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2634350159.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_2940000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: HandleModule
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 4139908857-0
                                                                                                                                                                                                                          • Opcode ID: 22ac302ccfb78eecba08ddadd84a5e7e103d48423597bb9dd2ae35c3b2861c78
                                                                                                                                                                                                                          • Instruction ID: 5cd6edcb831455fbfeec960ff54376e1e20a4046ffa7516b6dc73fe59b6dbd2a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 22ac302ccfb78eecba08ddadd84a5e7e103d48423597bb9dd2ae35c3b2861c78
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 927124B1A00B059FE724DF2AD154B5ABBF5FF88304F008A2DE49AD7A40DB75E845CB91
                                                                                                                                                                                                                          Function 02944248 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 60 2944248-2945a01 CreateActCtxA 63 2945a03-2945a09 60->63 64 2945a0a-2945a64 60->64 63->64 71 2945a66-2945a69 64->71 72 2945a73-2945a77 64->72 71->72 73 2945a88-2945ab8 72->73 74 2945a79-2945a85 72->74 78 2945a6a 73->78 79 2945aba-2945b3c 73->79 74->73 78->72
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CreateActCtxA.KERNEL32(?), ref: 029459F1
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2634350159.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_2940000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Create
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2289755597-0
                                                                                                                                                                                                                          • Opcode ID: 0e323780cb7fb89bbe8cc259cd5aa4353c7220bbf0e97f48441922a6267170cd
                                                                                                                                                                                                                          • Instruction ID: c4778639c36d89a4d723b10d476a01f7d074c2ac7d365eec14d9de43ee64537c
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0e323780cb7fb89bbe8cc259cd5aa4353c7220bbf0e97f48441922a6267170cd
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8241CEB0C00719CBEB24CFA9C884B9EBBB5FF49704F60806AD408AB251DB756949CF90
                                                                                                                                                                                                                          Function 02945935 Relevance: 1.6, APIs: 1, Instructions: 94COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 81 2945935-294593c 82 2945944-2945a01 CreateActCtxA 81->82 84 2945a03-2945a09 82->84 85 2945a0a-2945a64 82->85 84->85 92 2945a66-2945a69 85->92 93 2945a73-2945a77 85->93 92->93 94 2945a88-2945ab8 93->94 95 2945a79-2945a85 93->95 99 2945a6a 94->99 100 2945aba-2945b3c 94->100 95->94 99->93
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CreateActCtxA.KERNEL32(?), ref: 029459F1
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2634350159.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_2940000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Create
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2289755597-0
                                                                                                                                                                                                                          • Opcode ID: 4dca50748366e49d726fa40d91760ec3520c793a97891c24b3e7607bc98bab04
                                                                                                                                                                                                                          • Instruction ID: 09e150c823810cf0cebc01e120e12de732a8a6b686b86db254cd7158af29fb21
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4dca50748366e49d726fa40d91760ec3520c793a97891c24b3e7607bc98bab04
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AD41DFB0C00719CFEB24CFA9C884B9EBBB5FF89704F60806AD408AB250DB756949CF50
                                                                                                                                                                                                                          Function 0294C9A0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 102 294c9a0-294d394 DuplicateHandle 104 294d396-294d39c 102->104 105 294d39d-294d3ba 102->105 104->105
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0294D2C6,?,?,?,?,?), ref: 0294D387
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2634350159.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_2940000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: DuplicateHandle
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3793708945-0
                                                                                                                                                                                                                          • Opcode ID: a2e38ac4a19f3dbf3786ed72066a489c5a5f2e8f08d2f43b1d338530cda98d39
                                                                                                                                                                                                                          • Instruction ID: 4b9616979f4b8b3f5f8856d611342c6a53481e8b6916f851f6e4f59252b95c83
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a2e38ac4a19f3dbf3786ed72066a489c5a5f2e8f08d2f43b1d338530cda98d39
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CA21E4B5900349DFDB10CF9AD984ADEBBF8EB48314F14845AE918A3310D774A954CFA5
                                                                                                                                                                                                                          Function 0294D2F9 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 108 294d2f9-294d394 DuplicateHandle 109 294d396-294d39c 108->109 110 294d39d-294d3ba 108->110 109->110
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0294D2C6,?,?,?,?,?), ref: 0294D387
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2634350159.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_2940000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: DuplicateHandle
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3793708945-0
                                                                                                                                                                                                                          • Opcode ID: 8a99b12d5e1501758c8d82dff75c8a599e664097ac66f3539d97a119aecd6593
                                                                                                                                                                                                                          • Instruction ID: 166a4449774c1f1d21faef58459ab8081d38149107b6f55cce6cd912a6de758b
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8a99b12d5e1501758c8d82dff75c8a599e664097ac66f3539d97a119aecd6593
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8121E2B6D00249DFDB10CFAAD984ADEBBF4EB48314F14845AE918B3310D378AA54CF65
                                                                                                                                                                                                                          Function 0294B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 113 294b020-294b060 114 294b062-294b065 113->114 115 294b068-294b093 GetModuleHandleW 113->115 114->115 116 294b095-294b09b 115->116 117 294b09c-294b0b0 115->117 116->117
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetModuleHandleW.KERNELBASE(00000000), ref: 0294B086
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2634350159.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_2940000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: HandleModule
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 4139908857-0
                                                                                                                                                                                                                          • Opcode ID: 8e830c1c3effa2fe00f60dd8c8a478cfbccf591307bb461949928406ac45a745
                                                                                                                                                                                                                          • Instruction ID: 228112afd476957918f8d0fe27a253dbd98c25016c16898f371ff07d3d95a39b
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8e830c1c3effa2fe00f60dd8c8a478cfbccf591307bb461949928406ac45a745
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1D1110B6C007498FDB20CF9AC444BDEFBF4EB88224F10842AD868B7210D379A545CFA1
                                                                                                                                                                                                                          Function 065059D8 Relevance: 1.5, Strings: 1, Instructions: 292COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 119 65059d8-65059f3 120 65059f5-65059f7 119->120 121 65059ff-6505a0e 119->121 120->121 122 6505a10 121->122 123 6505a1a-6505a2a 121->123 122->123 124 6505a2d-6505a4f 123->124 125 6505a55-6505a5b 124->125 126 6505c88-6505ccf 124->126 127 6505a61-6505a67 125->127 128 6505b34-6505b38 125->128 154 6505cd1 126->154 155 6505ce5-6505cf1 126->155 127->126 129 6505a6d-6505a7a 127->129 130 6505b3a-6505b43 128->130 131 6505b5b-6505b64 128->131 133 6505a80-6505a89 129->133 134 6505b13-6505b1c 129->134 130->126 135 6505b49-6505b59 130->135 136 6505b66-6505b86 131->136 137 6505b89-6505b8c 131->137 133->126 141 6505a8f-6505ab0 133->141 134->126 140 6505b22-6505b2e 134->140 139 6505b8f-6505b95 135->139 136->137 137->139 139->126 142 6505b9b-6505bae 139->142 140->127 140->128 143 6505ab2 141->143 144 6505abc-6505ad7 141->144 142->126 147 6505bb4-6505bc4 142->147 143->144 144->134 153 6505ad9-6505adf 144->153 147->126 148 6505bca-6505bd7 147->148 148->126 152 6505bdd-6505c02 148->152 152->126 169 6505c08-6505c20 152->169 156 6505ae1 153->156 157 6505aeb-6505af1 153->157 159 6505cd4-6505cd6 154->159 161 6505cf3 155->161 162 6505cfd-6505d19 155->162 156->157 157->126 158 6505af7-6505b10 157->158 163 6505cd8-6505ce3 159->163 164 6505d1a-6505d36 159->164 161->162 163->155 163->159 169->126 173 6505c22-6505c2d 169->173 174 6505c7e-6505c85 173->174 175 6505c2f-6505c39 173->175 175->174 177 6505c3b-6505c51 175->177 179 6505c53 177->179 180 6505c5d-6505c76 177->180 179->180 180->174
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID: d
                                                                                                                                                                                                                          • API String ID: 0-2564639436
                                                                                                                                                                                                                          • Opcode ID: 3844e9543e3f9f2a3bf80d346c0f5177f567fe921ec00b72476dd05795ffcd02
