Edit tour

Windows Analysis Report
BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

Overview

General Information

Sample Name:	BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe
Analysis ID:	770746
MD5:	8f9d4f7768960c59b8011c8c1a52dd63
SHA1:	a8648349a9aa90efd315e278786951cedfe711a9
SHA256:	b63350aad8b78b989c052c8bdae2ea691108e8e15f4b9b6c864ad86b1c300e36
Tags:	94-130-56-29exeFakeBlueTwelveRedLineStealerscr
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Malicious sample detected (through community Yara rule)

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Writes to foreign memory regions

Tries to steal Crypto Currency Wallets

Machine Learning detection for sample

Allocates memory in foreign processes

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

C2 URLs / IPs found in malware configuration

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to launch a process as a different user

Yara detected Credential Stealer

Creates processes with suspicious names

Contains long sleeps (>= 3 min)

Enables debug privileges

Is looking for software installed on the system

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Detected TCP or UDP traffic on non-standard ports

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe (PID: 4220 cmdline: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe MD5: 8F9D4F7768960C59B8011C8C1A52DD63)

vbc.exe (PID: 5336 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe MD5: B3A917344F5610BEEC562556F11300FA)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": "94.130.56.29:14233", "Bot Id": "CryptoTraffic", "Authorization Header": "849e4d47f7252cdc8951ca8bcd961a86"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.258205839.0000000004431000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000000.253376814.0000000004A02000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: vbc.exe PID: 5336	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: vbc.exe PID: 5336	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.0.vbc.exe.4a00000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.0.vbc.exe.4a00000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a454:$pat14: , CommandLine: 0x134a3:$v2_1: ListOfProcesses 0x13282:$v4_3: base64str 0x13dfb:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x12098:$v4_8: procName 0x1280f:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.44e73d8.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.44e73d8.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x18854:$pat14: , CommandLine: 0x118a3:$v2_1: ListOfProcesses 0x11682:$v4_3: base64str 0x121fb:$v4_4: stringKey 0xff63:$v4_5: BytesToStringConverted 0xf176:$v4_6: FromBase64 0x10498:$v4_8: procName 0x10c0f:$v5_5: FileScanning 0x1016c:$v5_7: RecordHeaderField 0xfe34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.4513008.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.4513008.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x18854:$pat14: , CommandLine: 0x118a3:$v2_1: ListOfProcesses 0x11682:$v4_3: base64str 0x121fb:$v4_4: stringKey 0xff63:$v4_5: BytesToStringConverted 0xf176:$v4_6: FromBase64 0x10498:$v4_8: procName 0x10c0f:$v5_5: FileScanning 0x1016c:$v5_7: RecordHeaderField 0xfe34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.4513008.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.4513008.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a454:$pat14: , CommandLine: 0x45c74:$pat14: , CommandLine: 0x134a3:$v2_1: ListOfProcesses 0x3ecc3:$v2_1: ListOfProcesses 0x13282:$v4_3: base64str 0x3eaa2:$v4_3: base64str 0x13dfb:$v4_4: stringKey 0x3f61b:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x3d383:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x3c596:$v4_6: FromBase64 0x12098:$v4_8: procName 0x3d8b8:$v4_8: procName 0x1280f:$v5_5: FileScanning 0x3e02f:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x3d58c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT 0x3d254:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.44e73d8.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.44e73d8.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a454:$pat14: , CommandLine: 0x46084:$pat14: , CommandLine: 0x718a4:$pat14: , CommandLine: 0x134a3:$v2_1: ListOfProcesses 0x3f0d3:$v2_1: ListOfProcesses 0x6a8f3:$v2_1: ListOfProcesses 0x13282:$v4_3: base64str 0x3eeb2:$v4_3: base64str 0x6a6d2:$v4_3: base64str 0x13dfb:$v4_4: stringKey 0x3fa2b:$v4_4: stringKey 0x6b24b:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x3d793:$v4_5: BytesToStringConverted 0x68fb3:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x3c9a6:$v4_6: FromBase64 0x681c6:$v4_6: FromBase64 0x12098:$v4_8: procName 0x3dcc8:$v4_8: procName 0x694e8:$v4_8: procName
0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.4471420.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.4471420.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x9040c:$pat14: , CommandLine: 0xbc03c:$pat14: , CommandLine: 0xe785c:$pat14: , CommandLine: 0x8945b:$v2_1: ListOfProcesses 0xb508b:$v2_1: ListOfProcesses 0xe08ab:$v2_1: ListOfProcesses 0x8923a:$v4_3: base64str 0xb4e6a:$v4_3: base64str 0xe068a:$v4_3: base64str 0x89db3:$v4_4: stringKey 0xb59e3:$v4_4: stringKey 0xe1203:$v4_4: stringKey 0x87b1b:$v4_5: BytesToStringConverted 0xb374b:$v4_5: BytesToStringConverted 0xdef6b:$v4_5: BytesToStringConverted 0x86d2e:$v4_6: FromBase64 0xb295e:$v4_6: FromBase64 0xde17e:$v4_6: FromBase64 0x88050:$v4_8: procName 0xb3c80:$v4_8: procName 0xdf4a0:$v4_8: procName
Click to see the 7 entries

Snort Signatures

ETPRO MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 94.130.56.29 - Destination IP: 192.168.2.6

Timestamp:	94.130.56.29192.168.2.614233497132850353 12/20/22-16:09:28.411763
SID:	2850353
Source Port:	14233
Destination Port:	49713
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.6 - Destination IP: 94.130.56.29

Timestamp:	192.168.2.694.130.56.2949713142332850286 12/20/22-16:09:46.337104
SID:	2850286
Source Port:	49713
Destination Port:	14233
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init - Source IP: 192.168.2.6 - Destination IP: 94.130.56.29

Timestamp:	192.168.2.694.130.56.2949713142332850027 12/20/22-16:09:26.593382
SID:	2850027
Source Port:	49713
Destination Port:	14233
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: 94.130.56.29:14233

Avira URL Cloud: Label: malware

Machine Learning detection for sample

Source: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

Joe Sandbox ML: detected

Source: 00000000.00000002.258205839.0000000004431000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "94.130.56.29:14233", "Bot Id": "CryptoTraffic", "Authorization Header": "849e4d47f7252cdc8951ca8bcd961a86"}

Source: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2850027 ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init 192.168.2.6:49713 -> 94.130.56.29:14233
Source: Traffic	Snort IDS: 2850286 ETPRO TROJAN Redline Stealer TCP CnC Activity 192.168.2.6:49713 -> 94.130.56.29:14233
Source: Traffic	Snort IDS: 2850353 ETPRO MALWARE Redline Stealer TCP CnC - Id1Response 94.130.56.29:14233 -> 192.168.2.6:49713

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 94.130.56.29:14233

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: global traffic

TCP traffic: 192.168.2.6:49713 -> 94.130.56.29:14233

Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.56.29

Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: vbc.exe, 00000001.00000002.341807154.00000000050A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iptc.tc4xmp
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultP
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: vbc.exe, 00000001.00000002.345096258.0000000006D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Responsex
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.345096258.0000000006D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Responseiox
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4idx
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: vbc.exe, 00000001.00000002.348033092.0000000007CF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe, 00000000.00000002.258205839.0000000004431000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000000.253376814.0000000004A02000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: vbc.exe, 00000001.00000002.348033092.0000000007CF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: vbc.exe, 00000001.00000002.348033092.0000000007CF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: vbc.exe, 00000001.00000002.347886491.0000000007CDA000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348309619.0000000007D57000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347177798.0000000007BDE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347607150.0000000007C79000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.346585809.0000000007AFE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.344598612.0000000006CF0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.343811839.0000000006C28000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.346666909.0000000007B1B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.345046023.0000000006D7C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347513723.0000000007C5C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348925368.0000000007DFE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348511736.0000000007D9E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347277522.0000000007BFB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.349023639.0000000007E1B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342782103.0000000006AB6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348033092.0000000007CF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: vbc.exe, 00000001.00000002.348033092.0000000007CF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: vbc.exe, 00000001.00000002.347886491.0000000007CDA000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348309619.0000000007D57000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347177798.0000000007BDE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347607150.0000000007C79000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.346585809.0000000007AFE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.344598612.0000000006CF0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.343811839.0000000006C28000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.346666909.0000000007B1B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.345046023.0000000006D7C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347513723.0000000007C5C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348925368.0000000007DFE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348511736.0000000007D9E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347277522.0000000007BFB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.349023639.0000000007E1B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342782103.0000000006AB6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348033092.0000000007CF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: vbc.exe, 00000001.00000002.347886491.0000000007CDA000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348309619.0000000007D57000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347177798.0000000007BDE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347607150.0000000007C79000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.346585809.0000000007AFE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.344598612.0000000006CF0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.343811839.0000000006C28000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.346666909.0000000007B1B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.345046023.0000000006D7C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347513723.0000000007C5C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348925368.0000000007DFE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348511736.0000000007D9E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347277522.0000000007BFB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.349023639.0000000007E1B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342782103.0000000006AB6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348033092.0000000007CF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: vbc.exe, 00000001.00000002.347607150.0000000007C79000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.346666909.0000000007B1B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348511736.0000000007D9E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347277522.0000000007BFB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.349023639.0000000007E1B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348033092.0000000007CF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: vbc.exe, 00000001.00000002.347886491.0000000007CDA000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348309619.0000000007D57000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347177798.0000000007BDE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347607150.0000000007C79000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.346585809.0000000007AFE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.344598612.0000000006CF0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.343811839.0000000006C28000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.346666909.0000000007B1B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.345046023.0000000006D7C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347513723.0000000007C5C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348925368.0000000007DFE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348511736.0000000007D9E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347277522.0000000007BFB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.349023639.0000000007E1B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342782103.0000000006AB6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348033092.0000000007CF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: vbc.exe, 00000001.00000002.347886491.0000000007CDA000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348309619.0000000007D57000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347177798.0000000007BDE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347607150.0000000007C79000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.346585809.0000000007AFE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.344598612.0000000006CF0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.343811839.0000000006C28000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.346666909.0000000007B1B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.345046023.0000000006D7C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347513723.0000000007C5C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348925368.0000000007DFE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348511736.0000000007D9E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347277522.0000000007BFB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.349023639.0000000007E1B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342782103.0000000006AB6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348033092.0000000007CF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.0.vbc.exe.4a00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.44e73d8.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.4513008.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.4513008.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.44e73d8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.4471420.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen

Source: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.0.vbc.exe.4a00000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.44e73d8.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.4513008.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.4513008.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.44e73d8.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.4471420.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Code function: 0_2_01A8170A	0_2_01A8170A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 1_2_04FCF7C8	1_2_04FCF7C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 1_2_04FCF368	1_2_04FCF368

Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

Code function: 0_2_01A859E8 CreateProcessAsUserA,

0_2_01A859E8

Source: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe, 00000000.00000002.258205839.0000000004431000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameInerm.exe< vs BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe
Source: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe, 00000000.00000002.254692721.0000000003431000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameInerm.exe< vs BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

Source: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@0/1

Source: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: 1.0.vbc.exe.4a00000.0.unpack, BrEx.cs

Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbgpiZm5hZWxtb21laW1obHBtZ2puam9waGhwa2tvbGpwYXxQaGFudG9tCmZoaWxhaGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfEJvbHRYCmtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufExpcXVhbGl0eVdhbGxldApobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnxYZGVmaVdhbGxldApscGZjYmprbmlqcGVlaWxsaWZua2lrZ25jaWtnZmhkb3xOYW1pV2FsbGV0CmRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfE1haWFyRGVGaVdhbGxldApmZm5iZWxmZG9laW9oZW5ramlibm1hZGppZWhqaGFqYnxZb3JvaVdhbGxldAppYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3xUcm9ubGluawpqYmRhb2NuZWlpaW5tamJqbGdhbGhjZWxnYmVqbW5pZHxOaWZ0eVdhbGxldApua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnxNZXRhbWFzawphZmJjYmpwYnBmYWRsa21obWNsaGtlZW9kbWFtY2ZsY3xNYXRoV2FsbGV0CmhuZmFua25vY2Zlb2ZiZGRnY2lqbm1obmZua2RuYWFkfENvaW5iYXNlCmZoYm9oaW1hZWxib2hwamJibGRjbmdjbmFwbmRvZGpwfEJpbmFuY2VDaGFpbgpvZGJmcGVlaWhka2JpaG1vcGtiam1vb25mYW5sYmZjbHxCcmF2ZVdhbGxldApocGdsZmhnZm5oYmdwamRlbmpnbWRnb2VpYXBwYWZsbnxHdWFyZGFXYWxsZXQKYmxuaWVpaWZmYm9pbGxrbmpuZXBvZ2poa2dub2FwYWN8RXF1YWxXYWxsZXQKY2plbGZwbHBsZWJkamplbmxscGpjYmxtamtmY2ZmbmV8SmF4eHhMaWJlcnR5CmZpaGtha2ZvYmtta2pvanBjaHBmZ2NtaGZqbm1uZnBpfEJpdEFwcFdhbGxldAprbmNjaGRpZ29iZ2hlbmJiYWRkb2pqbm5hb2dmcHBmanxpV2FsbGV0CmFta21qam1tZmxkZG9nbWhwamxvaW1pcGJvZm5mamlofFdvbWJhdApmaGlsYWhlaW1nbGlnbmRka2pnb2ZrY2JnZWtoZW5iaHxBdG9taWNXYWxsZXQKbmxibW5uaWpjbmxlZ2tqanBjZmpjbG1jZmdnZmVmZG18TWV3Q3gKbmFuam1ka25oa2luaWZua2dkY2dnY2ZuaGRhYW1tbWp8R3VpbGRXYWxsZXQKbmtkZGduY2RqZ2pmY2RkYW1mZ2NtZm5saGNjbmltaWd8U2F0dXJuV2FsbGV0CmZuamhta2hobWtiamtrYWJuZGNubm9nYWdvZ2JuZWVjfFJvbmluV2FsbGV

