Edit tour

Windows Analysis Report
Notarising.exe

Overview

General Information

Sample name:	Notarising.exe
Analysis ID:	1366394
MD5:	300a85702dfee48866e544b5177704a0
SHA1:	c7056786da7a23171255d0f006a6b3e86bede0d2
SHA256:	f199aff3254f8943d2f616782a1fb4c5f69f0a6faa0325a10781be8a2fdb77ff
Tags:	exeredlinestealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Notarising.exe (PID: 4456 cmdline: C:\Users\user\Desktop\Notarising.exe MD5: 300A85702DFEE48866E544B5177704A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/ https://bartblaze.blogspot.com/2021/06/digital-artists-targeted-in-redline.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "195.20.16.188:20749", "Bot Id": "LogsDiller Cloud (Telegram: @logsdillabot)", "Authorization Header": "c2955ed3813a798683a185a82e949f88"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2330284235.0000000000E12000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2333325033.0000000003E24000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: Notarising.exe PID: 4456	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Notarising.exe PID: 4456	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Notarising.exe.e10000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Snort Signatures

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 195.20.16.188

Timestamp:	192.168.2.5195.20.16.18849704207492046045 12/22/23-21:25:08.288793
SID:	2046045
Source Port:	49704
Destination Port:	20749
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.5 - Destination IP: 195.20.16.188

Timestamp:	192.168.2.5195.20.16.18849704207492043231 12/22/23-21:25:24.427320
SID:	2043231
Source Port:	49704
Destination Port:	20749
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer Family Activity (Response) - Source IP: 195.20.16.188 - Destination IP: 192.168.2.5

Timestamp:	195.20.16.188192.168.2.520749497042046056 12/22/23-21:25:14.003688
SID:	2046056
Source Port:	20749
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 195.20.16.188 - Destination IP: 192.168.2.5

Timestamp:	195.20.16.188192.168.2.520749497042043234 12/22/23-21:25:08.615062
SID:	2043234
Source Port:	20749
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: 195.20.16.188:20749

Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "195.20.16.188:20749", "Bot Id": "LogsDiller Cloud (Telegram: @logsdillabot)", "Authorization Header": "c2955ed3813a798683a185a82e949f88"}

Multi AV Scanner detection for submitted file

Source: Notarising.exe

ReversingLabs: Detection: 67%

Machine Learning detection for sample

Source: Notarising.exe

Joe Sandbox ML: detected

Source: Notarising.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source:

Binary string: Z:\Oreans Projects\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: Notarising.exe, 00000000.00000002.2330383938.0000000000E82000.00000040.00000001.01000000.00000003.sdmp

Source: C:\Users\user\Desktop\Notarising.exe	Code function: 4x nop then jmp 078375BBh	0_2_07836750
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 4x nop then jmp 07831A22h	0_2_07831278
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 4x nop then jmp 078383C0h	0_2_07837EE0
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 4x nop then jmp 07832D83h	0_2_07832B50
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 4x nop then jmp 078356F1h	0_2_078356D9
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 4x nop then jmp 078322EFh	0_2_07831F10
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 4x nop then jmp 078322EFh	0_2_07831F20
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	0_2_07B67768
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 4x nop then jmp 07B6563Ah	0_2_07B65218
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 4x nop then jmp 07B65ABAh	0_2_07B65218
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 4x nop then jmp 07B6343Ah	0_2_07B63188
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 4x nop then jmp 07B64935h	0_2_07B64914

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:49704 -> 195.20.16.188:20749
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.5:49704 -> 195.20.16.188:20749
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 195.20.16.188:20749 -> 192.168.2.5:49704
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer Family Activity (Response) 195.20.16.188:20749 -> 192.168.2.5:49704

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 195.20.16.188:20749

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 195.20.16.188 ports 20749,0,2,4,7,9