                                                                                                                                                                                                                          • Instruction ID: 5c890a161101b65e87bdc6db0f610193e4d9742e48add3aab8842e88994af97b
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3844e9543e3f9f2a3bf80d346c0f5177f567fe921ec00b72476dd05795ffcd02
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D4C16D35600602CFD725CF18C58096ABBF2FF89314759C999D45A9B6A1EB30FC46CF94
                                                                                                                                                                                                                          Function 065048B8 Relevance: .6, Instructions: 590COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 477 65048b8-6504900 call 6504650 482 6504902-6504904 477->482 483 6504906-650490a 477->483 484 6504910-6504933 482->484 483->484 489 6504935-650493a 484->489 490 650493f-650494b 484->490 491 6504a1b-6504a21 489->491 495 650494d-6504979 call 6503f50 490->495 496 650497e-650498a 490->496 493 6504a23 491->493 494 6504a27-6504a47 491->494 493->494 507 6504a53-6504a68 494->507 508 6504a49-6504a4e 494->508 495->491 500 6504996-65049aa 496->500 501 650498c-6504991 496->501 512 6504a16 500->512 513 65049ac-65049ce 500->513 501->491 521 6504aeb 507->521 522 6504a6e-6504a7e 507->522 511 6504af0-6504afe 508->511 517 6504b00-6504b04 511->517 518 6504b16-6504b22 511->518 512->491 534 65049d0-65049f2 513->534 535 65049f4-6504a0d 513->535 523 6504b0c-6504b0e 517->523 526 6504c06-6504c3a 518->526 527 6504b28-6504b44 518->527 521->511 530 6504a80-6504a90 522->530 531 6504a92-6504a97 522->531 523->518 552 6504c52-6504c54 526->552 553 6504c3c-6504c50 526->553 542 6504bf2-6504c00 527->542 530->531 538 6504a99-6504aa9 530->538 531->511 534->512 534->535 535->512 554 6504a0f-6504a14 535->554 550 6504ab2-6504ac2 538->550 551 6504aab-6504ab0 538->551 542->526 544 6504b49-6504b52 542->544 548 6504e11-6504e38 544->548 549 6504b58-6504b6b 544->549 567 6504ecc-6504f08 548->567 568 6504e3e-6504e40 548->568 549->548 555 6504b71-6504b83 549->555 565 6504ac4-6504ac9 550->565 566 6504acb-6504adb 550->566 551->511 557 6504c84-6504cc4 552->557 558 6504c56-6504c68 552->558 553->552 554->491 570 6504b85-6504b91 555->570 571 6504bef 555->571 644 6504cc6 call 65054f8 557->644 645 6504cc6 call 6505508 557->645 558->557 569 6504c6a-6504c7c 558->569 565->511 581 6504ae4-6504ae9 566->581 582 6504add-6504ae2 566->582 606 6504f73-6504f94 567->606 607 6504f0a-6504f1d 567->607 568->567 573 6504e46-6504e48 568->573 569->557 570->548 575 6504b97-6504bec 570->575 571->542 573->567 578 6504e4e-6504e52 573->578 575->571 578->567 579 6504e54-6504e58 578->579 583 6504e6a-6504eac 579->583 584 6504e5a-6504e68 579->584 581->511 582->511 593 6504eb4-6504ec9 583->593 584->593 587 6504ccc-6504ce0 599 6504ce2-6504cf9 587->599 600 6504d27-6504d74 587->600 616 6504d07-6504d1f call 6503f50 599->616 617 6504cfb-6504d05 599->617 630 6504d76-6504d8f 600->630 631 6504dc8-6504ddf 600->631 609 6504f2d-6504f37 607->609 610 6504f1f-6504f2c 607->610 619 6504f46-6504f4c 609->619 620 6504f39-6504f44 609->620 616->600 617->616 629 6504f4e-6504f71 619->629 620->629 629->606 638 6504d91 630->638 639 6504d99-6504dc5 630->639 636 6504de1-6504dfc 631->636 637 6504e05-6504e0e 631->637 636->637 638->639 639->631 644->587 645->587
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 3562aa9905c27e1cbf2708e02c2bff5dfadcf33df808208338eb3c837c2661f1
                                                                                                                                                                                                                          • Instruction ID: 60e8338264a61af07f43683a697c2f26351c8abd5ad6c8cdad73ef69a5ba86ef
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3562aa9905c27e1cbf2708e02c2bff5dfadcf33df808208338eb3c837c2661f1
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C2324975B00605CFEB54DF29C584A6ABBF6FF88204B1584A9E646CB3A2DB30EC45CB51
                                                                                                                                                                                                                          Function 065048A8 Relevance: .3, Instructions: 277COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 1120 65048a8-65048b0 1121 65048b2-6504900 call 6504650 1120->1121 1122 6504917-650491c 1120->1122 1135 6504902-6504904 1121->1135 1136 6504906-650490a 1121->1136 1123 6504922-6504933 1122->1123 1130 6504935-650493a 1123->1130 1131 650493f-650494b 1123->1131 1132 6504a1b-6504a21 1130->1132 1139 650494d-6504979 call 6503f50 1131->1139 1140 650497e-650498a 1131->1140 1137 6504a23 1132->1137 1138 6504a27-6504a47 1132->1138 1141 6504910-650491c 1135->1141 1136->1141 1137->1138 1153 6504a53-6504a68 1138->1153 1154 6504a49-6504a4e 1138->1154 1139->1132 1146 6504996-65049aa 1140->1146 1147 650498c-6504991 1140->1147 1141->1123 1158 6504a16 1146->1158 1159 65049ac-65049ce 1146->1159 1147->1132 1167 6504aeb 1153->1167 1168 6504a6e-6504a7e 1153->1168 1157 6504af0-6504afe 1154->1157 1163 6504b00-6504b04 1157->1163 1164 6504b16-6504b22 1157->1164 1158->1132 1180 65049d0-65049f2 1159->1180 1181 65049f4-6504a0d 1159->1181 1169 6504b0c-6504b0e 1163->1169 1172 6504c06-6504c3a 1164->1172 1173 6504b28-6504b44 1164->1173 1167->1157 1176 6504a80-6504a90 1168->1176 1177 6504a92-6504a97 1168->1177 1169->1164 1198 6504c52-6504c54 1172->1198 1199 6504c3c-6504c50 1172->1199 1188 6504bf2-6504c00 1173->1188 1176->1177 1184 6504a99-6504aa9 1176->1184 1177->1157 1180->1158 1180->1181 1181->1158 1200 6504a0f-6504a14 1181->1200 1196 6504ab2-6504ac2 1184->1196 1197 6504aab-6504ab0 1184->1197 1188->1172 1190 6504b49-6504b52 1188->1190 1194 6504e11-6504e38 1190->1194 1195 6504b58-6504b6b 1190->1195 1213 6504ecc-6504f08 1194->1213 1214 6504e3e-6504e40 1194->1214 1195->1194 1201 6504b71-6504b83 1195->1201 1211 6504ac4-6504ac9 1196->1211 1212 6504acb-6504adb 1196->1212 1197->1157 1203 6504c84-6504cc4 1198->1203 1204 6504c56-6504c68 1198->1204 1199->1198 1200->1132 1216 6504b85-6504b91 1201->1216 1217 6504bef 1201->1217 1290 6504cc6 call 65054f8 1203->1290 1291 6504cc6 call 6505508 1203->1291 1204->1203 1215 6504c6a-6504c7c 1204->1215 1211->1157 1227 6504ae4-6504ae9 1212->1227 1228 6504add-6504ae2 1212->1228 1252 6504f73-6504f94 1213->1252 1253 6504f0a-6504f1d 1213->1253 1214->1213 1219 6504e46-6504e48 1214->1219 1215->1203 1216->1194 1221 6504b97-6504bec 1216->1221 1217->1188 1219->1213 1224 6504e4e-6504e52 1219->1224 1221->1217 1224->1213 1225 6504e54-6504e58 1224->1225 1229 6504e6a-6504eac 1225->1229 1230 6504e5a-6504e68 1225->1230 1227->1157 1228->1157 1239 6504eb4-6504ec9 1229->1239 1230->1239 1233 6504ccc-6504ce0 1245 6504ce2-6504cf9 1233->1245 1246 6504d27-6504d74 1233->1246 1262 6504d07-6504d1f call 6503f50 1245->1262 1263 6504cfb-6504d05 1245->1263 1276 6504d76-6504d8f 1246->1276 1277 6504dc8-6504ddf 1246->1277 1255 6504f2d-6504f37 1253->1255 1256 6504f1f-6504f2c 1253->1256 1265 6504f46-6504f4c 1255->1265 1266 6504f39-6504f44 1255->1266 1262->1246 1263->1262 1275 6504f4e-6504f71 1265->1275 1266->1275 1275->1252 1284 6504d91 1276->1284 1285 6504d99-6504dc5 1276->1285 1282 6504de1-6504dfc 1277->1282 1283 6504e05-6504e0e 1277->1283 1282->1283 1284->1285 1285->1277 1290->1233 1291->1233
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 8af1a557c33517a229ae88ea601d1ecb536bd0d7fc5f7a3b18773474fb871703
                                                                                                                                                                                                                          • Instruction ID: 0dc2a915b4495fa8070643ee60bc6af93c64b30b17d94b8a56e4a6da42cf8960
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8af1a557c33517a229ae88ea601d1ecb536bd0d7fc5f7a3b18773474fb871703
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0BB12634B00605CFDB54DF29C988A6EBBF6BF88204B1544A8E546DB3A2DB30ED05CB51
                                                                                                                                                                                                                          Function 06507D58 Relevance: .1, Instructions: 147COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 51785058e740d5472259ee196d3c96917a0a23142154a95971d0ef719db6f762
                                                                                                                                                                                                                          • Instruction ID: 6623c26273d15185a2d242ba9c0f4373d239024c9de5904f7b9d4c1252133091
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 51785058e740d5472259ee196d3c96917a0a23142154a95971d0ef719db6f762
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EB512571E00219CFEB54CFA9D884BDEBBB5BF88700F148529D415AB284DB75A946CF81
                                                                                                                                                                                                                          Function 06507D4C Relevance: .1, Instructions: 131COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 7dd3b740aeceee0bc213e99f5de77701b610c8295600c9f610367e64b04a91f5
                                                                                                                                                                                                                          • Instruction ID: 71da80309338c66dd4409783fcee8109a4183a1006a5f3e07990ea75e2d1388c
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7dd3b740aeceee0bc213e99f5de77701b610c8295600c9f610367e64b04a91f5
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EC5157B1D01219DFEB64CFA9C885BDEBBF5BF48700F148529E415AB284DB74A845CF81
                                                                                                                                                                                                                          Function 065059C8 Relevance: .1, Instructions: 124COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: d1a35c08b186a9828087834b98494fac7d794c805bef72d466dfc2cd02ba23da
                                                                                                                                                                                                                          • Instruction ID: 90aeb356eb6ad2810e7195f06f10f63edaf9239bf0ef67415e329507b5592d29
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d1a35c08b186a9828087834b98494fac7d794c805bef72d466dfc2cd02ba23da
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 89412935A00605CFDB10CF59C9809AAF7F2FF89310B598999E5599B2A1E730F911CF94
                                                                                                                                                                                                                          Function 06503DE0 Relevance: .1, Instructions: 107COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 15d0481025b04825f0f1c2b766a8729501966d0c9ddba4b4f012b25c19b108f2
                                                                                                                                                                                                                          • Instruction ID: 0e0f6a40c0c831ef6a69da30bd0380ce677217f737ccfafd00519e3edb292e89
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 15d0481025b04825f0f1c2b766a8729501966d0c9ddba4b4f012b25c19b108f2
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4A313476B002118BD729A738E4516AE73E6DFCA320718447ED449CF380DE75EC078B91
                                                                                                                                                                                                                          Function 065084C8 Relevance: .1, Instructions: 103COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 948e695742f9b2879e033d5ad3e470df2e6aca691c6dfb7a283eb8f1945865dc