Source: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe, u0097u0011/u009du0011.cs	Cryptographic APIs: 'CreateDecryptor'
Source: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe, u0097u0011/u009du0011.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe, u0097u0011/u009du0011.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.0.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.f90000.0.unpack, u0097u0011/u009du0011.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.f90000.0.unpack, u0097u0011/u009du0011.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.0.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.f90000.0.unpack, u0097u0011/u009du0011.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe, u0082u0093/u0088u0093.cs	.Net Code: ?? System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.f90000.0.unpack, u0082u0093/u0088u0093.cs	.Net Code: ?? System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

Code function: 0_2_01A852D8 pushad ; ret

0_2_01A852D9

Source: initial sample

Static PE information: section name: .text entropy: 7.643173971416759

Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	File created: \bluetwelve studio information for bloggers stray promotion on youtube 2022.scr.exe
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	File created: \bluetwelve studio information for bloggers stray promotion on youtube 2022.scr.exe			Jump to behavior

Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe TID: 3200	Thread sleep time: -10000000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe TID: 5212	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 5384	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 1324	Thread sleep count: 1675 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 5456	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Thread delayed: delay time: 10000000	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Window / User API: threadDelayed 1675

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Thread delayed: delay time: 10000000	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Binary or memory string: objectmethodInvokenhffskdsfkdfddafrffddhfscffdfhkgfsfdffdhfhddrfahddsshcfchfdgefffkdafsfhddhdshdghfBeginInvokeIAsyncResultAsyncCallbackcallbackEndInvokeresulthfsdkfdhgfshseffdfafffdchfhhfgsffrffdkdffcdshhfdasdfhfcfhfdgfadfdfrsfsshdkfffghhjfdffhfgadsffcrddfffskhjfsfhrgdddffdffffkhsjdfjsdfcffddshdffgfedfkfghjsddddffsfheghddjffffffgjskdgsfacsafpsfhjffkfhgfhjsrfhddfhffadsfsfhsscfgdbddfrjfsffhgdffafcfdssfkfhgjffchkffgahfhfsrddsfsfjjffadsfcfdggfsdehfsgkffjjcfssafdghfffrfddsdgkfffffchkfhrffdfdafgsssffjjffafffffdrdgfhcsdsgkffjjcfhdsfrfgfdsadfsdgkffffgdddfdsfdhfssfdghfhfssddssdfhfddfhhshsfddsdfsdfdshshsdsffdsdsdfsdfsfhsdhffsdssfsshddsfgfsafsdgfsdshsgsfsfdsdgssdaffadssgsfashdsfsgfssadfsdggasdsfdfshsggdsdfafaghssddfdafsadsfdsfsddsjdddfsdsfgdfgfsssdfhjfsdsafdfhgjffddddsgfdgsjsfsddfdfjdffafgdfddsfddjkfdssfdfsgfhfssjfsffdfgsjfadsffffdfhfsfsfsjsffsfdssdjdsdffffsskwssffssdvgsffffsdsgffssfddsxstartupInfoIicdajdfhfdfdffdffssdkfjhdfffdfhffsassdkfshhdffhdfsdhdffdfkdfaffdssdfffhhfhhsdfffdsshfffdhfhffdsffdfshfsdhshhhgfdffffdfsfhsfdfsffhfffdhsfddsffhssffdhdfffhhfdhsdffsfjhffsdffdfdh
Source: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Binary or memory string: hfsdkfdhgfshseffdfafffdch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 4A00000	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 4A02000	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 4A1E000	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 4A30000	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 48C0008	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 4A00000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 4A00000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Jump to behavior

Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Queries volume information: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.0.vbc.exe.4a00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.44e73d8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.4513008.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.4513008.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.44e73d8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.4471420.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.258205839.0000000004431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.253376814.0000000004A02000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 5336, type: MEMORYSTR

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Source: Yara match	File source: 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 5336, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.0.vbc.exe.4a00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.44e73d8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.4513008.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.4513008.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.44e73d8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.4471420.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.258205839.0000000004431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.253376814.0000000004A02000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 5336, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Valid Accounts	221 Windows Management Instrumentation	1 Valid Accounts	1 Valid Accounts	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Valid Accounts	LSASS Memory	11 Process Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	311 Process Injection	1 Access Token Manipulation	Security Account Manager	231 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Disable or Modify Tools	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	231 Virtualization/Sandbox Evasion	LSA Secrets	123 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	311 Process Injection	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Deobfuscate/Decode Files or Information	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	21 Obfuscated Files or Information	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	12 Software Packing	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.0.vbc.exe.4a00000.0.unpack	100%	Avira	HEUR/AGEN.1252166		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://iptc.tc4xmp	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17Response	0%	URL Reputation	safe
94.130.56.29:14233	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id19Responsex	1%	Virustotal		Browse
http://tempuri.org/Entity/Id19Responsex	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
94.130.56.29:14233	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultP	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	vbc.exe, 00000001.00000002.347886491.0000000007CDA000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348309619.0000000007D57000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347177798.0000000007BDE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347607150.0000000007C79000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.346585809.0000000007AFE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.344598612.0000000006CF0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.343811839.0000000006C28000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.346666909.0000000007B1B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.345046023.0000000006D7C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347513723.0000000007C5C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348925368.0000000007DFE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348511736.0000000007D9E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347277522.0000000007BFB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.349023639.0000000007E1B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342782103.0000000006AB6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348033092.0000000007CF7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	vbc.exe, 00000001.00000002.348033092.0000000007CF7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id7	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://iptc.tc4xmp	vbc.exe, 00000001.00000002.341807154.00000000050A6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6Response	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe, 00000000.00000002.258205839.0000000004431000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000000.253376814.0000000004A02000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	vbc.exe, 00000001.00000002.348033092.0000000007CF7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id20	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1Response	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	vbc.exe, 00000001.00000002.347886491.0000000007CDA000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348309619.0000000007D57000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347177798.0000000007BDE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347607150.0000000007C79000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.346585809.0000000007AFE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.344598612.0000000006CF0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.343811839.0000000006C28000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.346666909.0000000007B1B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.345046023.0000000006D7C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347513723.0000000007C5C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348925368.0000000007DFE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348511736.0000000007D9E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347277522.0000000007BFB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.349023639.0000000007E1B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342782103.0000000006AB6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348033092.0000000007CF7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16Response	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id18	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Response	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Response	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search.yahoo.com?fr=crmas_sfpf	vbc.exe, 00000001.00000002.347886491.0000000007CDA000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348309619.0000000007D57000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347177798.0000000007BDE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347607150.0000000007C79000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.346585809.0000000007AFE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.344598612.0000000006CF0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.343811839.0000000006C28000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.346666909.0000000007B1B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.345046023.0000000006D7C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347513723.0000000007C5C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348925368.0000000007DFE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348511736.0000000007D9E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.347277522.0000000007BFB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.349023639.0000000007E1B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342782103.0000000006AB6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.348033092.0000000007CF7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Responsex	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew	vbc.exe, 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17Response	vbc.exe, 00000001.00000002.341873161.0000000006951000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000001.00000002.342371127.0000000006A23000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.130.56.29	unknown	Germany		24940	HETZNER-ASDE	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	770746
Start date and time:	2022-12-20 16:08:07 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@0/1
EGA Information:	Successful, ratio: 50%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 114 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com
Execution Graph export aborted for target vbc.exe, PID 5336 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:09:05	API Interceptor	1x Sleep call for process: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe modified
16:09:44	API Interceptor	10x Sleep call for process: vbc.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
94.130.56.29	sXENjXwc4p.exe	Get hash	malicious	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
HETZNER-ASDE	file.exe	Get hash	malicious	Browse	136.243.147.81
	file.exe	Get hash	malicious	Browse	135.181.73.98
	file.exe	Get hash	malicious	Browse	135.181.73.98
	prog.apk	Get hash	malicious	Browse	144.76.58.8
	https://nto-pilot.com/?lang=en	Get hash	malicious	Browse	138.201.175.76
	file.exe	Get hash	malicious	Browse	135.181.73.98
	file.exe	Get hash	malicious	Browse	148.251.234.83
	SU2xrRCA3S.exe	Get hash	malicious	Browse	135.181.73.98
	icKRjsDL47.exe	Get hash	malicious	Browse	135.181.73.98
	h9Gwq0fYVO.exe	Get hash	malicious	Browse	135.181.73.98
	foNMlXr86C.exe	Get hash	malicious	Browse	135.181.73.98
	file.exe	Get hash	malicious	Browse	95.216.207.27
	file.exe	Get hash	malicious	Browse	148.251.234.83
	prog.apk	Get hash	malicious	Browse	144.76.58.8
	file.exe	Get hash	malicious	Browse	176.9.247.226
	file.exe	Get hash	malicious	Browse	195.201.24.164
	file.exe	Get hash	malicious	Browse	95.216.207.27
	file.exe	Get hash	malicious	Browse	195.201.24.164
	file.exe	Get hash	malicious	Browse	176.9.247.226
	[Atomic Heart] Personal Contract YouTube partners.scr	Get hash	malicious	Browse	95.217.102.105

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.log

Download File

Process:	C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	517
Entropy (8bit):	5.335306720429945
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhaxzAbDLI4M6:ML9E4Ks2wKDE4KhK3VZ9pKhmsXE4j
MD5:	BB6624785B5CCCA1B27C160A2F19C179
SHA1:	51C3A976DB55F4E09009C1E7663643A2205FBEA5
SHA-256:	CF05D58CFF71D857664AAB4D49D3ABABFD0D59A65303B0FA5B1996C1CD3E66DA
SHA-512:	83C5B206F17844ECE6D3F8330C661A66C76803DF80BDD29780C541963D4693F89947407336D4CDE03F1F902C8F50B64E4F49C1577B99AAB09EDA16F1677CA843
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2843
Entropy (8bit):	5.3371553026862095
Encrypted:	false
SSDEEP:	48:MxHKXeHKlEHU0YHKhQnouHIWUfHKhBHKdHKBfHK5AHKzvQTHmtHoxHImHK1HjHK0:iqXeqm00YqhQnouOqLqdqNq2qzcGtIxY
MD5:	9A010D404524B7E80B293AEC6FB4AF7F
SHA1:	B238A081C1D05DA6F76DA2F30C529C4275CCF5CF
SHA-256:	3FF08BA477214E6F51EC1F879A44FC02CBE69A69B072E7B317F337A786B21D63
SHA-512:	C7D0D118BFF6E2EDEF02290FC042556502D99967A37A5EDF98AF905BA66C4C2D2C159594DB3D22B5117EC5AA7DB910313A6370F650B9534D5B17E57378E02E2A
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Wi

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.5400057064748305
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe
File size:	196608
MD5:	8f9d4f7768960c59b8011c8c1a52dd63
SHA1:	a8648349a9aa90efd315e278786951cedfe711a9
SHA256:	b63350aad8b78b989c052c8bdae2ea691108e8e15f4b9b6c864ad86b1c300e36
SHA512:	0e2f0edae9b7e410e7258de77ab08cc6dff9532c896561a6db50535cb4fb18eaaf26cd26257292355fa69678bb5c3866394e0b1d82c218db1dc6385fec281ca7
SSDEEP:	3072:gY1x8WCRhhuDNmTQhAC38Em9OAQzqkjO1UFag+7DNNvFs0T6O9fjTy3z7mS5Jnfz:Zj8TRm38Em6qkjtYNC0TxfjuHnfWE
TLSH:	2E14C00A77D4EBE3CA6DC5B7F89522B54772DA6E4173D31628C80AE9DFE3780841170A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c.....................H........... ........@.. .......................`............@................................