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 195.20.16.188:20749

Source: Joe Sandbox View

ASN Name: EITADAT-ASFI EITADAT-ASFI

Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.20.16.188

Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: Notarising.exe, 00000000.00000002.2332679589.000000000355E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purl.oen
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000004214000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000004214000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, Notarising.exe, 00000000.00000002.2333325033.0000000004280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000004280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000004280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000004280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000004280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000004214000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, Notarising.exe, 00000000.00000002.2333325033.0000000004280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000004280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, Notarising.exe, 00000000.00000002.2333325033.0000000003E24000.00000004.00000800.00020000.00000000.sdmp, Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000004280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000004280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000004214000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, Notarising.exe, 00000000.00000002.2333325033.0000000004280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, Notarising.exe, 00000000.00000002.2333325033.0000000003E63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000004280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: Notarising.exe, 00000000.00000002.2336508256.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Notarising.exe, Notarising.exe, 00000000.00000002.2330284235.0000000000E12000.00000040.00000001.01000000.00000003.sdmp, Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: Notarising.exe, 00000000.00000002.2336508256.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Notarising.exe, 00000000.00000002.2336508256.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Notarising.exe, 00000000.00000002.2336508256.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Notarising.exe, 00000000.00000002.2336508256.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Notarising.exe, 00000000.00000002.2336508256.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Notarising.exe, 00000000.00000002.2336508256.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Notarising.exe, 00000000.00000002.2336508256.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Notarising.exe, 00000000.00000002.2336508256.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

PE file contains section with special chars

Source: Notarising.exe	Static PE information: section name:
Source: Notarising.exe	Static PE information: section name:
Source: Notarising.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_03C3DCD4	0_2_03C3DCD4
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07836750	0_2_07836750
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07834688	0_2_07834688
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07833430	0_2_07833430
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07830438	0_2_07830438
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07831278	0_2_07831278
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07834048	0_2_07834048
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07837EE0	0_2_07837EE0
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07839E20	0_2_07839E20
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_0783AE28	0_2_0783AE28
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07834DF0	0_2_07834DF0
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07835C81	0_2_07835C81
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_078308A0	0_2_078308A0
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07834678	0_2_07834678
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07830429	0_2_07830429
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_0783403E	0_2_0783403E
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07831F10	0_2_07831F10
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07831F20	0_2_07831F20
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07B67768	0_2_07B67768
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07B63C68	0_2_07B63C68
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07B65218	0_2_07B65218
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07B69A58	0_2_07B69A58
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07B63188	0_2_07B63188
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07B649C8	0_2_07B649C8
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07B620C9	0_2_07B620C9
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07B67759	0_2_07B67759
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07B60E6A	0_2_07B60E6A
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07B65DE8	0_2_07B65DE8
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07B61518	0_2_07B61518
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07B65207	0_2_07B65207
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07B649B8	0_2_07B649B8
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07B61980	0_2_07B61980
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07B67118	0_2_07B67118
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07B61970	0_2_07B61970
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07B60006	0_2_07B60006
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07B60808	0_2_07B60808
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_07B60040	0_2_07B60040

Source: Notarising.exe	Binary or memory string: OriginalFilename vs Notarising.exe
Source: Notarising.exe, 00000000.00000002.2333325033.0000000003E63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Notarising.exe
Source: Notarising.exe, 00000000.00000002.2332131345.000000000196E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Notarising.exe

Source: Notarising.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: Notarising.exe	Static PE information: Section: ZLIB complexity 0.9982143282302802
Source: Notarising.exe	Static PE information: Section: ZLIB complexity 0.9980615373770838
Source: Notarising.exe	Static PE information: Section: ZLIB complexity 1.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/1@0/1

Source: C:\Users\user\Desktop\Notarising.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Users\user\Desktop\Notarising.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\Notarising.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\Notarising.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\Notarising.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Notarising.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Notarising.exe

ReversingLabs: Detection: 67%

Source: C:\Users\user\Desktop\Notarising.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Notarising.exe

Static file information: File size 4310025 > 1048576

Source: Notarising.exe

Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x3e3809

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\Notarising.exe

Unpacked PE file: 0.2.Notarising.exe.e10000.0.unpack :ER; :R; :R;.imports:W;.rsrc:R;.themida:EW;.boot:ER; vs :ER; :R;