                                                                                                                                                                                                                          • Instruction ID: 99376fc5c3bacc5aa585723d256ad3389fb90914cdd445750fc2aaac2142fd38
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 948e695742f9b2879e033d5ad3e470df2e6aca691c6dfb7a283eb8f1945865dc
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BB31AB35B003048FDB09EBB8A46056E77E7EBC92017144579E506DB381EF39EC068BE1
                                                                                                                                                                                                                          Function 06505579 Relevance: .1, Instructions: 101COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 424df0389c080ba6564cdfb1fdd3b7d026652cb138570dfb6ddacb3f5bc74cbc
                                                                                                                                                                                                                          • Instruction ID: 62d8b273b1fa14d74d623ab589519bd751f258b4c2f470cd45768452f1b931e4
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 424df0389c080ba6564cdfb1fdd3b7d026652cb138570dfb6ddacb3f5bc74cbc
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A2318735B002119FDB05DF35D884AAEBBB2FF89204B508569E906CB3A5DF30ED01CB90
                                                                                                                                                                                                                          Function 06505588 Relevance: .1, Instructions: 96COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 3699b9716baec08f792077d207a3d02be8c61eaecb720e39bbb18b85016c2d2f
                                                                                                                                                                                                                          • Instruction ID: fa1146b94534d50e73db533a5213b5863482dc0e60ece93d337784da3e86776f
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3699b9716baec08f792077d207a3d02be8c61eaecb720e39bbb18b85016c2d2f
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 01316335B002119FDB15DF35D884AAEBBB6BF89200B408469E906CB3A5DF31ED01CBA0
                                                                                                                                                                                                                          Function 0650F920 Relevance: .1, Instructions: 96COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 1efebd566638f3770edac0c67a36f66edb2b768341994189270057529bbe7aab
                                                                                                                                                                                                                          • Instruction ID: 1ca63bde87ee64f079414e933d6da89185273a00169eea9f79de14e8b213bff0
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1efebd566638f3770edac0c67a36f66edb2b768341994189270057529bbe7aab
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7131F7357093506FDB5A6F78D82455E3FBFEB8A11431504ABEA06CB395DD708C05CBA1
                                                                                                                                                                                                                          Function 065087A0 Relevance: .1, Instructions: 93COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: d5a3bbcedb1d3273381d2aedd0896175507140272c34c90698b61d7dde8c427e
                                                                                                                                                                                                                          • Instruction ID: 6e7200149a090a6011e9e989c8a4ecbc4871bf9ad0486e7434e2faeae8934ad2
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d5a3bbcedb1d3273381d2aedd0896175507140272c34c90698b61d7dde8c427e
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D841F0B1D01208DFEF14CFAAD944ADEBBB6BF88310F14842AE415B7294DB35A945CF90
                                                                                                                                                                                                                          Function 06508795 Relevance: .1, Instructions: 82COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 11abb24eb04f148fc26e7cada3c9f27cc2520c4cde65faf8ed5996349f072524
                                                                                                                                                                                                                          • Instruction ID: 1df65f890069dd8ecd43cfbe4232301eb23b6feac830731a7d804d4233bc1a58
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 11abb24eb04f148fc26e7cada3c9f27cc2520c4cde65faf8ed5996349f072524
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8731F2B1D012489FEB14CFAAD944BDEBBF6AF88300F14842AE415B7294DB359945CF90
                                                                                                                                                                                                                          Function 06508A98 Relevance: .1, Instructions: 77COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: cf853fefef364afd2dcf4f4802d90d7b9897b6be1ef6eb40e9708c5ddef52a64
                                                                                                                                                                                                                          • Instruction ID: 4ccaf136c2f239e29ad9dad465af085027386b139a809f661e93c36945e3e509
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: cf853fefef364afd2dcf4f4802d90d7b9897b6be1ef6eb40e9708c5ddef52a64
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3531E2B1D01258DFEF14DFA9D894B9EBBF5BF48310F24842AE409B7280DB75A945CB90
                                                                                                                                                                                                                          Function 028AD4C4 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2634154543.00000000028AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028AD000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_28ad000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: a33ed473ff202df5f6f40ab877b62874744a2012ddb14f908c4853e164cd43aa
                                                                                                                                                                                                                          • Instruction ID: 53d55208221699ce6410df6414b3f31d0a4c99a8138520dd143db85dd5610e3c
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a33ed473ff202df5f6f40ab877b62874744a2012ddb14f908c4853e164cd43aa
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CC212579500244DFEB05DF10D9D0B2ABF65FB88318F24C569E809CBA56CB36D456CBA2
                                                                                                                                                                                                                          Function 028AD3D8 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2634154543.00000000028AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028AD000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_28ad000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 629de2f1f8095d49e375f02a79ec6e49177b0a4fa6b5eeae6c4f53cc00b41939
                                                                                                                                                                                                                          • Instruction ID: 5268dc7056b42f14dd5c927d0577ff510c7c1c6311b9ace0ecff36a79db2feab
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 629de2f1f8095d49e375f02a79ec6e49177b0a4fa6b5eeae6c4f53cc00b41939
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D221287D500344DFEB08DF10D9C0B16BB65FB84318F24C569D809CB656C73AE456CBA2
                                                                                                                                                                                                                          Function 028BD01C Relevance: .1, Instructions: 72COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2634194021.00000000028BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028BD000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_28bd000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 05f66aaf6af7da1c689239632c65863a85f9ea33b1cfb5355a6ca9e9dc79239b
                                                                                                                                                                                                                          • Instruction ID: 24419c94ef04d8834e130098036e96cf81134bf246fde399d7bbd0f350d90ed8
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 05f66aaf6af7da1c689239632c65863a85f9ea33b1cfb5355a6ca9e9dc79239b
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0521D07D604344EFDB16DF14D9C0B66BB65EF84218F24C5ADD80A8B386C73AD847CA62
                                                                                                                                                                                                                          Function 06508A8C Relevance: .1, Instructions: 66COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: ee2197a6af38dd332f4547774339e62760e66e0c12e823d2130443f5b6422d50
                                                                                                                                                                                                                          • Instruction ID: 3c668b783577ff78c7376dcf457bbd0e1927516a20f8c0fdd20717d0a0d80fdf
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ee2197a6af38dd332f4547774339e62760e66e0c12e823d2130443f5b6422d50
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4E2128B1D017589FEF24CFA9C895B9EBBF9BF48300F14842AE405B7280DB759945CB90
                                                                                                                                                                                                                          Function 028BD006 Relevance: .1, Instructions: 63COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2634194021.00000000028BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028BD000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_28bd000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 1c81da954bfa0ec7fc027b56e4a36ba2c06125a096fb43356ed790c985f26b35
                                                                                                                                                                                                                          • Instruction ID: 9a78d66a004ce00449471beee6cf21280a924644e67c5e99840e795358f2895e
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1c81da954bfa0ec7fc027b56e4a36ba2c06125a096fb43356ed790c985f26b35
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CC2180795087809FCB02CF14D994B51BF71EF46214F28C5EAD8498F2A7C33A985ACB62
                                                                                                                                                                                                                          Function 0650BC5D Relevance: .1, Instructions: 59COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: c09198cc1e09b13947dc5fbb71ad81854acbb039634274fd80721131b59c92b3