File Icon


Icon Hash:	e4f4a484a4b098a4

Static PE Info

General

Entrypoint:	0x42d502
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x639EEC8B [Sun Dec 18 10:33:47 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2d4b8	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2e000	0x4567	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x34000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2b508	0x2b600	False	0.8513148414985591	data	7.643173971416759	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x2e000	0x4567	0x4600	False	0.20329241071428572	data	4.975290046895956	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x34000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x2e1a4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 3543 x 3543 px/m
RT_ICON	0x2e60c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3543 x 3543 px/m
RT_ICON	0x2f6b4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3543 x 3543 px/m
RT_GROUP_ICON	0x31c5c	0x30	data
RT_VERSION	0x31c8c	0x4f4	data
RT_MANIFEST	0x32180	0x3e7	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (939), with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
94.130.56.29192.168.2.614233497132850353 12/20/22-16:09:28.411763	TCP	2850353	ETPRO MALWARE Redline Stealer TCP CnC - Id1Response	14233	49713	94.130.56.29	192.168.2.6
192.168.2.694.130.56.2949713142332850286 12/20/22-16:09:46.337104	TCP	2850286	ETPRO TROJAN Redline Stealer TCP CnC Activity	49713	14233	192.168.2.6	94.130.56.29
192.168.2.694.130.56.2949713142332850027 12/20/22-16:09:26.593382	TCP	2850027	ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init	49713	14233	192.168.2.6	94.130.56.29

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2022 16:09:26.168210030 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:26.191246986 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:26.191353083 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:26.593381882 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:26.616084099 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:26.703876019 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:28.387984991 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:28.411762953 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:28.500984907 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:35.779660940 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:35.804711103 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:35.804778099 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:35.804822922 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:35.804864883 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:35.845330954 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:40.703062057 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:40.727485895 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:40.923954010 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:41.231669903 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:41.255109072 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:41.314505100 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:41.359431982 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:41.382098913 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:41.382209063 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:41.383140087 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:41.526073933 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:41.548304081 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:41.548777103 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:41.554673910 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:41.577363968 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:41.627023935 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:41.636322021 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:41.659096003 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:41.695327997 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:41.718040943 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:41.814526081 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:41.826141119 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:41.848854065 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:41.855295897 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:41.877742052 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:41.879445076 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:41.902019024 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:41.928046942 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:41.950807095 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.127120972 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:42.144467115 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:42.166603088 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.166656971 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.166793108 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.167325020 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.186016083 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:42.208868027 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.314588070 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:42.643757105 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:42.666199923 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.666223049 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.666239977 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.666302919 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:42.666367054 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.666377068 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:42.666378021 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:42.666445017 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.666455030 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:42.666460037 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.666474104 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.666491032 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.666521072 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.666613102 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:42.666654110 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:42.666759968 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.666877985 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:42.666949034 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.667093992 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:42.688668013 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.688695908 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.688714981 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.688806057 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:42.688806057 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:42.688884020 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:42.688941956 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.689035892 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:42.689069986 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.689116955 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.689441919 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.689486980 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.689508915 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.689528942 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.689774990 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.689882994 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.711018085 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.711077929 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.711118937 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.711158037 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.711318970 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.711498976 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:42.711514950 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.012737989 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.012881041 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.013319969 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.013411045 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.035252094 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.035537004 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.035768032 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.035790920 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.035964966 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.036585093 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.036600113 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.036771059 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.037108898 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.037125111 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.040240049 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.040450096 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.040450096 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.040600061 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.040713072 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.062562943 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065092087 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065140009 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065176964 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065216064 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065253019 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065293074 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065329075 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065361023 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065392971 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065426111 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065458059 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065488100 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065519094 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065551043 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065586090 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065618038 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065650940 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065680981 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065697908 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065716028 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065733910 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065764904 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065804005 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065845013 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065887928 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065921068 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065949917 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.065993071 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.066071033 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.066174030 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.066390038 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.066458941 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.088246107 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.088274956 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.088366985 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.090553999 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.090604067 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.090637922 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.090671062 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.090733051 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.090770960 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.090806961 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.090840101 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.090873003 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.092117071 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.092156887 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.092197895 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.092303991 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.092339039 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.092370987 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.092391968 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.092413902 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.092433929 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.092456102 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.092475891 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.092967033 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.093133926 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.094419956 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.094449043 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.094465017 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.094480991 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.094494104 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.094508886 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.094522953 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.094537973 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.094552040 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.094568014 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.094583035 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.094597101 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.094610929 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.094625950 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.094816923 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.094893932 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.095069885 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.095169067 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.095184088 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.095390081 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.095406055 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.095993996 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.096199989 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.118216991 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118254900 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118280888 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118304014 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118329048 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118351936 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118376017 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118401051 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118438959 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118463993 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118486881 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118513107 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118536949 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118558884 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118590117 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118618011 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118643999 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118669033 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118707895 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118732929 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118755102 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.118777990 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.119110107 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.119277954 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.119316101 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.119344950 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.119364023 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.119896889 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.120009899 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.141387939 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.141416073 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.141438007 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.141479015 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.141755104 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.141875029 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.141916037 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.141930103 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.142025948 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.142071962 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.142231941 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.142307997 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.142426014 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.142472029 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.142565966 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.142628908 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.142720938 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.142833948 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.143029928 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.143148899 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.143151999 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.143163919 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.143178940 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.143520117 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.143641949 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.143656969 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.143714905 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.143750906 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.143914938 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.144073009 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.144153118 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.144169092 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.144433975 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.144449949 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.165715933 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.165832043 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.166802883 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.168117046 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.177373886 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.200723886 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.303468943 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.326347113 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.424321890 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.541888952 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:44.565175056 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:44.627301931 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:46.311280966 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:46.334907055 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:46.337104082 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:46.360987902 CET	14233	49713	94.130.56.29	192.168.2.6
Dec 20, 2022 16:09:46.424325943 CET	49713	14233	192.168.2.6	94.130.56.29
Dec 20, 2022 16:09:46.436306000 CET	49713	14233	192.168.2.6	94.130.56.29

Analysis Process: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exePID: 4220, Parent PID: 3452

General

Target ID:	0
Start time:	16:09:01
Start date:	20/12/2022
Path:	C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe
Imagebase:	0xf90000
File size:	196608 bytes
MD5 hash:	8F9D4F7768960C59B8011C8C1A52DD63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.258205839.0000000004431000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	16:09:05
Start date:	20/12/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Imagebase:	0x1a0000
File size:	2688096 bytes
MD5 hash:	B3A917344F5610BEEC562556F11300FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.342173195.00000000069DF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000001.00000000.253376814.0000000004A02000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exePID: 4220, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	35.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.5%
Total number of Nodes:	115
Total number of Limit Nodes:	3

Executed Functions

Function 01A859E8 Relevance: 1.8, APIs: 1, Instructions: 262
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 01A85C7B

Memory Dump Source

Source File: 00000000.00000002.254571563.0000000001A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a80000_BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube .jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: c21d5fcbae12599ef41b43f473d1a8006bf97a2b4f51b4fb2b52c36561c5767c
Instruction ID: 25654d96653d6438e713d8d347def2e17717df36a05282d8f13c3ea779ce6314
Opcode Fuzzy Hash: c21d5fcbae12599ef41b43f473d1a8006bf97a2b4f51b4fb2b52c36561c5767c
Instruction Fuzzy Hash: 12A16871E002198FEB24DFA9C8857DDBBF2FF48314F048169E918A7290DB749989CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01A8170A Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.254571563.0000000001A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a80000_BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7706640319c5f92cb7775cfca1518b72ce7cb01a48845d27651c5eb79471acd
Instruction ID: a61c0d06efa6d78c050796726bae05aeb8bb8d51fee391d08165bc22bc0d986d
Opcode Fuzzy Hash: c7706640319c5f92cb7775cfca1518b72ce7cb01a48845d27651c5eb79471acd
Instruction Fuzzy Hash: E1E17930B002059FDB14EBA8C984BAEBBF2BF85314F158169E506AB795DB70DC46CB85

Uniqueness

Uniqueness Score: -1.00%

Function 01A859DF Relevance: 1.8, APIs: 1, Instructions: 263
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 01A85C7B

Memory Dump Source

Source File: 00000000.00000002.254571563.0000000001A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a80000_BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube .jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 8d138e32376961e0eba890d7587cbef4b2eec71cd0caada9ad6a7de1bb85e63e
Instruction ID: a91e25d44a7b0b91c23587920c94d4b4845102eafed2a875d5fed68500df3b47
Opcode Fuzzy Hash: 8d138e32376961e0eba890d7587cbef4b2eec71cd0caada9ad6a7de1bb85e63e
Instruction Fuzzy Hash: E4A16971E002198FEB14DFA9C8857DDBBF2FF48314F048569E918A7290DB74998ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 01A86073 Relevance: 1.6, APIs: 1, Instructions: 66
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 01A86105

Memory Dump Source

Source File: 00000000.00000002.254571563.0000000001A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a80000_BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube .jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f8d9aae4e183b44506e9091a9c290b98e852b7aae5ace81842c268f903d1d3d9
Instruction ID: c13c74dc6810f79d5ff83b04869a8cc2d23a1794599d85377aee401905962a78
Opcode Fuzzy Hash: f8d9aae4e183b44506e9091a9c290b98e852b7aae5ace81842c268f903d1d3d9
Instruction Fuzzy Hash: 152112B1900359DFDB10CF9AD885BDEBBF4FB48324F00852AE918A3241D778A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A86078 Relevance: 1.6, APIs: 1, Instructions: 65
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 01A86105

Memory Dump Source

Source File: 00000000.00000002.254571563.0000000001A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a80000_BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube .jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f2fa89dea0973d8fc52c95d058fc3c2349774e71a19c8689d4b21de7d2820adc
Instruction ID: 1cf2fb1979fbcfbd082fbe05c882f1b9e28f8772c93b3a229afc121d1870f647
Opcode Fuzzy Hash: f2fa89dea0973d8fc52c95d058fc3c2349774e71a19c8689d4b21de7d2820adc
Instruction Fuzzy Hash: 3321E2B5900359DFDB10CF9AD885BDEBBF4FB48324F10852AE918A3241D778A944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 01A85E18 Relevance: 1.6, APIs: 1, Instructions: 61
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 01A85E97

Memory Dump Source

Source File: 00000000.00000002.254571563.0000000001A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a80000_BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube .jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 4a83c7fc0201108c8209c909dd1e0df2fbe38342984bb2bd36d4be96d363da99
Instruction ID: 0081bd00c650ccbad3893c7c26bd5ecd144726dee58df70943d07aa9a9d989e7
Opcode Fuzzy Hash: 4a83c7fc0201108c8209c909dd1e0df2fbe38342984bb2bd36d4be96d363da99
Instruction Fuzzy Hash: 7F2138B1D002199FDB10DF9AC9857DEFBF4FB48224F04852AE918B3340D778A9448FA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A85ED8 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 01A85F56

Memory Dump Source

Source File: 00000000.00000002.254571563.0000000001A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a80000_BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube .jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c1385de2add5c4a6bf10847af331003c46c0cff1ab6368a44bd18922d7c3e53f
Instruction ID: bbd1168bef6ba2f7c78063d76d0994aa5aa63fe99ce61403547a769293c79ac2
Opcode Fuzzy Hash: c1385de2add5c4a6bf10847af331003c46c0cff1ab6368a44bd18922d7c3e53f
Instruction Fuzzy Hash: 632129B19002499FDB10DF9AC944BDEBBF4EB48320F14842AE918A3240C334A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A85E20 Relevance: 1.6, APIs: 1, Instructions: 58
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 01A85E97

Memory Dump Source

Source File: 00000000.00000002.254571563.0000000001A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a80000_BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube .jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 4e7dc388a693388f2c577636d529eb8bd3ccd3f8c1ad2e39b0eb58869d9d1b0b
Instruction ID: 09e84c1eb9a4f1c42b4e8d7cf989c487f537bd35733e7d99262cc8a9f0d5ca93
Opcode Fuzzy Hash: 4e7dc388a693388f2c577636d529eb8bd3ccd3f8c1ad2e39b0eb58869d9d1b0b
Instruction Fuzzy Hash: 6F211AB1D002199FDB10DF9AD9457DEFBF4BB49224F14852AD418B3240D778A9448FA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A85EE0 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 01A85F56

Memory Dump Source

Source File: 00000000.00000002.254571563.0000000001A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a80000_BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube .jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 458f298ca91d04b1e27c16a9d7df1d989da1540d51b0c448cdd1c7d837517f41
Instruction ID: 8600e446a3f149a71ea2fe20677f0e43911e9ab137353c9df4d8c017d32c4681
Opcode Fuzzy Hash: 458f298ca91d04b1e27c16a9d7df1d989da1540d51b0c448cdd1c7d837517f41
Instruction Fuzzy Hash: 432108B1D002499FDB10DF9AC944BDEFBF4FB48324F14842AE968A3250D374A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A85FCB Relevance: 1.5, APIs: 1, Instructions: 49
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 01A8603B

Memory Dump Source

Source File: 00000000.00000002.254571563.0000000001A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a80000_BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube .jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cd7566318a67684b958620978ff20032c9850a2b3fa9675b906afbfe0bf52b8c
Instruction ID: 2ea4c6f75d19799b9467f56a21f0a62b48204d0f051ad3cc5ca31c65d09696cc
Opcode Fuzzy Hash: cd7566318a67684b958620978ff20032c9850a2b3fa9675b906afbfe0bf52b8c
Instruction Fuzzy Hash: 671116B6900248DFDB10DF9AD888BDEBFF4EB48324F10841AE528A7250C735A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A85FD0 Relevance: 1.5, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 01A8603B

Memory Dump Source

Source File: 00000000.00000002.254571563.0000000001A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a80000_BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube .jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c550845162641757272a0bff9d81e83ddc05390049548ac1c4f0ff8e9c4f45b0
Instruction ID: 9bb2aa2f38809d1f65d150cc8beb9e07c90ef7ca2853e9a61f4bd1a000838f88
Opcode Fuzzy Hash: c550845162641757272a0bff9d81e83ddc05390049548ac1c4f0ff8e9c4f45b0
Instruction Fuzzy Hash: 1E11F5B5900249DFDB20DF9AD988BDEBFF4FB48324F10841AE528A7250C775A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01A861A8 Relevance: 1.5, APIs: 1, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 01A8620F

Memory Dump Source

Source File: 00000000.00000002.254571563.0000000001A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a80000_BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube .jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 68ae611fa300cdffdceb429236f768bafb932d4d7d9df3530b2b56286dab8b26
Instruction ID: 95610ad1d2ec8010a25de9eaafda8879443aaa7303721c222741b8085f6ebc8d
Opcode Fuzzy Hash: 68ae611fa300cdffdceb429236f768bafb932d4d7d9df3530b2b56286dab8b26
Instruction Fuzzy Hash: 801142B5C002488FDB10DF99D588BDEFBF4AB48324F10845AD568A3240D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A861B0 Relevance: 1.5, APIs: 1, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 01A8620F

Memory Dump Source

Source File: 00000000.00000002.254571563.0000000001A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a80000_BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube .jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 8078b331b316a1b3479e349c182136c4806b04a14bf0764083990957c2d626a5
Instruction ID: 48e1cb9280e4f55f272b80a1303dce37e322d4de84575af20b942caed4cbc308
Opcode Fuzzy Hash: 8078b331b316a1b3479e349c182136c4806b04a14bf0764083990957c2d626a5
Instruction Fuzzy Hash: 1E1112B1C002488FDB20DF9AD888BDEFBF8EB48324F10845AD518A3240D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vbc.exePID: 5336, Parent PID: 4220COMMON