                                                                                                                                                                                                                          • Instruction ID: f15455611322e56065757cec2a7205da5cb633028a8a271a51bd77eee1bbbb51
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c09198cc1e09b13947dc5fbb71ad81854acbb039634274fd80721131b59c92b3
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 571104392002005FDBD5AB38E8648AF3BABEFC6354304481DEA07C7600CD70AD068BB2
                                                                                                                                                                                                                          Function 0650A84E Relevance: .1, Instructions: 59COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: d85cc2523e04de3dd5d5052113dd8fd2d700112a868c65c1133465f87100c821
                                                                                                                                                                                                                          • Instruction ID: 72ef8fcb350f6c797e5687b2bbef808864d21067e6ab90892cf367a54e892dc5
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d85cc2523e04de3dd5d5052113dd8fd2d700112a868c65c1133465f87100c821
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7B112E7190D3D48FEB168B648814298BFB1FF07251F0501EBD08ADB293D73D894ACB22
                                                                                                                                                                                                                          Function 06508C58 Relevance: .1, Instructions: 57COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 7d287bf1c664a9c0bf60025b9f0a02791e440afa870ff939124cc25d66925f6d
                                                                                                                                                                                                                          • Instruction ID: c7167a6496161fb1b8b86ffc89c43b999d8c56edb3ecff108bc557fb5353e2be
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7d287bf1c664a9c0bf60025b9f0a02791e440afa870ff939124cc25d66925f6d
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2221D075E012189FDF48CFA9E888ADDBBB1BB89301F10912AE805B3390EB345905CF54
                                                                                                                                                                                                                          Function 028AD3D3 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2634154543.00000000028AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028AD000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_28ad000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 0c18b29bf45e1f8211f0d9b8393173274bc5291f3679a0d43233693b02d382c4
                                                                                                                                                                                                                          • Instruction ID: 8e0a7e45038bcf93accf7c550a7e91539eda3eceec0ccca5e9032f300b3718e3
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0c18b29bf45e1f8211f0d9b8393173274bc5291f3679a0d43233693b02d382c4
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2311D37A504280DFDB15CF10D9C4B56BF71FB84324F28C6A9D8098BA56C33AE456CBA1
                                                                                                                                                                                                                          Function 028AD4BF Relevance: .1, Instructions: 56COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2634154543.00000000028AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028AD000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_28ad000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 0c18b29bf45e1f8211f0d9b8393173274bc5291f3679a0d43233693b02d382c4
                                                                                                                                                                                                                          • Instruction ID: 6dfc49da317db56d6c8af046d4e563983f957f7237c0cc5ccd0c4d9e0ae87add
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0c18b29bf45e1f8211f0d9b8393173274bc5291f3679a0d43233693b02d382c4
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6611E67A504280CFDF15CF10D9C4B56BF71FB84318F28C6A9D8498BA56C336D456CBA1
                                                                                                                                                                                                                          Function 06508350 Relevance: .0, Instructions: 50COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: a4777534b89b0dc64627706829792b752d8d43d5b95518443dfc7c905fc0ff6b
                                                                                                                                                                                                                          • Instruction ID: a77da27cef72b23064ea84a883192080443c26f3071b326a4b7ab04296873111
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a4777534b89b0dc64627706829792b752d8d43d5b95518443dfc7c905fc0ff6b
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C5017131B002199BDF10DEA9EC44AAFB7FAFBC8251B14803AE605D7280DB30991587A1
                                                                                                                                                                                                                          Function 0650C499 Relevance: .0, Instructions: 48COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 8c489fe5f075af592e01a816b9ccdd9a0a5ca457dc3b01b5c2122b4706f05196
                                                                                                                                                                                                                          • Instruction ID: 8fbc4e49ad75ba5f70a2309d2dcbaaaff97921b61f50edcba62db937f0df745e
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8c489fe5f075af592e01a816b9ccdd9a0a5ca457dc3b01b5c2122b4706f05196
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5A01C0342057058FE325AF74E41866F7BE7EFCA315B108A6AD54A87640CF749D0ACBA2
                                                                                                                                                                                                                          Function 0650BC70 Relevance: .0, Instructions: 46COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 98bcf8013664571e6b048537ab455e0b2cbfd5b2c7ab247a37a235ccf2d8f750
                                                                                                                                                                                                                          • Instruction ID: 4862d85d415c0aa2e000eea7bafe24b7f2116a6b8d59aaaae10f80fd09455351
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 98bcf8013664571e6b048537ab455e0b2cbfd5b2c7ab247a37a235ccf2d8f750
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DC018F392002055FDBC4AB78E46452E77ABEFC9354754582CDA07CB640DEB0BD4A8BA2
                                                                                                                                                                                                                          Function 0650E8B0 Relevance: .0, Instructions: 44COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 8224bb2addffc129b1b4a88aa1a136c5d15b64614ba2bf3bf6e124a74114cba9
                                                                                                                                                                                                                          • Instruction ID: 402cb8fca9ea766aaad4371ed828bb1ddf8ea1c5538ff0c1bb709e045bafabd4
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8224bb2addffc129b1b4a88aa1a136c5d15b64614ba2bf3bf6e124a74114cba9
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1701F934619304AFCB01EF74D81499A3FBFEF8620071444EAE905CB262DB32DD11C7A1
                                                                                                                                                                                                                          Function 0650C4A8 Relevance: .0, Instructions: 42COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 066215c7fc418b30d667b33766e8a52375d7594a52b70c75affccd96c213c610
                                                                                                                                                                                                                          • Instruction ID: 31a92c24e4e9c63a873cfc8c393a48fa11499438fe5457c6d919d1dae4267c47
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 066215c7fc418b30d667b33766e8a52375d7594a52b70c75affccd96c213c610
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 060188342006058BE324AF65E01865AB7E7EFC9315B108A29D54A87A44CF74AC0A8BA2
                                                                                                                                                                                                                          Function 06505508 Relevance: .0, Instructions: 42COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: a89b53b387625a67b564e14b817b293e938c1d2dee316651f91932fb503cf389
                                                                                                                                                                                                                          • Instruction ID: dab9b14ee3fb0f6642919ffe66443ab8631ce42a14b01d298e50de5ffe2f0a23
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a89b53b387625a67b564e14b817b293e938c1d2dee316651f91932fb503cf389
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5E01A938A11701CFEBB59A35E60462777F7FF84209714883CD54686594FE71E484CF90
                                                                                                                                                                                                                          Function 06506E90 Relevance: .0, Instructions: 41COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 72a6752765d32e174d3cde9171e74bf42d4ec6dd31d46ee9ca0855b7bbe60766
                                                                                                                                                                                                                          • Instruction ID: de17cd5b3f7917bd3b5ceeccb0b9d0704d293b0ccecff624b280cb67d3f7301a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 72a6752765d32e174d3cde9171e74bf42d4ec6dd31d46ee9ca0855b7bbe60766
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DFF0B4672041D83FDB514EAA9C11EFF3FEDDB8E161B084056FBD8C1241C829C921ABB0
                                                                                                                                                                                                                          Function 06508F42 Relevance: .0, Instructions: 38COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: c5f412d1229487829bc2befcfd45fd72588d9f0784372e3a5fcca6f5b12dc44b
                                                                                                                                                                                                                          • Instruction ID: 4ecb5607e6a6db94b17703b2d6783d5b6c2502ab09731c44008d2d6934c7344e
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c5f412d1229487829bc2befcfd45fd72588d9f0784372e3a5fcca6f5b12dc44b