Executed Functions

Function 04FCF7C8 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d18fd995398ece869585733cb6db2a4168f6d4185edb0464e017902746ade915
Instruction ID: be05c50cb78a6c9205aa578ef54f246f81674d4f2ff79de775a54cf4f22d6134
Opcode Fuzzy Hash: d18fd995398ece869585733cb6db2a4168f6d4185edb0464e017902746ade915
Instruction Fuzzy Hash: 6B22BE34B042158FDB14DF78D958A6EBBE6EF89214F1544ADE906CB3A2CB34EC06CB51

Uniqueness

Uniqueness Score: -1.00%

Function 09AB0048 Relevance: 34.4, Strings: 27, Instructions: 674COMMON

Download Yara Rule

Strings

xPvl, xrefs: 09AB0B7F
xPvl, xrefs: 09AB0ADD
xPvl, xrefs: 09AB0B13
xPvl, xrefs: 09AB0963
xPvl, xrefs: 09AB0C21
xPvl, xrefs: 09AB081F
xPvl, xrefs: 09AB088B
xPvl, xrefs: 09AB0BB5
xPvl, xrefs: 09AB0747
xPvl, xrefs: 09AB0999
xPvl, xrefs: 09AB0A05
xPvl, xrefs: 09AB0C57
xPvl, xrefs: 09AB09CF
xPvl, xrefs: 09AB0711
xPvl, xrefs: 09AB0A3B
xPvl, xrefs: 09AB092D
xPvl, xrefs: 09AB0BEB
xPvl, xrefs: 09AB07B3
xPvl, xrefs: 09AB07E9
xPvl, xrefs: 09AB0A71
xPvl, xrefs: 09AB08C1
xPvl, xrefs: 09AB0B49
xPvl, xrefs: 09AB08F7
xPvl, xrefs: 09AB0855
xPvl, xrefs: 09AB0AA7
xPvl, xrefs: 09AB06DB
xPvl, xrefs: 09AB077D

Memory Dump Source

Source File: 00000001.00000002.351323722.0000000009AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9ab0000_vbc.jbxd

Similarity

API ID:
String ID: xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl$xPvl
API String ID: 0-2145305819
Opcode ID: 5fa7306b11ff974f4456b9bdddbb9006e790f4fbdca54c87231a5fe7af753a97
Instruction ID: 6b30f0c4c530a580e6377aa410149fb1a6e47f74ca84796f975c242b3720d564
Opcode Fuzzy Hash: 5fa7306b11ff974f4456b9bdddbb9006e790f4fbdca54c87231a5fe7af753a97
Instruction Fuzzy Hash: 5D4298703006148FCB64AF78D550A6EB3A2FF86B19F01495CDA43AF791CB79EC458B86

Uniqueness

Uniqueness Score: -1.00%

Function 09AB3EE5 Relevance: 3.9, Strings: 3, Instructions: 198COMMON

Download Yara Rule

Strings

<C, xrefs: 09AB407E
<C, xrefs: 09AB4058
<C, xrefs: 09AB4025

Memory Dump Source

Source File: 00000001.00000002.351323722.0000000009AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9ab0000_vbc.jbxd

Similarity

API ID:
String ID: <C$<C$<C
API String ID: 0-3161134618
Opcode ID: 7d19ba971831f6788ccb8a283f8bba502f2d1b88be0110b40790da88233424b2
Instruction ID: 28fe4082e1cfb2f29b5f290e96c733228083d4b3213537266f39ff714cb32065
Opcode Fuzzy Hash: 7d19ba971831f6788ccb8a283f8bba502f2d1b88be0110b40790da88233424b2
Instruction Fuzzy Hash: E5711975B442088FCB04DFA8C8949ADBBFAEF89704B15409AE601DF3B2DB75ED458B50

Uniqueness

Uniqueness Score: -1.00%

Function 04FCEAD8 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

,~g, xrefs: 04FCEF9C
(l, xrefs: 04FCEBD5

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID: ,~g$ (l
API String ID: 0-3280312248
Opcode ID: 25be241536c6e37e13eaa18f84a7ebd31f8a5d34c3abaaab30a1d7187648baf6
Instruction ID: d8b1c6f3e60d126359dd2bac13292a4e7be0e2fb9e081d9e481f08c08edf89df
Opcode Fuzzy Hash: 25be241536c6e37e13eaa18f84a7ebd31f8a5d34c3abaaab30a1d7187648baf6
Instruction Fuzzy Hash: 1EE14B34A0020ADFCB14DF65D698A9DBBB2FF89314F158569E9069B3A1DB30FC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 09AB14DA Relevance: 2.8, Strings: 2, Instructions: 339COMMON

Download Yara Rule

Strings

xPvl, xrefs: 09AB1A8B
xPvl, xrefs: 09AB1A55

Memory Dump Source

Source File: 00000001.00000002.351323722.0000000009AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9ab0000_vbc.jbxd

Similarity

API ID:
String ID: xPvl$xPvl
API String ID: 0-3285020817
Opcode ID: 9857850d461dbb15c4e14576656ed74aa49126e687f48042b53e26175d15bf06
Instruction ID: 339383c7de9de6fc1db1740845c6a5fbdf668b19803c98312bb2a34d77b8880b
Opcode Fuzzy Hash: 9857850d461dbb15c4e14576656ed74aa49126e687f48042b53e26175d15bf06
Instruction Fuzzy Hash: 53C1C3347083458FD7148B64C965A7EBBFAAF85B08F15446DE5078F3A2CB74EC418B92

Uniqueness

Uniqueness Score: -1.00%

Function 09AB482E Relevance: 2.2, Strings: 1, Instructions: 966COMMON

Download Yara Rule

Strings

tA, xrefs: 09AB486E

Memory Dump Source

Source File: 00000001.00000002.351323722.0000000009AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9ab0000_vbc.jbxd

Similarity

API ID:
String ID: tA
API String ID: 0-743120799
Opcode ID: a63d4faa572ea4b1b605ad9c05941d56092a40653e3b5b5aeedc719f275dea6e
Instruction ID: de302f0648b06b96fae6fe63ea469a8752c825ffe8b621a3a8941de1cf633040
Opcode Fuzzy Hash: a63d4faa572ea4b1b605ad9c05941d56092a40653e3b5b5aeedc719f275dea6e
Instruction Fuzzy Hash: 882180397441449FCB01DBA8D885D9EBBB9FF9A610B11408AF5429B3B2C731DC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04FC8C08 Relevance: 2.0, Instructions: 1976COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ab720aa70774b12bd56c3f5892bb980c30dfcd41d55dce9b678be47b93a5efb
Instruction ID: 6b6e48c841da7473865ac2b6736f14a96db55dc5f1d6431d315b38bb141a1547
Opcode Fuzzy Hash: 7ab720aa70774b12bd56c3f5892bb980c30dfcd41d55dce9b678be47b93a5efb
Instruction Fuzzy Hash: 6713EB38D55208DFCF1A9B70E412999B732FF9930AB1085BED81126B69CB3FC952DB41

Uniqueness

Uniqueness Score: -1.00%

Function 04FC8C18 Relevance: 2.0, Instructions: 1973COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45e52a83a017ca530046d60f244e74e0ee1b18b312abdb583a0903fe0737fb5e
Instruction ID: 40b8e2000427254198d50178d036d4dc4b80b938b197bb9d2ee143010e943a75
Opcode Fuzzy Hash: 45e52a83a017ca530046d60f244e74e0ee1b18b312abdb583a0903fe0737fb5e
Instruction Fuzzy Hash: 0913EB38D51208DFCF1A9B70E452999B332FF9930AB1085BED81126B69CB3FD952DB41

Uniqueness

Uniqueness Score: -1.00%

Function 04FC0908 Relevance: 1.5, Strings: 1, Instructions: 298COMMON

Download Yara Rule

Strings

kth^, xrefs: 04FC0A42, 04FC0A47

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID: kth^
API String ID: 0-2658015146
Opcode ID: 6921a0a183445dc310f693792421b8da52297743598e54c58359936369c0fdd5
Instruction ID: 00f74f53bee67544f5ec436a59e4d0a6eab56eb3b91d19fc6c18bf4315bd0655
Opcode Fuzzy Hash: 6921a0a183445dc310f693792421b8da52297743598e54c58359936369c0fdd5
Instruction Fuzzy Hash: 4ED1E274D05229CFEB24DF64C944BDDBBB2EB89304F1095EAC509A7290DB34AA86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04FC08F8 Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

kth^, xrefs: 04FC0A42, 04FC0A47

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID: kth^
API String ID: 0-2658015146
Opcode ID: 7104a4f52a8b70e8e5ea197035904010fd0d3048366a38180d9095fd4a629e2f
Instruction ID: 344b12a4993fdfdba709b129c62df67ec4a04271de1d775f2c32f3ce9440fdb5
Opcode Fuzzy Hash: 7104a4f52a8b70e8e5ea197035904010fd0d3048366a38180d9095fd4a629e2f
Instruction Fuzzy Hash: 1291D074D05228CFEB64DF65C944BDDBBB2EB89304F1085EAD509B7250EB346A86CF60

Uniqueness

Uniqueness Score: -1.00%

Function 04FCDB80 Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

(l, xrefs: 04FCDBC7

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID: (l
API String ID: 0-172737615
Opcode ID: bccd9ca2c6dd223866af7f6de329ef3d66abbc4b9a0082a7c6ad2b217276b298
Instruction ID: f82959d6f155f86c0ba10814af74d0ed9fe87a87a6e628593d6a044a8617b244
Opcode Fuzzy Hash: bccd9ca2c6dd223866af7f6de329ef3d66abbc4b9a0082a7c6ad2b217276b298
Instruction Fuzzy Hash: 2C718E71E002098FDB14DFA9C5546AEBBF2AFC9304F24856ED805EB391DB70AC46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 09AB1AF8 Relevance: 1.4, Instructions: 1440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.351323722.0000000009AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9ab0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60dc6b3dace8bf945a181384e4db320bee9ae428fee9e8ca57f81e8d3c1b9ff6
Instruction ID: 72dd20c56cb4184fbb755f370f8c06b660d2c13a612913c231b644d607c3857c
Opcode Fuzzy Hash: 60dc6b3dace8bf945a181384e4db320bee9ae428fee9e8ca57f81e8d3c1b9ff6
Instruction Fuzzy Hash: F4C26E34B042189FDB14DF64C850BEDB7B6EF89704F1080AAE616AB7A1CB71AD85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04FCEACA Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

(l, xrefs: 04FCEBD5

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID: (l
API String ID: 0-172737615
Opcode ID: 3f946b03001d3f3ef48128a75ffa6dbc5426ff1374b4bd41191f4de125f2a2b9
Instruction ID: a5b973caccf7f994b6992da723ef18370e3c93aaee6456dd71dda85e6343afe5
Opcode Fuzzy Hash: 3f946b03001d3f3ef48128a75ffa6dbc5426ff1374b4bd41191f4de125f2a2b9
Instruction Fuzzy Hash: F581F774A0020ADFCB14DF65D69899DBBF2FF88314B158569E806AB361DB34EC42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04FC2B60 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

8cQh, xrefs: 04FC2C95

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID: 8cQh
API String ID: 0-3196321620
Opcode ID: 7db83fd65c52bbcc4417932fe13e0b47f1f1ea8955b2fb22a1e79dfe3e0e9d5c
Instruction ID: 44e78164f98affc4becd2b316bf3f676b190606a0296439a3158c138ef4c5cf3
Opcode Fuzzy Hash: 7db83fd65c52bbcc4417932fe13e0b47f1f1ea8955b2fb22a1e79dfe3e0e9d5c
Instruction Fuzzy Hash: 5A610A30D11208DFCB04EFB8E8548ADBBB2FF8A316B60956DE41677290DF319849CB55

Uniqueness

Uniqueness Score: -1.00%

Function 09AB4530 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

<C, xrefs: 09AB4541

Memory Dump Source

Source File: 00000001.00000002.351323722.0000000009AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9ab0000_vbc.jbxd

Similarity

API ID:
String ID: <C
API String ID: 0-3045115134
Opcode ID: a4c96ff971d73e5e6f87a7acb2d814ce2afb8b1475a0d6b882fb220acd75bb8b
Instruction ID: 86469d8753fe3a4b864cd5926bbcd61819bb02b268f8f651411edd75e41910a7
Opcode Fuzzy Hash: a4c96ff971d73e5e6f87a7acb2d814ce2afb8b1475a0d6b882fb220acd75bb8b
Instruction Fuzzy Hash: 8041E775B001149FCB44DF69D998EAABBF5FF8CB14B154069E506DB3A2DB31EC048B60

Uniqueness

Uniqueness Score: -1.00%

Function 04FC44B8 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

8cQh, xrefs: 04FC44DD

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID: 8cQh
API String ID: 0-3196321620
Opcode ID: 3548320759a560c1f6dd24f8d246528163e3768203aa0eea10205ff3204e4d9b
Instruction ID: 64cae4507b5e1e207b957da3826849167f234608d7aff80628bc0678422cdd95
Opcode Fuzzy Hash: 3548320759a560c1f6dd24f8d246528163e3768203aa0eea10205ff3204e4d9b
Instruction Fuzzy Hash: BF11C6305087448FD315EF79E41856A7FE2DFC6315B15897CD0868B282CF75680A8BA2

Uniqueness

Uniqueness Score: -1.00%

Function 04FCEF37 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

,~g, xrefs: 04FCEF9C

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID: ,~g
API String ID: 0-1173222925
Opcode ID: 37fe8447006a1eeb5f1a60dd69d2dbeb293d32f9380222a58432c320d73b13a9
Instruction ID: 0901acd0069cd2c948a1ba96cdf25dac0ac35302cedb6fc94dba7900ec149681
Opcode Fuzzy Hash: 37fe8447006a1eeb5f1a60dd69d2dbeb293d32f9380222a58432c320d73b13a9
Instruction Fuzzy Hash: 270147326093815FC3129B35DA905AB7FE2EFD7164708887ED54ACB292DB30AC0AC761

Uniqueness

Uniqueness Score: -1.00%

Function 04FC44C8 Relevance: 1.3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

8cQh, xrefs: 04FC44DD

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID: 8cQh
API String ID: 0-3196321620
Opcode ID: 2cb6f6519e86e70b53163990b0237836445817dc1aea33a39a943299e03a8f8c
Instruction ID: fe177338e4286aa8aa878681eb29fca1fbfd8ecd41aefe80daa8b7c013fbad9a
Opcode Fuzzy Hash: 2cb6f6519e86e70b53163990b0237836445817dc1aea33a39a943299e03a8f8c
Instruction Fuzzy Hash: CB0175706047048BD314EF65E51866A77E2EFC5319B11893CD15687781CF75A80A9BE2

Uniqueness

Uniqueness Score: -1.00%

Function 04FCEF50 Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

,~g, xrefs: 04FCEF9C

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID: ,~g
API String ID: 0-1173222925
Opcode ID: 16f8ebce58b8f848a31f8fa8a2b3e9942c2a710dc9433083a2dff27d43b1a600
Instruction ID: 84f3f793c31e747eec54189d83978732030b23b3f4fc22721637aaf5b8953183
Opcode Fuzzy Hash: 16f8ebce58b8f848a31f8fa8a2b3e9942c2a710dc9433083a2dff27d43b1a600
Instruction Fuzzy Hash: D6F0F6726003055BD3109F26D68496B73DAEBC5264714883CD60A87241DF31BC09C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 09AB0CE8 Relevance: .6, Instructions: 616COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.351323722.0000000009AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9ab0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e26d14ba4a51e09dcbb73c228c97f0d27b695e5a4cc66b4f37bd24102df4bb6
Instruction ID: 4f76c56c6d1c0102e468c9d751366228d411ccea890ed98a0b565dd2570c2c5e
Opcode Fuzzy Hash: 4e26d14ba4a51e09dcbb73c228c97f0d27b695e5a4cc66b4f37bd24102df4bb6
Instruction Fuzzy Hash: 8022D4347082059FDB158B64C964ABEBBFABF85B14F15846EE5068F7A6CF30DC018B91

Uniqueness

Uniqueness Score: -1.00%

Function 09AB1FC8 Relevance: .6, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.351323722.0000000009AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9ab0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c66107a0f52474b14353b4964677800c32cbe1ce0c9cc72edfba83ca5ce181
Instruction ID: 6108bb2cfd1f6543782988ae4df61d3f7c61273b59d8f6c51e29491acc9b3fcf
Opcode Fuzzy Hash: 83c66107a0f52474b14353b4964677800c32cbe1ce0c9cc72edfba83ca5ce181
Instruction Fuzzy Hash: FC22B2787402189FDB249B14C955BFDB7B6EF88B04F00809AEA165F3A6CB71EC81CB55

Uniqueness

Uniqueness Score: -1.00%

Function 09AB0043 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.351323722.0000000009AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9ab0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e406ed2552fe4b903ce2419287739d5c4e4e1e00adf291a3b495a13f8b84376
Instruction ID: 1fe3ea017af6a6ba6be111be8fab7984c9d670034aa4303489f70c4bbe82b72b
Opcode Fuzzy Hash: 2e406ed2552fe4b903ce2419287739d5c4e4e1e00adf291a3b495a13f8b84376
Instruction Fuzzy Hash: 33C19B347002189FEB109F64D995FBE76BAEF89B05F104069EA029F3A6CB75DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 09AB063C Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.351323722.0000000009AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9ab0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26e575f535b4c8236c1a0c0086b84b9c335e81e78d4b9c6420ce3144c1a62a44
Instruction ID: 2b2fb308ef22a426bfadf3b3a5bb7a0c2c299b8b510451772c5326bbbbe756a4
Opcode Fuzzy Hash: 26e575f535b4c8236c1a0c0086b84b9c335e81e78d4b9c6420ce3144c1a62a44
Instruction Fuzzy Hash: 88B1AD34700218DFEB109F64D995FBA76BAEF99B05F004069EA029F3A6CB74DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 09AB06BA Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.351323722.0000000009AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9ab0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8614a5f4230c4c9da9a3964203bee0c8f94276bbfca52c6b99125d4b0f6672e7
Instruction ID: ddf834dfb970fae96a37330cc15040d1570df443f5c7146c36c6b98697e45344
Opcode Fuzzy Hash: 8614a5f4230c4c9da9a3964203bee0c8f94276bbfca52c6b99125d4b0f6672e7
Instruction Fuzzy Hash: B9B1AC34700218DFEB109B64D995FBE76BAEF88B05F004069EA029F3A6CB74DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 09AB05CC Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.351323722.0000000009AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9ab0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79eaa96a629027bbecb9c2a187fc46c25911f6c279fba116e2ad29bbc2f10834
Instruction ID: acdf1ef9f0d1852be2c88476aebd2d738c4a6225975a54c3684c2e23c2356781
Opcode Fuzzy Hash: 79eaa96a629027bbecb9c2a187fc46c25911f6c279fba116e2ad29bbc2f10834
Instruction Fuzzy Hash: B2B1AC34700218DFEB109F64D995FBA76BAEF99B05F004069EA029F3A6CB75DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 09AB0555 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.351323722.0000000009AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9ab0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 687f5208959b69222f87f8e85cc67debd629f0fa3e02396d0b9b11edae91ec3a
Instruction ID: 05aff2ed00becf5f156731f2bcf2773131996f256914b1fdf5013ecd194c247f
Opcode Fuzzy Hash: 687f5208959b69222f87f8e85cc67debd629f0fa3e02396d0b9b11edae91ec3a
Instruction Fuzzy Hash: 8CB19C347002189FEB109F64D995FBE76BAEF99B05F004069EA029F3A6CB75DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04FCD968 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8487651227fd8453ab32a5bcae0a653a0c18e1c178c355828e4c9a650f45feb
Instruction ID: 187ab7871a613e2b34f98b69a5b3e0f767d98b818ead39938c6c8d71e99eb768
Opcode Fuzzy Hash: c8487651227fd8453ab32a5bcae0a653a0c18e1c178c355828e4c9a650f45feb
Instruction Fuzzy Hash: B8511B35A01219EFDF14DFA5EA949ADBBB2FF89314F108029E802A7361DB35AD41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04FC2541 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b26a62d3591cb063c51706471701bf691c90bd7d7d736fc62b175c51eaa67d67
Instruction ID: bfcad7821ae728be1578752e592f97da7b58bf4d654ec7b9ca817161c49aec7d
Opcode Fuzzy Hash: b26a62d3591cb063c51706471701bf691c90bd7d7d736fc62b175c51eaa67d67
Instruction Fuzzy Hash: 0751DF74E00218CFDB08DFA5E5885ADBBB2FF89305F20816ED819AB355DB35A846CF50

Uniqueness

Uniqueness Score: -1.00%

Function 09AB3430 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.351323722.0000000009AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9ab0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40ae25048ae2b9943eaa7980f111334e43a091a363738d5de90cfd590f829125
Instruction ID: 97523927a1cdfce25c43fc798487b9821942a92fd7fd2df13fa35d14ab646e88
Opcode Fuzzy Hash: 40ae25048ae2b9943eaa7980f111334e43a091a363738d5de90cfd590f829125
Instruction Fuzzy Hash: 87513935B001189FCB14CF69C984DAEBBB6FF89710B158169F905AB362DB31ED05CB60

Uniqueness

Uniqueness Score: -1.00%

Function 04FCEE99 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9db377a7949e9a76758c53ec3743f6795d2dbe3d1b70144ce98a744db93df199
Instruction ID: cce47a1afb5c0a4aae28c7c10a1bb20e88314799c8722e9f124ae4c2339c4131
Opcode Fuzzy Hash: 9db377a7949e9a76758c53ec3743f6795d2dbe3d1b70144ce98a744db93df199
Instruction Fuzzy Hash: C651D634A0020ADFDB14DFA5DA94A9DBBB2FF88315F158469E905AB361CB35EC42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04FC2550 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 985252701b1cce34e4c2a8e24256c875c0b186409f0c18b4f80cfc7f7ac467a1
Instruction ID: 8d7aa004dd2e10e03c6d21e334c801ef09f542bfbd7cdbe86646c9e911ea0f48
Opcode Fuzzy Hash: 985252701b1cce34e4c2a8e24256c875c0b186409f0c18b4f80cfc7f7ac467a1
Instruction Fuzzy Hash: C851CF74E00218CFCB18DFA5E5885ADBBB2FF89305F20852ED819AB354DB356846CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04FC6EB6 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 775d875eaf3c8f83d1c0fd9d9d04e55bf4de36082ce65da70d6458ac8881599f
Instruction ID: 92f8dfa646b9c0e3f85e701608fb041ca62d8dc68d6c5f3a2ef122f0e109732c
Opcode Fuzzy Hash: 775d875eaf3c8f83d1c0fd9d9d04e55bf4de36082ce65da70d6458ac8881599f
Instruction Fuzzy Hash: 5A519175B042445FEB059F78D41466D7FB2EF86204F2484AEE946DB381EB34DD06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 09AB11E8 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.351323722.0000000009AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9ab0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df3270cec1c3ab509cc7bbb1ea91039a407c70be5407c0ba1ca802e94e7f7c39
Instruction ID: cf6d062029b00c15f63a09aa2f2eae4a0d8c0ac2622813faa914cbc70092a3e6
Opcode Fuzzy Hash: df3270cec1c3ab509cc7bbb1ea91039a407c70be5407c0ba1ca802e94e7f7c39
Instruction Fuzzy Hash: 784107347082055FEB505B6898B4B7E76AEAFC9B18F10447EE6028F3A2CFB1DC418751

Uniqueness

Uniqueness Score: -1.00%

Function 04FCDE60 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd24755a3d4fe5e4d171f1830d9b4906e8eecf1d9aae664410836bd9aa8be06
Instruction ID: ca9404da30fb8de87260bb9a0c35d3275b3aede4bba7b890f0b84c1d8fdfee39
Opcode Fuzzy Hash: 5cd24755a3d4fe5e4d171f1830d9b4906e8eecf1d9aae664410836bd9aa8be06
Instruction Fuzzy Hash: 1741BE31B082059FD704DB68D9646BEBBB2EF8A214F1481BED50ADB391DB31AC46C791

Uniqueness

Uniqueness Score: -1.00%

Function 04FCDB6F Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9daac15cf14b2be92db014ae11b658f07b741e5dba15539d6505f9effb91c212
Instruction ID: 5204ef51eee05d1978c95b666ecf8025d199f43f4c78dcb8c4d7f76e05127f93
Opcode Fuzzy Hash: 9daac15cf14b2be92db014ae11b658f07b741e5dba15539d6505f9effb91c212
Instruction Fuzzy Hash: E4416D71E0074A8BCB15CFA9C9405DEFBF2BF86314F14856AE805BB651E7B0A946CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04FCB090 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fece264351d6e90415797ae8f1a8940a8361416b90a14a55732301eeefacc366
Instruction ID: 4d2d3054b31c01311c6622ba6684eec74241cf0ec3b9df1ee0d64be562c9f471
Opcode Fuzzy Hash: fece264351d6e90415797ae8f1a8940a8361416b90a14a55732301eeefacc366
Instruction Fuzzy Hash: 9241F534B042499FEB04EB79E8167AE7BF2DF85304F0484BDD501DB285DB38A906CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04FC8360 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6ad96a65bc5f563104cf3b8b2a98b57de1b9d280bd6f01e3007ca136609a1a0
Instruction ID: e59902c6dbfecc45c07948fc3fe0449a4a424f9dbead4ab7926ad63ff0f3612a
Opcode Fuzzy Hash: d6ad96a65bc5f563104cf3b8b2a98b57de1b9d280bd6f01e3007ca136609a1a0
Instruction Fuzzy Hash: 14315A34B042088FD718EF69C5A8A6E7BF2EF89745F14447CE9029B3A1DB35AC02CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04FCB7F7 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39c15eb91704e9acde78525f147d7fd0bb777f00a276c989cb051bd6123a77ab
Instruction ID: 7b8d1264867c0ed874c77a80d75ad4cbbbb6faf1e2bc0420009f80747f3e87a2
Opcode Fuzzy Hash: 39c15eb91704e9acde78525f147d7fd0bb777f00a276c989cb051bd6123a77ab
Instruction Fuzzy Hash: 0A31DA31E00B468ADB10EFB9D8416D8B371EFDA320F24872AE44977601EB70B5D9CB84

Uniqueness

Uniqueness Score: -1.00%

Function 04FC85C8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da684931d6b97a47281dd2180e062779bab3df0493d6bdddacbc57472c25370
Instruction ID: 1c533e63cfb8aa65e38282ad1770da053151efb1fca9ec4a03eda796941686c5
Opcode Fuzzy Hash: 5da684931d6b97a47281dd2180e062779bab3df0493d6bdddacbc57472c25370
Instruction Fuzzy Hash: D5212334B083504FC705EB3AA11847E3BE39FC625431948BED606CBB92DF749C068792

Uniqueness

Uniqueness Score: -1.00%

Function 04FC5638 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43a12140459afc3e8acd1a9d04ac9daebdd7c9424904f8ab40f9fa309c9c9cf1
Instruction ID: 44db6dccff3f3db3343dfc3dab0aab8e39f9c3b621cb5b1c9571c9a2a33ac058
Opcode Fuzzy Hash: 43a12140459afc3e8acd1a9d04ac9daebdd7c9424904f8ab40f9fa309c9c9cf1
Instruction Fuzzy Hash: 054156B5D08218EFCF01DFA1F90A8ACBFB2FB89311F044068E511A7262D73A5956DF10