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0B0116B4D04209EFEF44DFA8D946BAEBBB4FB08301F1045A9E815A3380E7744A41CF90
                                                                                                                                                                                                                          Function 0650B358 Relevance: .0, Instructions: 37COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: fc3f63c07f3e532aea405aa1536db9e99d175135981be46731c5819cf63d2678
                                                                                                                                                                                                                          • Instruction ID: 5dbe4f28ba66128d98ba7a3c4a7ee1835335d2327da8c99e149311e6268e7564
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fc3f63c07f3e532aea405aa1536db9e99d175135981be46731c5819cf63d2678
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0501F234909386EFCB05EFB8D5A449CBFB7FF4620472406D9D852AB292CF301A45DB62
                                                                                                                                                                                                                          Function 0650C170 Relevance: .0, Instructions: 37COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 5c5ca07b9af2ce9a4b0394e2110c7119c7f7a0fe09cd3cd772c6ef79a65c807b
                                                                                                                                                                                                                          • Instruction ID: 4345cea84413e05092117904628d5bf157483d72cf2543ce5b65acbaa67e712d
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5c5ca07b9af2ce9a4b0394e2110c7119c7f7a0fe09cd3cd772c6ef79a65c807b
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4801D6311017019FD315EF25E808466BFFFFB49301700861AE84683A10CB30A54ACFE4
                                                                                                                                                                                                                          Function 06508F50 Relevance: .0, Instructions: 37COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: a001f520ddc652d3ba476a421fa2c086762eda3654715e80089d4c807f2d9b06
                                                                                                                                                                                                                          • Instruction ID: 3f5f5add4f37b04fdbe48f28109327a8cd6a133b1b10c36e4bab70e7b84b08ea
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a001f520ddc652d3ba476a421fa2c086762eda3654715e80089d4c807f2d9b06
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1F01D2B4D0420AEFDF44DFA9D945AAEFBF5BB49301F1085AAE915A3380E7744A41CF90
                                                                                                                                                                                                                          Function 0650ADE9 Relevance: .0, Instructions: 37COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: c707e5c68a799ff52d3dbe521d3cde9606865a61869052d29ed3f5be7570c72a
                                                                                                                                                                                                                          • Instruction ID: db1c4694cd5b0bb1c6eafff7dac7c7d16c75b2ec97490c44ab3022844df797fe
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c707e5c68a799ff52d3dbe521d3cde9606865a61869052d29ed3f5be7570c72a
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EAF02E352052406FCB542B79A8946CFBFDBEFCE214B00445DE20EC3142CD70584587B6
                                                                                                                                                                                                                          Function 028AD5F3 Relevance: .0, Instructions: 37COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2634154543.00000000028AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028AD000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_28ad000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 7b0307d3a85494643ebff0f0ac8f1c6de0979820eb41afcc01abc83141c20088
                                                                                                                                                                                                                          • Instruction ID: f1d09d928792f75465d11980f1008f1f2913010a9fbc3b90cc952e82e4ff6ce5
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7b0307d3a85494643ebff0f0ac8f1c6de0979820eb41afcc01abc83141c20088
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 90F0F97A200640AF97208F0AD984C27FBA9EBD4675719C55AE84A9B612C671EC41CBA0
                                                                                                                                                                                                                          Function 06503EC8 Relevance: .0, Instructions: 36COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 4e82bc509ee2de91ae4abd2f7702c08a416c95715057f4c239931f1f2363d004
                                                                                                                                                                                                                          • Instruction ID: b6a0e9c3b592eebc72094f3fb3bad711d46a7d3918c6b6f537e27d78b740558d
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4e82bc509ee2de91ae4abd2f7702c08a416c95715057f4c239931f1f2363d004
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D8F090353002014FC258E769E86196F73D79BCA610314892DD44A8B740EF70FD0687A2
                                                                                                                                                                                                                          Function 0650ACB8 Relevance: .0, Instructions: 36COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 66a81195e8d6d1656d65a236bef198022959bb2445b8a95c680bda7245f24ee4
                                                                                                                                                                                                                          • Instruction ID: 99866e46f358a3b02a0803c1a0dd0b96498e63e197e623361c5bbdec9feecbdf
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 66a81195e8d6d1656d65a236bef198022959bb2445b8a95c680bda7245f24ee4
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FEF09E733082A45FCB2B17746C240EE3FAAE9C62A130500DFE186CB152CE508906C3E2
                                                                                                                                                                                                                          Function 06506EA0 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 594e36e63ba4f6f3b65ceb1bbe3f60f653cbbfceb63ac873a4369275ee3a0101
                                                                                                                                                                                                                          • Instruction ID: 7617b6a36b937734e086181736d024ec9e7c16ab173f7dfeb44273a6bf216c1a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 594e36e63ba4f6f3b65ceb1bbe3f60f653cbbfceb63ac873a4369275ee3a0101
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 33F012662041E83F8B518EAA5C11CFB7FEDDA8E1617084156FFD8D2141C929C921ABB0
                                                                                                                                                                                                                          Function 028AD5E4 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2634154543.00000000028AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028AD000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_28ad000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 634f39a2a531c3e9a6ec4bdadd5715d880deb418b41f8b837644ddbf2cabe4d1
                                                                                                                                                                                                                          • Instruction ID: 52f5ecf75be2b34539ed983a3724d1703fe391e506e2a8c5712853a43482693a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 634f39a2a531c3e9a6ec4bdadd5715d880deb418b41f8b837644ddbf2cabe4d1
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 78F04F79104680AFD725CF05CD94C23BFB9EFC66647198489E88A9B753C671FC42CBA0
                                                                                                                                                                                                                          Function 065067C8 Relevance: .0, Instructions: 34COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 8dc75ce9d2a81c9e06b08892a5190098446e6102240349b3c8c02140ab752509
                                                                                                                                                                                                                          • Instruction ID: 93d4000af24522bc6121c790f0365cceb221ce5f70aec93e1f51e6d730d3bbc7
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8dc75ce9d2a81c9e06b08892a5190098446e6102240349b3c8c02140ab752509
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 22F02E31B00300ABE7209A28EC01F627FE4AF82724F158266F610CF1E2DAB1E804DB80
                                                                                                                                                                                                                          Function 06508FC0 Relevance: .0, Instructions: 33COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 96c0810e3e066f7ab77b5d1e6ed6b455a21e5f5b69047660a9453a6737e8e724
                                                                                                                                                                                                                          • Instruction ID: e770121a6f646ae09ee38620755cbadcc97919f152885397543bd917bd461fcf
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 96c0810e3e066f7ab77b5d1e6ed6b455a21e5f5b69047660a9453a6737e8e724
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DBF0C2B0C08259DFEF00CFB0C8159AEBFB0FB56201F0041C6E446E7391E6388A41CB40
                                                                                                                                                                                                                          Function 06508341 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 9e31e9e91589305a4959257c0323f74e0f41a6ac37bb8a5f61503b3e94173af8
                                                                                                                                                                                                                          • Instruction ID: 8f806dd62bc080933a1e29b0abc7729e74cd0bcb7176ba177be6cb6efa534b6a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9e31e9e91589305a4959257c0323f74e0f41a6ac37bb8a5f61503b3e94173af8
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3AF03772F102155B9F509969AC449BF7BF9EBD9261B080036D914D3181F734D91587A1
                                                                                                                                                                                                                          Function 0650B368 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: c6ee3463ec66425a1b58bd5e72ad0b39af84142a8078e9789e700f1440b3b747
                                                                                                                                                                                                                          • Instruction ID: 8dda82e7cf4ee6b102f7d970a19be5aa65e5792a289fcd9eec99bcaa51c1ffb8
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c6ee3463ec66425a1b58bd5e72ad0b39af84142a8078e9789e700f1440b3b747
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EBF01474E0120AEFCB44EFB9E59955CBBB6FB49204B2046A9C906A7250EB305A44DB61
                                                                                                                                                                                                                          Function 065054F8 Relevance: .0, Instructions: 31COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: be68abfdd819f8e7dc8de197153a30a28de9d0ada9e9a85b1fd9135b4e0df6a5
                                                                                                                                                                                                                          • Instruction ID: 0400686e26d216b4faf01eed22feeaac0ff8b5d6c80f2f7957da6dc8980e7d73
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: be68abfdd819f8e7dc8de197153a30a28de9d0ada9e9a85b1fd9135b4e0df6a5
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F2F0B4399007428FEBA5CA61DA0177BBBB2BF80215F48896DD04246995EBB5E545CF80
                                                                                                                                                                                                                          Function 0650AC60 Relevance: .0, Instructions: 31COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: cbf384bab73739a05cbacb3b9b7984fd3841a2faaec873e7e87f2a306237e45d
                                                                                                                                                                                                                          • Instruction ID: 5c0f55b8398a47eccd642371f00f39229e3a0328b3d93e3054be0d00929c6bfe
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: cbf384bab73739a05cbacb3b9b7984fd3841a2faaec873e7e87f2a306237e45d
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B6F0A7362082E45FCB1B2778AC344DE3F6ADAC626570500DBD545CB152CE550909C7EA
                                                                                                                                                                                                                          Function 0650C110 Relevance: .0, Instructions: 30COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 2d1c50171abb351c8327eaab6a791880258685dde14b8e7af7a687362b223a6b
                                                                                                                                                                                                                          • Instruction ID: d420e1b7d20fd5608213accdc25bc2215633e75f10c88f84e3c5f7f6e1a4eecb
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2d1c50171abb351c8327eaab6a791880258685dde14b8e7af7a687362b223a6b
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5BF050302057D14FC713DB34E51479E7FFB9F82204B04059EE186CB652CA745D05C7A2
                                                                                                                                                                                                                          Function 0650ADF8 Relevance: .0, Instructions: 28COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 4eceafc24f4791209dc38f7db6969c32cf927467bfd631871930c1b641eca90c
                                                                                                                                                                                                                          • Instruction ID: ce2acc34ab509b07ae2a35c136bafddfc007adffd179e2984d5a1737fc5e7f2c
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4eceafc24f4791209dc38f7db6969c32cf927467bfd631871930c1b641eca90c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 86E0D835300100ABDB582F6AE498A9F7BDFEBCD351B00442CE20EC3241CEB15C0547B6
                                                                                                                                                                                                                          Function 0650C180 Relevance: .0, Instructions: 27COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 66e81eab74371c566c216edfa00c58057e074147043ab5fff575c3a20c1da5b1
                                                                                                                                                                                                                          • Instruction ID: 9acdebc6edab00b68c2a7c1c4a920e40bb3e5bf6fbfd5e0b1c54674836873eaf
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 66e81eab74371c566c216edfa00c58057e074147043ab5fff575c3a20c1da5b1
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CFF06D34500B019FD719EF26E548516BBFBFB88305700862AE84B83A10DB70A50ACF94
                                                                                                                                                                                                                          Function 0650C120 Relevance: .0, Instructions: 25COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: a71a198b7684e71b351ba40f4f77fdb7998b352f5523aa10e06fc6a454a9d897
                                                                                                                                                                                                                          • Instruction ID: 5e0627892f82a743a59242cba56348f92088e6f18bae69c05fb196f83dff436b
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a71a198b7684e71b351ba40f4f77fdb7998b352f5523aa10e06fc6a454a9d897
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C5E065302007555FC755AB29E5187AFBBEBDF86314F04052DE647C7641CFB1AC058BA2
                                                                                                                                                                                                                          Function 0650CC38 Relevance: .0, Instructions: 25COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: cf6fbb19e6ca93be8caf8bdddd405cf49aab8c6c9c077b2277603c42e43af536
                                                                                                                                                                                                                          • Instruction ID: b797aa0c33a2f82239cb33c5d35723a51362bbc3daad6b01e3662093155de758
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: cf6fbb19e6ca93be8caf8bdddd405cf49aab8c6c9c077b2277603c42e43af536
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6DE04F356062909FC762EA25FD14AEB3B76EB97618B025356E00097A46CA300946CBF2
                                                                                                                                                                                                                          Function 06505698 Relevance: .0, Instructions: 24COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 41b1341fceeb5e86bead459991db9bbfeb6b5c8b0226f4604d7b3489c65f0d07
                                                                                                                                                                                                                          • Instruction ID: 80c97a44e4d26de13f931b28bd2daa2c718db7c964f500281952f6f40f56e0b4
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 41b1341fceeb5e86bead459991db9bbfeb6b5c8b0226f4604d7b3489c65f0d07
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 19E0D8B210C3119FD344DB60E8048967BE4EF95320F058C7EE480C7181FB76D841CBA9
                                                                                                                                                                                                                          Function 0650CE88 Relevance: .0, Instructions: 23COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 5116fd78445e5edb049741cf225214ef0ce07faecad4d5bc8da9485c0f3ce9d4
                                                                                                                                                                                                                          • Instruction ID: ce9299d1445140a9d7f4a8c690528796778da9ccbb4c9583091a85eaac13f04b
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5116fd78445e5edb049741cf225214ef0ce07faecad4d5bc8da9485c0f3ce9d4
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 22E0D878405381AFC742EB34E5518AA3B7AEA5721430712CADC80DB645C6209D00C796
                                                                                                                                                                                                                          Function 0650B500 Relevance: .0, Instructions: 22COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 0f4c5b0e3c353abde6a3f7aca8b4243a5ee3170750926a343fe5de90702f33ba
                                                                                                                                                                                                                          • Instruction ID: a73d23d6837ed50daf71818e64579353dbf1c878e327f325f3f9bc0ca2635f28
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0f4c5b0e3c353abde6a3f7aca8b4243a5ee3170750926a343fe5de90702f33ba
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 68F03935C0424AEBCB05CFB4DA488CDFF7AEB42244F20429AE96196191DA321B46DB90
                                                                                                                                                                                                                          Function 0650E280 Relevance: .0, Instructions: 22COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: b1e900cbb823149c4c306c78e247c851bac8584488b22f3df37bb8ff33f1c16c
                                                                                                                                                                                                                          • Instruction ID: 456586046b24f3fecedd63f6cb3cd96d0ba582d4fd0bf5982679b9ec50acbb74
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b1e900cbb823149c4c306c78e247c851bac8584488b22f3df37bb8ff33f1c16c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BDE0D8345057015FDB51FB10FF125A53775B75A708B021545DC0057A95CB705D49CBE2
                                                                                                                                                                                                                          Function 0650E1FF Relevance: .0, Instructions: 22COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 1c20a276efd3d35ca5b7c248ff6586f696431ffaef15933e2c007b795ee0c5b6
                                                                                                                                                                                                                          • Instruction ID: ceec1f33c87dc7792c4312f8240886d984066a793025859cd7bcc583ca8498ce
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1c20a276efd3d35ca5b7c248ff6586f696431ffaef15933e2c007b795ee0c5b6
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EBE0DF71A09248EFCB41DFA4E9109AE3BB69B82204F2041DBD809E7350D6304F258B62
                                                                                                                                                                                                                          Function 0650E8F8 Relevance: .0, Instructions: 21COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 0b972335a8fd0b1598cc067e50d3efd31d0a0a8f05989e84c0c2281fb1cd6017