Uniqueness

Uniqueness Score: -1.00%

Function 04FC8350 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da26d113ec71e1de23763294e45ede9fe5e2c746630065f7fc98cd63122d8880
Instruction ID: f938aeed63b38d3ae16dc9ef93b9c4f015adc6ae2ed7a037fd0bdefb419b126f
Opcode Fuzzy Hash: da26d113ec71e1de23763294e45ede9fe5e2c746630065f7fc98cd63122d8880
Instruction Fuzzy Hash: D6316D34B042498FD714EF29C5A8AAE7BF2EF89351F1454ACE5029B361CB35AC46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04FCB808 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da900cab0c2263a1e15aac9528aece721a35adf7ec76a216b90d6f3036a9c77f
Instruction ID: a00c3616918cd9e7b11c28273b08ad5c29cb38f2d6f10655d49d10724b8ba068
Opcode Fuzzy Hash: da900cab0c2263a1e15aac9528aece721a35adf7ec76a216b90d6f3036a9c77f
Instruction Fuzzy Hash: EF316731E00B0A8ACB10EFB9D8416D9B371FF9A324F21872AE55977641EB70B5D4CB94

Uniqueness

Uniqueness Score: -1.00%

Function 04FC5648 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb37b96195efa32ae8f0e29011f0c4eca817ade8633ad86ad2f9e660752a38a
Instruction ID: 0a63ab64c40b6aca531b221b8854bed7c8c03bbece44e6f1de872653e9c06390
Opcode Fuzzy Hash: efb37b96195efa32ae8f0e29011f0c4eca817ade8633ad86ad2f9e660752a38a
Instruction Fuzzy Hash: BB3139B5D08319EFCF01DFA1F94A9ACBBB2FB89311F044428E611A7261DB366956DF10

Uniqueness

Uniqueness Score: -1.00%

Function 04FC8AD8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f512b8561af47f14f4f53cdcb15fface4d4e2d3f071310a091028f58c3ead643
Instruction ID: 2983f13a47628724bdd57739a5cf577474b1e114ec90b18a016857de387fdce2
Opcode Fuzzy Hash: f512b8561af47f14f4f53cdcb15fface4d4e2d3f071310a091028f58c3ead643
Instruction Fuzzy Hash: 5C31F431E00606CBCB11AFB9D5242AAB7B1EFC5301B10963EC856A3341EF74B982CB91

Uniqueness

Uniqueness Score: -1.00%

Function 09AB0FB4 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.351323722.0000000009AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9ab0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b0ea25261c514a7e88d2d4ee5dd9a2c47cc6ed98a5eb80f3b2ad58fc7356fa
Instruction ID: 470889a9f8de36a103356c25240358df730fecb192ebd0e4744983329e5d203e
Opcode Fuzzy Hash: f1b0ea25261c514a7e88d2d4ee5dd9a2c47cc6ed98a5eb80f3b2ad58fc7356fa
Instruction Fuzzy Hash: BC21F4307082449FDB058B6999209BABBFAEFC5750B1481BBE406CB2A2CB308C01C761

Uniqueness

Uniqueness Score: -1.00%

Function 04FC8AE8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92dd8eca93ee1afd0e35579cfd5ac647320b3cc259e75fc6571ac88ee95e6902
Instruction ID: f23a81899f940a75237370882a4835d0f636fe5e12158f1291bb65b7cbf5f07e
Opcode Fuzzy Hash: 92dd8eca93ee1afd0e35579cfd5ac647320b3cc259e75fc6571ac88ee95e6902
Instruction Fuzzy Hash: 1231B431F00606CBCB14AFB9D5252AAB7B1EFC5315B10962DC816A7341EF75B982CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04FCF851 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5256633f81417f3b3627cb06b287387a9d152b6bedd2ecc3a31566accf289485
Instruction ID: b409c5aa31a24b41cd8bb3d83fb0f0072aa62a4f1cc4d40fd02e158c156bad0a
Opcode Fuzzy Hash: 5256633f81417f3b3627cb06b287387a9d152b6bedd2ecc3a31566accf289485
Instruction Fuzzy Hash: DD217135B002069FDB11DF65C944AAEBBB2EF86314F14806DE9018B3A2CB31E902CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04FCBBA0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a4b313d010f1d6c0ccdf75beaab1bc5a3ccb1f570d755c8b1a3cf3820530acb
Instruction ID: 381bcd3992cbf4092089aaed0333d212979e20bd11b773674116f16fb411afd6
Opcode Fuzzy Hash: 3a4b313d010f1d6c0ccdf75beaab1bc5a3ccb1f570d755c8b1a3cf3820530acb
Instruction Fuzzy Hash: 5E21A375B08296CBC716EB3BB22B27D3FA5EB53545B05407DE053C6543DE28A807C721

Uniqueness

Uniqueness Score: -1.00%

Function 04FC403F Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 360d729e80ff797e15522d6cc408c86313694f8f8df2689dfc8398bd09e4ee7a
Instruction ID: b2073130a3b72c052c86e8c9a8cffb3238fcf3f4a51c81f437c0a5313e79f370
Opcode Fuzzy Hash: 360d729e80ff797e15522d6cc408c86313694f8f8df2689dfc8398bd09e4ee7a
Instruction Fuzzy Hash: 4221F5311092940FD705A734939849E3FF3DFD212930929BEC586CF692DE24680B9757

Uniqueness

Uniqueness Score: -1.00%

Function 04FC5830 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab5e0f22552b3d4d29c69a166a7f59e9f6986ad36e236e566dfb8e3b264bd67
Instruction ID: e21e52019151004786202447df8930d766bd43e3f04e193d5ce76bbd58a6f8cc
Opcode Fuzzy Hash: dab5e0f22552b3d4d29c69a166a7f59e9f6986ad36e236e566dfb8e3b264bd67
Instruction Fuzzy Hash: 9D21957020838A8FC721EF24D54489A77E3AF912587058E69D5458F1A5EB70BC4AC792

Uniqueness

Uniqueness Score: -1.00%

Function 04FCBBB0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1ae4caf6f7106ec93450cfb00a74a9094910e63c3f2c2b67a60125000d7cc42
Instruction ID: 5b1448b48069fc7cbc824e5ad5310bbb564231cb46d9e78fb1795245902cbbf4
Opcode Fuzzy Hash: d1ae4caf6f7106ec93450cfb00a74a9094910e63c3f2c2b67a60125000d7cc42
Instruction Fuzzy Hash: 57217175B08196CBD719DB3AB22B2793BA5DB93605F04407DE057C7683DF29E8038761

Uniqueness

Uniqueness Score: -1.00%

Function 04FC4C10 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be117480893d2fda359a888a24feffd63d3556c158b6e0f8243878338fc264c5
Instruction ID: 90b3e55420ac80b411706d9d6432b48cd0bfd68153cd29ac3c84edc52aadc87f
Opcode Fuzzy Hash: be117480893d2fda359a888a24feffd63d3556c158b6e0f8243878338fc264c5
Instruction Fuzzy Hash: D6313AB6904315EFCB01EFA0FD4A9AD7FB2FB88701F004468E6016B261D73A5966EF51

Uniqueness

Uniqueness Score: -1.00%

Function 04FCD430 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68bf0a7274ce038e59e65afa7b8f1353030efa8483b0f6f360ad2e1728dbd4e7
Instruction ID: f5029d8eec047d7cd1f8427c53ce06c5e141c8837be6d6f6defb1ea47749c6f9
Opcode Fuzzy Hash: 68bf0a7274ce038e59e65afa7b8f1353030efa8483b0f6f360ad2e1728dbd4e7
Instruction Fuzzy Hash: 1111D3317053809FC7129B39D85866A7BB3EFC2219F1448BED646CB383CAB1AC0AC711

Uniqueness

Uniqueness Score: -1.00%

Function 04FCC078 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 300ce20f8a1fce728be679c580431ac79fe4937910ae3c3bd5ed30dc744ad3bf
Instruction ID: e24ac031bb3ef6d8908d98b760a730cf643f8c1c707edb74fb866f261b210d5f
Opcode Fuzzy Hash: 300ce20f8a1fce728be679c580431ac79fe4937910ae3c3bd5ed30dc744ad3bf
Instruction Fuzzy Hash: 4C11517070470A9BC700DF35E941A6EB3F6FFC5228B144929D1059B691EB70BD4A87E5

Uniqueness

Uniqueness Score: -1.00%

Function 04FC11C0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b000b7200ca3724bbc9800c2137970a656bef030db8a12f30275aad3feb62028
Instruction ID: fbab66294f33fff4bf690ef78b5bf86e7871f85d1d46148f7e807a9e102cd484
Opcode Fuzzy Hash: b000b7200ca3724bbc9800c2137970a656bef030db8a12f30275aad3feb62028
Instruction Fuzzy Hash: E121C075E052189BCB04CFA9EA846DDBBB5FF88310F10512AE405B3251EB341941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 04FC5860 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaafe96c375f74c081232c1c61998e43ca7dc7f6d235f9d5d4f2ad0239d1bb5e
Instruction ID: fc9ec42341ab15a4683cd3875dacebb74c03f6d38497ce5ea97f3cd5fb62b92f
Opcode Fuzzy Hash: aaafe96c375f74c081232c1c61998e43ca7dc7f6d235f9d5d4f2ad0239d1bb5e
Instruction Fuzzy Hash: F911287120470EDBC720DF29D58499F73E6EF842687018E28E5558B6A4EB70FD4A87D1

Uniqueness

Uniqueness Score: -1.00%

Function 04FCD450 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5a734097aa163f416971ac93271c6e191c39b8e2d41bbe6d6a4a52c613a563
Instruction ID: cb911e866013774b5c23222abc8dc22832fb32e8d990404d3bf1676bc262db3a
Opcode Fuzzy Hash: 6e5a734097aa163f416971ac93271c6e191c39b8e2d41bbe6d6a4a52c613a563
Instruction Fuzzy Hash: 04015B317003009BD715AB76E95872AB7A7EBC621AF14583DEA4687782CFB1FC068750

Uniqueness

Uniqueness Score: -1.00%

Function 04FC4090 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee3f81be6d47341520573a75461cac672404e92abd05e31df2eaf10befe86d2
Instruction ID: 7b997c87a9fb17ac7eb801cd6f3dd8c4de618ae266e3b9ca69b5bfac4059de17
Opcode Fuzzy Hash: cee3f81be6d47341520573a75461cac672404e92abd05e31df2eaf10befe86d2
Instruction Fuzzy Hash: B301BC326012154F9688A735E34856E76E7EFC122A349683DC516CB680DF347C0B9796

Uniqueness

Uniqueness Score: -1.00%

Function 04FCC068 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d101c6a3b3058ba705787733c275c43e4117d87fa7f3467f40cd673c9bda4ee4
Instruction ID: bbfeb511578fdb8488440aeb1ee24716db1b9351cf30e1868f722c7e18124e95
Opcode Fuzzy Hash: d101c6a3b3058ba705787733c275c43e4117d87fa7f3467f40cd673c9bda4ee4
Instruction Fuzzy Hash: 1301F7316047469FC705EF75E84459E7BB6FFC2164B04496AC1058B293EB30A80A87E1

Uniqueness

Uniqueness Score: -1.00%

Function 04FCCBC0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ce014be4352cdd6d310fdafad0342f8bff171dcf51a8dfab6defdb86f910e5
Instruction ID: 67f66ce05f9507e4e47552df9504c0f4b442949850fb04e7c90d9b8c19eb336d
Opcode Fuzzy Hash: 37ce014be4352cdd6d310fdafad0342f8bff171dcf51a8dfab6defdb86f910e5
Instruction Fuzzy Hash: 3501BC382046468FC700CF2AE644C9ABBF1EF8421471684ADE546CBB72CBB0E806CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04FC7890 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed70b06abf41bc6ce7f46f5ba0c18dbc8efe1d1df72425ce6d9267fb13ba93c
Instruction ID: 4f6151c5658b7f94931ef4c9551ba40af72ae1b468da4b6a7d5ab20ed51c3fe6
Opcode Fuzzy Hash: 4ed70b06abf41bc6ce7f46f5ba0c18dbc8efe1d1df72425ce6d9267fb13ba93c
Instruction Fuzzy Hash: 38F0DC70B0D2845FC701A778A8284693FA6EB8614532904FEDA45CB392DE299C02C762

Uniqueness

Uniqueness Score: -1.00%

Function 04FC14A8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd00eede494ef295c2cfe97f1fcc27a777ef08ce21dfaff0f31dd55288fd93fd
Instruction ID: 58254e4de362b6d1c7f2868f44097a28f66403f8f6c7a7e8dc7b53bd3003e253
Opcode Fuzzy Hash: fd00eede494ef295c2cfe97f1fcc27a777ef08ce21dfaff0f31dd55288fd93fd
Instruction Fuzzy Hash: DB01E5B4D0824ADFCB01DFA4D6442AEBFB0FB09301F2045AAC405A3341E3345B55CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04FC6CD0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62262a5da3100b545c9201101d043ba32b97d3bc5ae69fe1cce6354c9da1ee0
Instruction ID: cd247bea65e993abb3985a3065dda3bd6a450c79187b356e39a13258628f4f63
Opcode Fuzzy Hash: a62262a5da3100b545c9201101d043ba32b97d3bc5ae69fe1cce6354c9da1ee0
Instruction Fuzzy Hash: 3C0181757082889FC741DB78C8188693FB6EF5620471544FEE945CB362DA36DC12CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04FCEFD0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a746b021d38df97970f91aedb9857fea4965b576d2dc6b6e802e992f8871c6ae
Instruction ID: 5ffbb3f01eccf61e9e66fdb4e3e50ad68ac8983b97a585cf82d48c8a4db3059e
Opcode Fuzzy Hash: a746b021d38df97970f91aedb9857fea4965b576d2dc6b6e802e992f8871c6ae
Instruction Fuzzy Hash: E1F0303274563647DA2016997A007FAB68DCB80FA6F05407FF60DC76C1DB5AE84293E2

Uniqueness

Uniqueness Score: -1.00%

Function 04FC3369 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e4ec3e64d9b10337ed397d75f93f2f691d929063c92e5d9e88fe6c56181db98
Instruction ID: 4b2f2038da5497668cb560ac280aca62efb39d08bd319b30ecf748cc9578f422
Opcode Fuzzy Hash: 8e4ec3e64d9b10337ed397d75f93f2f691d929063c92e5d9e88fe6c56181db98
Instruction Fuzzy Hash: A1017C30D09248EFCB01EFB8E89959C7FB1EF46204B1004FEC815EB392DA355A4ACB46

Uniqueness

Uniqueness Score: -1.00%

Function 04FCCBD0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44a29620925bf05b27ee3765bfe563a35df1e2a280d0e997b3d408a5a4a6685b
Instruction ID: 10f82ef3c9b5703fe60db75750e2de238d57e4247c29ca9cfc79609ff3414b28
Opcode Fuzzy Hash: 44a29620925bf05b27ee3765bfe563a35df1e2a280d0e997b3d408a5a4a6685b
Instruction Fuzzy Hash: 930169352006058FC754CF2AE648C9AB7E6FF84724752D469E50ACB761DBB0FD42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04FC14B8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc174e1dff1f371f60cea8eb373f19a4cde38b4e70abdfe6afa15a3790c5e84
Instruction ID: e6cb2c59298de45e741da2715562684df86c8da65a3da4b9074d4403470e7f30
Opcode Fuzzy Hash: 8fc174e1dff1f371f60cea8eb373f19a4cde38b4e70abdfe6afa15a3790c5e84
Instruction Fuzzy Hash: A901C474D0420EEFCB04DFA9D6446AEBBF0FB48301F2085AAC815A3241E7345A51CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04FC31F7 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9a9bdd21f1bd5e144e526051b35124fc7f19e7a575696710f00ae255f843234
Instruction ID: 7022632b9934612dec5edf829e19ae01ae99d02d58dc0627fbd6141eed3729c6
Opcode Fuzzy Hash: f9a9bdd21f1bd5e144e526051b35124fc7f19e7a575696710f00ae255f843234
Instruction Fuzzy Hash: DCF0E2312082805FD315A77FA8496DE3FE6DBC726074840BED95EC7383C965180ACBB1

Uniqueness

Uniqueness Score: -1.00%

Function 04FC31B1 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 456fbf548251c84a917880571fdc324b788c791c1909e331fb9ee1d9fee7c897
Instruction ID: 85987fc1540b106e9e7b807445bf5d4f1246bb2fc0f6140c8c8c94348c61b702
Opcode Fuzzy Hash: 456fbf548251c84a917880571fdc324b788c791c1909e331fb9ee1d9fee7c897
Instruction Fuzzy Hash: 8BF0B4316495900FC312A37DE8945EE7F669F9322130806BED143DB253C9060C06C766

Uniqueness

Uniqueness Score: -1.00%

Function 04FCC138 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2659388433d45fb39190d9ed7ac0f73a7cb25389f27bc7ec73e01a58e97ca9d3
Instruction ID: 91e1b43ba2d93d3f0c84b456abd3045319d369f2eb2728616875ed20ec50a438
Opcode Fuzzy Hash: 2659388433d45fb39190d9ed7ac0f73a7cb25389f27bc7ec73e01a58e97ca9d3
Instruction Fuzzy Hash: 4AF096366096D25FC312DB39D444C99BFB5AE9263030A86EEE449CB263CB14ED45C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 04FCBF38 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcb3e2a315ad912cea98efba7b26bbade6f46a6b565dbea01f76ed0fdd39e2cd
Instruction ID: 9bb4b81120a3c11324edaeae163a0e17d63d82b21a76c8ec2228e2a4e8785baf
Opcode Fuzzy Hash: bcb3e2a315ad912cea98efba7b26bbade6f46a6b565dbea01f76ed0fdd39e2cd
Instruction Fuzzy Hash: C3016D30A04659CFCB54EF69D5088EEBFF1FF89320B00456DD44AE7202DB709A09CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04FC4190 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549bfadd292d69b5e3b78d782130327f1c7d36497bebc771484d93fc4e266f86
Instruction ID: 04fbd756299f327c01abc1c1563635b65d258aa4edfc72366d8412bebe811bcc
Opcode Fuzzy Hash: 549bfadd292d69b5e3b78d782130327f1c7d36497bebc771484d93fc4e266f86
Instruction Fuzzy Hash: 670126708097458FC716DF26E408456BFF2FF8A300704857ED88683A52CB70654ACF51

Uniqueness

Uniqueness Score: -1.00%

Function 04FC4130 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b34317786ca826350dc9d16b4382343edf7eb0ccb49a1b049c0d632b9ac4a058
Instruction ID: e733625bb38c97016e046d9c310a0b563cf1b10e3f7a57489fc785271149cf00
Opcode Fuzzy Hash: b34317786ca826350dc9d16b4382343edf7eb0ccb49a1b049c0d632b9ac4a058
Instruction Fuzzy Hash: 21F0B4311097609FD711E72AE41979A7FF6DF83219F04046ED242CB643CA66680AC7A2

Uniqueness

Uniqueness Score: -1.00%

Function 04FC7908 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7f347cad78eeff32a7b66797bb1865f027e46e9d7c91bbc3b924a6b443342d
Instruction ID: 9d16cf483156b2ec99e0d9182a6b6bb5d59e7c1e8c65637b0e0183e6f0522785
Opcode Fuzzy Hash: 0a7f347cad78eeff32a7b66797bb1865f027e46e9d7c91bbc3b924a6b443342d
Instruction Fuzzy Hash: 3DF08C92B0E3D14FC71653B96D295A46FA19AD709234E40FFD181CBAE3D988980BD362

Uniqueness

Uniqueness Score: -1.00%

Function 04FC3378 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53fd1e73cea5e1222538edcac9d00c58e56100dffa310262433b82ca3c4e27f6
Instruction ID: 857f7e0e99b8b19d63e56ffd0f36c870db0b1f6b18dd6fcdb92f7942d3f24b6f
Opcode Fuzzy Hash: 53fd1e73cea5e1222538edcac9d00c58e56100dffa310262433b82ca3c4e27f6
Instruction Fuzzy Hash: ACF06930E04208EFCB40FFB4F54949C7BF1EB86204B1004B9C815A7382EA306A49CB46

Uniqueness

Uniqueness Score: -1.00%

Function 04FCBED7 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eca5cb7826e1d53fdd203a23ed8e46f3e81461e33cbd016ef7ffd33107f623da
Instruction ID: 6bd84e287812248492385c9a7e821377c236a7ea8a28fc214fcfccbb5b86ff61
Opcode Fuzzy Hash: eca5cb7826e1d53fdd203a23ed8e46f3e81461e33cbd016ef7ffd33107f623da
Instruction Fuzzy Hash: 55F05C362082585BC305177AB51644A7F5DCFC712130055BFE508CB253DA644C09C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 04FCDE5E Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f98b8bb156a5136b2c97a36d479792cff4c906e8ee654153bb5d96ae8b1122
Instruction ID: 6385a350e1aa13e2c76faf1d855d255fd7cdc13f558e3aa2457cebfffeef1538
Opcode Fuzzy Hash: 39f98b8bb156a5136b2c97a36d479792cff4c906e8ee654153bb5d96ae8b1122
Instruction Fuzzy Hash: 78F0A031B051049FD7149A6ADC48BEBFBA1EFC9320F14827ED50AC7351DAB19849C790

Uniqueness

Uniqueness Score: -1.00%

Function 04FCBF48 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9eec683ee66fe8e50043098545a36e74f7363a379beefc0ba41b5354d3e9f12
Instruction ID: 953f310beace7c1718900d8b3221708376991ac2633a527386039ed457396e03
Opcode Fuzzy Hash: f9eec683ee66fe8e50043098545a36e74f7363a379beefc0ba41b5354d3e9f12
Instruction Fuzzy Hash: 63F04470A00618CFCB40EF6AD90859EBBF4FF88320B00452AE419E3202EB70AA05CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 04FCDB3D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae3633dd5a9deee016d34501c34dac2c09da274c42daa5b97cfedbbec912ea22
Instruction ID: abd37744a9a1947659fdb36cc3263e2fadea754770f8214d9bc23528e298bed4
Opcode Fuzzy Hash: ae3633dd5a9deee016d34501c34dac2c09da274c42daa5b97cfedbbec912ea22
Instruction Fuzzy Hash: 4001F635A0521AEBDF00DB90DE84FEEBBB2BF48300F104018E801B72A2D731A941DB50

Uniqueness

Uniqueness Score: -1.00%

Function 04FC86D4 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d997406ae037e46cece6e3e12284c2450d6356361b74a92d2313c3f85ca73e
Instruction ID: a1b3bab8f8a5d7cf22ef6e50fae377ed00f8f44009ee7e17cd39d568d277c132
Opcode Fuzzy Hash: 13d997406ae037e46cece6e3e12284c2450d6356361b74a92d2313c3f85ca73e
Instruction Fuzzy Hash: 27F02E7150C7508FC310EB76EA550597FE1DE82251344CDAEC095C69E1EB70B40BD352

Uniqueness

Uniqueness Score: -1.00%

Function 04FCDF88 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a3a4523a4a41b6c9b7c9c0f09144dd614da18b948a4079bc5dc7f22200902e2
Instruction ID: bbfba4912c9cf5a545ea7c5666f313f777df6a36e42dc4e358135770913514f1
Opcode Fuzzy Hash: 8a3a4523a4a41b6c9b7c9c0f09144dd614da18b948a4079bc5dc7f22200902e2
Instruction Fuzzy Hash: B0F09670C0A3C99FCB41DFB899115ADBFB06F06210F0485AFD444D7652E2344646DBD2

Uniqueness

Uniqueness Score: -1.00%

Function 04FC85BA Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 636bec8fe1040488cee3f6f512b4499e38a0a589b1ed9559dae292ce59476caa
Instruction ID: 30860b43e1866ca097689beb7ad601b4da4e85f9b2e1e74420b24dbd531ad8d7
Opcode Fuzzy Hash: 636bec8fe1040488cee3f6f512b4499e38a0a589b1ed9559dae292ce59476caa
Instruction Fuzzy Hash: 5EE022303093850B872AA23A69004B96BA79FC32A130946BEC606CA642DF65980A83A1

Uniqueness

Uniqueness Score: -1.00%

Function 04FCC148 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0a01bca24fc540f19d07d2d6a61b031fc096845f76c9ddc5e8d69902b77df0e
Instruction ID: a49bc1e72d40a29b96158b5610945da400a52247deb6a0cb28d6a2a3da824beb
Opcode Fuzzy Hash: a0a01bca24fc540f19d07d2d6a61b031fc096845f76c9ddc5e8d69902b77df0e
Instruction Fuzzy Hash: CAF0E5377059669FC3008F29D404C49B7F9EF81734306815AE40887322CB20FD41C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 04FC3208 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81931cdc23458b5f788fd1d310f97723f67cd031996422f73325a8f0d06e218
Instruction ID: 5f5e730a5f3454768cde4e463cea741e972cd0672ad1266356c2315ebdfb03a4
Opcode Fuzzy Hash: b81931cdc23458b5f788fd1d310f97723f67cd031996422f73325a8f0d06e218
Instruction Fuzzy Hash: C1E022323002106BC300666FB948A9E7AD9DBCA325B00007DEA1EC3381CA612802CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 04FC41A0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f6aea7e8749627f4411c2d86c218e3d76708d50e6b810817f18e017abf0057c
Instruction ID: 1ab1fe0981c28fb5862ad4416389d9bffc0fc454f73adbb55ceecf7e6de6bf10
Opcode Fuzzy Hash: 8f6aea7e8749627f4411c2d86c218e3d76708d50e6b810817f18e017abf0057c
Instruction Fuzzy Hash: F0F067B0901B158FD724DF27E408556BFF2FB893057008A3EE84A82A52DB70A44ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 04FCBEE8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15b9bac2f57d9766301136b3b32f02c79e2761499611227fee97699ad5158814
Instruction ID: 8cc21da7359395dbb667058328182be60de6ee9596776f192ad14bd45304db40
Opcode Fuzzy Hash: 15b9bac2f57d9766301136b3b32f02c79e2761499611227fee97699ad5158814
Instruction Fuzzy Hash: A8E02632308218A7C30467BBB81985BBA9ED7CA225340993DFA09C3343DFB59C0193B1

Uniqueness

Uniqueness Score: -1.00%

Function 04FCB080 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af9ea0b4bd301e6e43e10a9f8cc009679a8d55ffc65bb5976c639c17e8ebfb6f
Instruction ID: a4745ae692faa29aa81b6dc5e181f1d0597cc7d978c5b6e016878921938af126
Opcode Fuzzy Hash: af9ea0b4bd301e6e43e10a9f8cc009679a8d55ffc65bb5976c639c17e8ebfb6f
Instruction Fuzzy Hash: 27E0DF30A0D2C14FD712FB79A9088D93FB58E4329078900EED889CB227DE21CC09C7A3