                                                                                                                                                                                                                          • Instruction ID: 34fd18890b6c5981b5b52481c1fd5ceb93266267b53c3b3b6ed316a091738c32
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0b972335a8fd0b1598cc067e50d3efd31d0a0a8f05989e84c0c2281fb1cd6017
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 68E0173E226254AFC702AB69DC40CD63F79EF4A62030840C6F6458F273C621A925DBB1
                                                                                                                                                                                                                          Function 0650F910 Relevance: .0, Instructions: 21COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 7800e571f650a17d4df084cee037267a1013966f19353aa2cd8e82da3f826db7
                                                                                                                                                                                                                          • Instruction ID: 1129a81e95392fd98bc134982f41469bd465aca5ab713537b24daef550f4e23f
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7800e571f650a17d4df084cee037267a1013966f19353aa2cd8e82da3f826db7
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D9D02B357053246F8B1A167858240F73BAFABCA51032580A7F505DB146CD654C0F83E1
                                                                                                                                                                                                                          Function 0650AC80 Relevance: .0, Instructions: 20COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: bbae6d4b4c318c95f98026091e2f3aae84e91d7e3af21084eb432a41cbad768d
                                                                                                                                                                                                                          • Instruction ID: e61a1bebeec383aa4f529bfe64d1d041c3ed7f494a0cbeacffba0eaf31790c67
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bbae6d4b4c318c95f98026091e2f3aae84e91d7e3af21084eb432a41cbad768d
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 10D05E36300129978E1D27B9F4184AE77ABEAC9762301006EE70BCB240CFA55D0A97DA
                                                                                                                                                                                                                          Function 0650B510 Relevance: .0, Instructions: 19COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: a76dd506c84c462d8cf45333d7926fac60d32d58f9f356be797e3f86ebff03d7
                                                                                                                                                                                                                          • Instruction ID: 4cb43acfdbc7e44cf1b3808c8d363b6d2ed73a0a94ae723b052f0abec8bd513a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a76dd506c84c462d8cf45333d7926fac60d32d58f9f356be797e3f86ebff03d7
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 08E09275D0020DEFCB40DFE5E9448DDFBBAEB48200F2082AAD909A3200EB306B55DF90
                                                                                                                                                                                                                          Function 0650E210 Relevance: .0, Instructions: 16COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 69c98abeeffd52a205fe57aa7360bbe9e886efa6a9092c1f89c7bb998aa5866d
                                                                                                                                                                                                                          • Instruction ID: 47ae9c34d6f09d7b61fb568ee6fbc18327ca97e1b48676364f9642af00eacbc1
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 69c98abeeffd52a205fe57aa7360bbe9e886efa6a9092c1f89c7bb998aa5866d
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AED05B71E0020CFFCB40DFA8E91155D77BADB45204B1041D9D909E3700DA315F109B91
                                                                                                                                                                                                                          Function 0650F8EA Relevance: .0, Instructions: 14COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 68920a99b455db1b6a6512fc4ebc82770b96ebfb44a1b5310569b937858a8e7b
                                                                                                                                                                                                                          • Instruction ID: 76cb26fed61dcee4d17a6d67400494da6886c4f81682e53ddd69e9a0ac99d748
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 68920a99b455db1b6a6512fc4ebc82770b96ebfb44a1b5310569b937858a8e7b
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: ADC012367400100B0AC56A5C701006D66DB83C86A3385006ADA0FC3344CD614C464B91
                                                                                                                                                                                                                          Function 06503721 Relevance: .0, Instructions: 9COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 18c7ea395d5f214638352c3ff0cfc9d7207ade0d17682424ad801db513ecd292
                                                                                                                                                                                                                          • Instruction ID: e0277401f48b8dffbbb07fff939fd115e06c29e37ff428440c59003f52ed519f
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 18c7ea395d5f214638352c3ff0cfc9d7207ade0d17682424ad801db513ecd292
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B7B092326601021BF7507261AC0BFD2389193E07A5F195020B752A528ADEDAD04086A9

                                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                                          Function 06506FE8 Relevance: .8, Instructions: 784COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: c89e2ddf5dc8d6a92ec64cd2219667bdfe1b4abe151dba3052fc1a5b3cb32b06
                                                                                                                                                                                                                          • Instruction ID: 5aeb03d76b723adadf23c8ef0bc4b0e7f0c75310eb8d9016ad1f55b1dacdcb4d
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c89e2ddf5dc8d6a92ec64cd2219667bdfe1b4abe151dba3052fc1a5b3cb32b06
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 48621FB46003009BE789DF18D45871A7BE6EB88308F65C49DC10A9F396DFB6D90B8F95
                                                                                                                                                                                                                          Function 06506FF8 Relevance: .8, Instructions: 780COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: f8ce7334e574c10efcd41e955357664d6b1c6ede294f40ca3ec943945954bde9
                                                                                                                                                                                                                          • Instruction ID: 66587163a69400d57129b206574248791196560bb26363ff1cc498f32a9175ad
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f8ce7334e574c10efcd41e955357664d6b1c6ede294f40ca3ec943945954bde9
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A1621FB46003009BE789DF18D45871A7BE6EB88308F65C49DC10A9F396DFB6D90B8F95
                                                                                                                                                                                                                          Function 0294DC74 Relevance: .3, Instructions: 264COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2634350159.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_2940000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 6794c35a51440d36c50fc38835191a327e733e40aab0199bda813c5b7edbbfa9
                                                                                                                                                                                                                          • Instruction ID: d07ac80ba155394b94783b899134bbeefb484864cd8bad35312b79323d2fe80f
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6794c35a51440d36c50fc38835191a327e733e40aab0199bda813c5b7edbbfa9
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DBA19D36E0020A8FCF05DFB4C84499EB7B6FF84304B15856AE905AB265DF75EA06CF90
                                                                                                                                                                                                                          Function 0650E2C7 Relevance: 46.6, Strings: 37, Instructions: 387COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID: DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj
                                                                                                                                                                                                                          • API String ID: 0-3050091760
                                                                                                                                                                                                                          • Opcode ID: bb42b7a2f1472ea788511921f0ee2de9ed68f03eef006c3e6c12c66a286e751c
                                                                                                                                                                                                                          • Instruction ID: 133213786c10ea3d010b125be368cd0ca1acb27385156b6de738ca21a5232b5c
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bb42b7a2f1472ea788511921f0ee2de9ed68f03eef006c3e6c12c66a286e751c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 50D1BF34700701ABE206F6A5DCA2AADB797FBCA304B444438C6084FB95EF727D295797
                                                                                                                                                                                                                          Function 0650E2D8 Relevance: 46.6, Strings: 37, Instructions: 383COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID: DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj
                                                                                                                                                                                                                          • API String ID: 0-3050091760
                                                                                                                                                                                                                          • Opcode ID: 8d731dc43968e8ce2e5b153ced4f9586e3697e437350e43b4c6aea2bcb7c1eb9
                                                                                                                                                                                                                          • Instruction ID: d43c8314f257fa3c6fb78eb0ad91b96611acc7378f22914c9f3ac7f0dce46cd3
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8d731dc43968e8ce2e5b153ced4f9586e3697e437350e43b4c6aea2bcb7c1eb9
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 70D1A034300701ABE206F6A5DC61AADB397FBCA304B854438D6044F795EF727C195797
                                                                                                                                                                                                                          Function 0650CC7F Relevance: 16.4, Strings: 13, Instructions: 147COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID: DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj
                                                                                                                                                                                                                          • API String ID: 0-1192847946
                                                                                                                                                                                                                          • Opcode ID: 63bdeb694d09a334aaf79b760d65a9836d5c2519b3396d13c1afdbeeb8b70e64
                                                                                                                                                                                                                          • Instruction ID: 3c05962ae2c19f6f78d731a4dc802b00595a52abc9a5b9fa5702add20c14cf2f
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 63bdeb694d09a334aaf79b760d65a9836d5c2519b3396d13c1afdbeeb8b70e64
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5641C034300700ABE306FAA5D856A6EB797FBCA304B444938D6188FB85CF766D194797
                                                                                                                                                                                                                          Function 0650CC90 Relevance: 16.4, Strings: 13, Instructions: 143COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID: DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj
                                                                                                                                                                                                                          • API String ID: 0-1192847946
                                                                                                                                                                                                                          • Opcode ID: 95ad22b60de88f716ffc021b4156dcebc0a50af491d421980bc903e2989756c2
                                                                                                                                                                                                                          • Instruction ID: ea73afb1a590e4d06be52262a30134352be935f9901ee1c3b2b5fae51f2e9c6f
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 95ad22b60de88f716ffc021b4156dcebc0a50af491d421980bc903e2989756c2
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CC41C034300700ABE206FAA5D852A6EB797FBCA304B844938D7188FB85CF76BD154797
                                                                                                                                                                                                                          Function 0650CED1 Relevance: 10.1, Strings: 8, Instructions: 100COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID: DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj
                                                                                                                                                                                                                          • API String ID: 0-2670367415
                                                                                                                                                                                                                          • Opcode ID: bb35d66016d17ecb8b59238e03b6e777238814e9b80036463a792c1b3f473c0b
                                                                                                                                                                                                                          • Instruction ID: b72a5dd2f77cd2cfb54a75704f4119db4e6792bac12ac1daf055f33206e5aa33
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bb35d66016d17ecb8b59238e03b6e777238814e9b80036463a792c1b3f473c0b
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3B31E234700311ABE706FAA8D851AAEB79BFBCA304B444838D6088FB85CF767D154797
                                                                                                                                                                                                                          Function 0650CEE0 Relevance: 10.1, Strings: 8, Instructions: 93COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID: DTj$DTj$DTj$DTj$DTj$DTj$DTj$DTj
                                                                                                                                                                                                                          • API String ID: 0-2670367415
                                                                                                                                                                                                                          • Opcode ID: fb7288534fd09d5a6ef0fa2ca0da16f251bc5626df039e8ff5f50ca347af9712
                                                                                                                                                                                                                          • Instruction ID: cd0471cece28140e553f62d5efc6b5aa17f43f1095b40019ca05afd1ffc1e56f
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fb7288534fd09d5a6ef0fa2ca0da16f251bc5626df039e8ff5f50ca347af9712
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8121D034700311ABE706FAA9D851A6EB797FBCA308B844438D6188FB85CFB67C154797
                                                                                                                                                                                                                          Function 0650C968 Relevance: 8.8, Strings: 7, Instructions: 88COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID: DTj$DTj$DTj$DTj$DTj$DTj$DTj
                                                                                                                                                                                                                          • API String ID: 0-1309597825
                                                                                                                                                                                                                          • Opcode ID: 76985a0f44f5c55a60a1d028c770f7b37ffc5dee1661bbb93a30b8d92ef2bede
                                                                                                                                                                                                                          • Instruction ID: 9e9f606decd55f6e9a9cdc9e78a8e3d4901446ff5a0a6685d4893cc0eac860aa
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 76985a0f44f5c55a60a1d028c770f7b37ffc5dee1661bbb93a30b8d92ef2bede
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FD31C3303003526FEB01BBA5EC559AE77A3FB8A305704456CE619CFA94CF715D8A8B83
                                                                                                                                                                                                                          Function 0650C978 Relevance: 8.8, Strings: 7, Instructions: 83COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID: DTj$DTj$DTj$DTj$DTj$DTj$DTj
                                                                                                                                                                                                                          • API String ID: 0-1309597825
                                                                                                                                                                                                                          • Opcode ID: 58b156c406331ab2186a83b4e0cef93b99dd225485a4538d0c223b6a209c462f
                                                                                                                                                                                                                          • Instruction ID: 9cadd7dbe90331899c241483caf308ea3b0abe0110a395b050b07a161817585d
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 58b156c406331ab2186a83b4e0cef93b99dd225485a4538d0c223b6a209c462f
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8121B530300352AFEB05BBA5EC5586E77A3FB8A305704457CE619CFA94CE715D8A8B83
                                                                                                                                                                                                                          Function 0650D538 Relevance: 7.6, Strings: 6, Instructions: 78COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID: DTj$DTj$DTj$DTj$DTj$DTj
                                                                                                                                                                                                                          • API String ID: 0-23703227
                                                                                                                                                                                                                          • Opcode ID: 197bae3bbc41e6e0d94fde75b18b2a65542c12e0ad9010f5f12c4648e1434fac
                                                                                                                                                                                                                          • Instruction ID: 291b2c55f1d825eb77986445c24079e16c62ce463360255c2e9aa1efa3198b32
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 197bae3bbc41e6e0d94fde75b18b2a65542c12e0ad9010f5f12c4648e1434fac
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D821D434700350ABE306FBA99861A6DB797FBCA708B448538D6148FB85CF726D1947A3
                                                                                                                                                                                                                          Function 0650D548 Relevance: 7.6, Strings: 6, Instructions: 73COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000004.00000002.2636635756.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_4_2_6500000_RegAsm.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID: DTj$DTj$DTj$DTj$DTj$DTj
                                                                                                                                                                                                                          • API String ID: 0-23703227
                                                                                                                                                                                                                          • Opcode ID: eb10213e9a433d3d56f89cf19ae1a1dccb80e927e81d008ea28f28526c1ea772
                                                                                                                                                                                                                          • Instruction ID: 934e1ad82ea45505d2a2addbae3ecc56400ca2fb7b5384ae408671c4532bf5d8
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: eb10213e9a433d3d56f89cf19ae1a1dccb80e927e81d008ea28f28526c1ea772
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7111D530700310ABE202F6A9D851A6EB797FBCA708B408538D6144FB84CF726D154793