Uniqueness

Uniqueness Score: -1.00%

Function 04FC4140 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 059993e68a0836aadc0f0912f32505e60e54d7f98d5a1b1f80508ab4cc7a86be
Instruction ID: 8c58095cb227bc3632209d75eb4d7b0f81094003b481d29daabc32471b27919b
Opcode Fuzzy Hash: 059993e68a0836aadc0f0912f32505e60e54d7f98d5a1b1f80508ab4cc7a86be
Instruction Fuzzy Hash: 92E0ED316047648BC310EB2AE10865A7BE6EBC2318F04083DD242CB642CBA6A806CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 04FC0471 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da77b25ad80b77539f2d0af6ada57737e959abcb3fcef78b632a3cd4972f4ca
Instruction ID: 0f728ff75425555676b8a98c5801204558ed9bf215355469d67173a8f4ba39ae
Opcode Fuzzy Hash: 0da77b25ad80b77539f2d0af6ada57737e959abcb3fcef78b632a3cd4972f4ca
Instruction Fuzzy Hash: 4DE06DB5909205DFDB00EBB0FA1469E7BA0EB45209B1109AEC004AB251E7345F19DB51

Uniqueness

Uniqueness Score: -1.00%

Function 04FCB260 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a2ac1a8c80bd92ebf7abcb63fbb06ff3f29114ec4ee566832c3349c9b98f917
Instruction ID: b6e7f5173517011998776780ed124837d2107706d79d68b6ef5442f6f8996907
Opcode Fuzzy Hash: 3a2ac1a8c80bd92ebf7abcb63fbb06ff3f29114ec4ee566832c3349c9b98f917
Instruction Fuzzy Hash: E7E02B3290C3505F4706D7F494151DE3FA78D831B471501E7C50CCB242DD2A0D0583E1

Uniqueness

Uniqueness Score: -1.00%

Function 04FC0480 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61954f8cdc9c7ae019970c6479800cdf9ebcfbe5ae882fb84518ed25c23c4e52
Instruction ID: 8b2588a9fbdca623567373549f8ebb1173e37b29be458ed4d6e621de20d2f8b8
Opcode Fuzzy Hash: 61954f8cdc9c7ae019970c6479800cdf9ebcfbe5ae882fb84518ed25c23c4e52
Instruction Fuzzy Hash: 4EE04670909209EFDB10EFB4FA1569E77A8EB4420AF104AAEC404A7240EB756F14DB61

Uniqueness

Uniqueness Score: -1.00%

Function 04FC66A0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f198f0230d0ff2c20cbb4d387c889dab73e1904d92fe672eb02e66219e65e4bf
Instruction ID: fe2d9cd980eeabde6448ccddfd89db9f6e4771d68bd46cfaabcbcdee0e80c6e1
Opcode Fuzzy Hash: f198f0230d0ff2c20cbb4d387c889dab73e1904d92fe672eb02e66219e65e4bf
Instruction Fuzzy Hash: A9E02C7210C3A80FE302DB38F855C9D3BC1EB85308316498CEA44CF28AC6691E0283C3

Uniqueness

Uniqueness Score: -1.00%

Function 04FC31C0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a0dd849bccb2f80c50a5a7dc10c2409107c8947a48bfadd749cdb20ba8ddc5d
Instruction ID: a95de853d39647e0ee26b0ab457511dc810bc03f89ccd9b43f72418b76085a8f
Opcode Fuzzy Hash: 1a0dd849bccb2f80c50a5a7dc10c2409107c8947a48bfadd749cdb20ba8ddc5d
Instruction Fuzzy Hash: 75D0C231700014474514636EB5084AE3B9EEFC6122304003EE507C3241CF151C0747E5

Uniqueness

Uniqueness Score: -1.00%

Function 04FCBE90 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5984b9a1c55a162cede504d909fc57106129ed007a6371a8927c4abd649e3f43
Instruction ID: 1bedd8341c321496b94d25fa96a9cd446ec36b299e8267479a581a2ef24eaeb7
Opcode Fuzzy Hash: 5984b9a1c55a162cede504d909fc57106129ed007a6371a8927c4abd649e3f43
Instruction Fuzzy Hash: 77E0D828A0D3D84FD74ACB39E0271067F619B82615F0480DFC0458F557C62A9645C752

Uniqueness

Uniqueness Score: -1.00%

Function 04FCDF98 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc5c8370c83ae0c357d9de7aed6894856f2a64b8f1cc68fdbf81ec044babe6be
Instruction ID: 89ace9c19af7e61d84878f788476fc1c2ff6bbb86a740d33e44e3b664f9ae2e5
Opcode Fuzzy Hash: bc5c8370c83ae0c357d9de7aed6894856f2a64b8f1cc68fdbf81ec044babe6be
Instruction Fuzzy Hash: 86E092B5D0424E9F8B94EFA9D5425BEBFF4AB48200F10816AD918E3240E6345A51CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 04FCB270 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4ae5f3241116675f7a15ddbeeb491162ef23771ed68bd53833d61cd7cef2ae
Instruction ID: 2c02fd347b31412c3c68da0ae022024eb6384345fdc9dd722e03fdb1e0f02753
Opcode Fuzzy Hash: fd4ae5f3241116675f7a15ddbeeb491162ef23771ed68bd53833d61cd7cef2ae
Instruction Fuzzy Hash: 1ED022336083282B0704EAA998004CE7F9DCA84078B0100AAC70CC7200EE712A0043E6

Uniqueness

Uniqueness Score: -1.00%

Function 04FC78D8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b5d907aa4791da74b3081df91e4f9b07d471d194e584112238f56045b13d65
Instruction ID: 1c05d2703ec6413e7e81eaab2369cf7c33da5ae22384ce3a60329e100cc2f583
Opcode Fuzzy Hash: 41b5d907aa4791da74b3081df91e4f9b07d471d194e584112238f56045b13d65
Instruction Fuzzy Hash: 5ED05E3270D1D01B8302A37D79200986FA19BC609531D10FED581C77D2CC845C069366

Uniqueness

Uniqueness Score: -1.00%

Function 04FC6D18 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e33bf19aa89821b1d73fc776db9d33d2bc0ac17c60b899ccaa076bb4812bcf34
Instruction ID: 73511b1f12da1d3eb72a9361a0c32aacf0185eaba8147f6bc19bf7036bbca976
Opcode Fuzzy Hash: e33bf19aa89821b1d73fc776db9d33d2bc0ac17c60b899ccaa076bb4812bcf34
Instruction Fuzzy Hash: 6ED017362481849FCB42DB68C844C883F32BF3A21030441E9E585CF233C2628811DB00

Uniqueness

Uniqueness Score: -1.00%

Function 04FC0448 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be5c9a5b78c82a32bc01e5e407561f638362eb6b813f03ea15e153ef4ad8b34d
Instruction ID: 37184c05793bdf1fe649fbaf8bdb059266653d600572fe3bac1fba9aa6b898e1
Opcode Fuzzy Hash: be5c9a5b78c82a32bc01e5e407561f638362eb6b813f03ea15e153ef4ad8b34d
Instruction Fuzzy Hash: 58C01230819309DFCA109FA4B50872B766CE707715F40165D950853100AB755961C565

Uniqueness

Uniqueness Score: -1.00%

Function 04FCB241 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 317d41791796b23b7a9f97bb4fb1293f2598400ceb4c568aa91e2c72261755e2
Instruction ID: 8e752bcb509959df3184ce215bb530ebeb957ac1741c681c03d32b70dc66769b
Opcode Fuzzy Hash: 317d41791796b23b7a9f97bb4fb1293f2598400ceb4c568aa91e2c72261755e2
Instruction Fuzzy Hash: 51B0121006D3C30FCF0347A29D550C43F3099432113050AC6C092CB917C10A8C0FE7E3

Uniqueness

Uniqueness Score: -1.00%

Function 04FC7D29 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41686658b1e45e93b0ab262633c3a0976806a71b1b996f8bb3498e5d17e7bb1b
Instruction ID: b6fe4e29cb1ffce28e8bd139b49e4965c355b2b638a8e2df8c07c3c28e1ec7fa
Opcode Fuzzy Hash: 41686658b1e45e93b0ab262633c3a0976806a71b1b996f8bb3498e5d17e7bb1b
Instruction Fuzzy Hash: FEB0123381C07817C602D2ADBB404C4BF2084900A72E84B9AD54CCD7A39609C01342A8

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04FC5A57 Relevance: 8.9, Strings: 7, Instructions: 114COMMON

Download Yara Rule

Strings

,~g, xrefs: 04FC5AC3
,~g, xrefs: 04FC5B9F
,~g, xrefs: 04FC5AEF
,~g, xrefs: 04FC5B1B
,~g, xrefs: 04FC5B47
,~g, xrefs: 04FC5B73
,~g, xrefs: 04FC5A9A

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID: ,~g$,~g$,~g$,~g$,~g$,~g$,~g
API String ID: 0-810847461
Opcode ID: c4bc62a604e28f01485b3518cd7e23cb60538aa51a8c5275ea3dbd3a18442267
Instruction ID: d2374aa54430d1a6e548b4ce78f0cfcc861eace8f47616a963c366f4803876dc
Opcode Fuzzy Hash: c4bc62a604e28f01485b3518cd7e23cb60538aa51a8c5275ea3dbd3a18442267
Instruction Fuzzy Hash: 093108743082546BE705AB34E85563E239BFBCA168B28452DD8038B795CF396C0FA393

Uniqueness

Uniqueness Score: -1.00%

Function 04FC5E90 Relevance: 8.9, Strings: 7, Instructions: 112COMMON

Download Yara Rule

Strings

,~g, xrefs: 04FC5ED2
,~g, xrefs: 04FC5EFB
,~g, xrefs: 04FC5FAB
,~g, xrefs: 04FC5F27
,~g, xrefs: 04FC5FD7
,~g, xrefs: 04FC5F7F
,~g, xrefs: 04FC5F53

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID: ,~g$,~g$,~g$,~g$,~g$,~g$,~g
API String ID: 0-810847461
Opcode ID: 9a5e76e5c3cf312a1a59be86daed52878b44f0bbe58909b262772011fc802985
Instruction ID: 0c0d27349673994db264546d65a34eadef6724406984e77cb284871b7aaa6364
Opcode Fuzzy Hash: 9a5e76e5c3cf312a1a59be86daed52878b44f0bbe58909b262772011fc802985
Instruction Fuzzy Hash: B231CB7930C2545BE705AF34EC5163E279BEFCA164B28446DC9038B394DF396C0AA763

Uniqueness

Uniqueness Score: -1.00%

Function 04FC5EA0 Relevance: 8.9, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

,~g, xrefs: 04FC5ED2
,~g, xrefs: 04FC5EFB
,~g, xrefs: 04FC5FAB
,~g, xrefs: 04FC5F27
,~g, xrefs: 04FC5FD7
,~g, xrefs: 04FC5F7F
,~g, xrefs: 04FC5F53

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID: ,~g$,~g$,~g$,~g$,~g$,~g$,~g
API String ID: 0-810847461
Opcode ID: 33cc9f22488493e40301e6817faa24fc881a5db78ccddc85da919975a2a5221d
Instruction ID: 4f743a11223feef8861f984555cf6b0d4bad308513367bc13c76cc4b88e753fd
Opcode Fuzzy Hash: 33cc9f22488493e40301e6817faa24fc881a5db78ccddc85da919975a2a5221d
Instruction Fuzzy Hash: 3B318C7930815467E704AB74EC5163E239BEBC9164F28442DD9038B394DF397C0A63A3

Uniqueness

Uniqueness Score: -1.00%

Function 04FC5A68 Relevance: 8.9, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

,~g, xrefs: 04FC5AC3
,~g, xrefs: 04FC5B9F
,~g, xrefs: 04FC5AEF
,~g, xrefs: 04FC5B1B
,~g, xrefs: 04FC5B47
,~g, xrefs: 04FC5B73
,~g, xrefs: 04FC5A9A

Memory Dump Source

Source File: 00000001.00000002.341546528.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fc0000_vbc.jbxd

Similarity

API ID:
String ID: ,~g$,~g$,~g$,~g$,~g$,~g$,~g
API String ID: 0-810847461
Opcode ID: 2bacd3161fb2ae8f0dd63413d2969cf6976fa9f044e50fe31cea25c5bc478ce1
Instruction ID: 4201ef811d4a2ced3b7d801ca7b034a078864409536b273deae63a149d3563cc
Opcode Fuzzy Hash: 2bacd3161fb2ae8f0dd63413d2969cf6976fa9f044e50fe31cea25c5bc478ce1
Instruction Fuzzy Hash: 4931AA753081146BE704AB35F85563E239BFBCA158F28552DD9038B794DF396C0BA393

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
BlueTwelve Studio Information For Bloggers Stray Promotion on YouTube 2022.scr.exe

Function 01A859E8 Relevance: 1.8, APIs: 1, Instructions: 262
processCOMMON

Function 01A859DF Relevance: 1.8, APIs: 1, Instructions: 263
processCOMMON

Function 01A86073 Relevance: 1.6, APIs: 1, Instructions: 66
injectionCOMMON

Function 01A86078 Relevance: 1.6, APIs: 1, Instructions: 65
injectionCOMMON

Function 01A85E18 Relevance: 1.6, APIs: 1, Instructions: 61
threadinjectionCOMMON

Function 01A85ED8 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 01A85E20 Relevance: 1.6, APIs: 1, Instructions: 58
threadinjectionCOMMON

Function 01A85EE0 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Function 01A85FCB Relevance: 1.5, APIs: 1, Instructions: 49
memoryCOMMON

Function 01A85FD0 Relevance: 1.5, APIs: 1, Instructions: 48
memoryCOMMON

Function 01A861A8 Relevance: 1.5, APIs: 1, Instructions: 43
threadCOMMON

Function 01A861B0 Relevance: 1.5, APIs: 1, Instructions: 43
threadCOMMON