Source: Notarising.exe

Static PE information: 0x9B423614 [Wed Jul 17 05:41:40 2052 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: Notarising.exe	Static PE information: section name:
Source: Notarising.exe	Static PE information: section name:
Source: Notarising.exe	Static PE information: section name:
Source: Notarising.exe	Static PE information: section name: .imports
Source: Notarising.exe	Static PE information: section name: .themida
Source: Notarising.exe	Static PE information: section name: .boot

Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_011EEB2F push 05A4385Ch; mov dword ptr [esp], ebx	0_2_011EEAB6
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_011EEB2F push 6E4B276Ah; mov dword ptr [esp], eax	0_2_011EEADA
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_011FE91F push eax; mov dword ptr [esp], edi	0_2_011FE8F0
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_011FE91F push edi; mov dword ptr [esp], 64E3572Eh	0_2_011FE903
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_01199918 push edx; mov dword ptr [esp], eax	0_2_0119993F
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_01199918 push 3FB833B4h; mov dword ptr [esp], ecx	0_2_0119997D
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_0116E915 push edi; mov dword ptr [esp], ecx	0_2_0116E8AB
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_0116F112 push 357183D8h; mov dword ptr [esp], ebp	0_2_0116F0EF
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_0116F112 push edx; mov dword ptr [esp], 717009DAh	0_2_0116F0FD
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_0116F112 push 54163B9Bh; mov dword ptr [esp], ebp	0_2_0116F126
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_011A691C push ebp; mov dword ptr [esp], ecx	0_2_011A6940
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_011A691C push eax; mov dword ptr [esp], 75C73679h	0_2_011A6953
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_011E0915 push ebp; mov dword ptr [esp], ecx	0_2_011E0933
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_01155119 push edi; mov dword ptr [esp], ebx	0_2_01155113
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_01155119 push 3F647DC6h; mov dword ptr [esp], edi	0_2_01155130
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_01164918 push 1FD5431Dh; mov dword ptr [esp], ecx	0_2_01164871
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_01164918 push 11B0E4EAh; mov dword ptr [esp], ecx	0_2_0116488B
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_01164918 push eax; mov dword ptr [esp], 02274B64h	0_2_011648A6
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_01164918 push edi; mov dword ptr [esp], ebx	0_2_01164911
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_01164918 push edi; mov dword ptr [esp], ebx	0_2_0116494B
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_011D8108 push 3DB7ED35h; mov dword ptr [esp], esp	0_2_011D8CBA
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_011D8108 push 6C80F259h; mov dword ptr [esp], eax	0_2_011D8CC2
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_011B2902 push edx; mov dword ptr [esp], 093D8DB6h	0_2_011B2916
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_011B2902 push esi; mov dword ptr [esp], ecx	0_2_011B2928
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_011B2902 push edx; mov dword ptr [esp], 499B0554h	0_2_011B2943
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_011A0900 push 6F4792F8h; mov dword ptr [esp], edx	0_2_011A0925
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_0116F137 push 0B532DBEh; mov dword ptr [esp], edi	0_2_0116F159
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_0116F137 push edx; mov dword ptr [esp], ecx	0_2_0116F186
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_011D3936 push esi; mov dword ptr [esp], ecx	0_2_011D397D
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_011D9131 push 07912C68h; mov dword ptr [esp], ebx	0_2_011D912B
Source: C:\Users\user\Desktop\Notarising.exe	Code function: 0_2_011D9131 push ecx; mov dword ptr [esp], 70F9F6F7h	0_2_011D91A5

Source: initial sample

Static PE information: section name: entropy: 7.962888780247569

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\Notarising.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Notarising.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Notarising.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Notarising.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\Notarising.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Jump to behavior

Source: C:\Users\user\Desktop\Notarising.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\Notarising.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\Notarising.exe	Window / User API: threadDelayed 1692			Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Window / User API: threadDelayed 5194			Jump to behavior

Source: C:\Users\user\Desktop\Notarising.exe TID: 2148	Thread sleep time: -24903104499507879s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe TID: 5676	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\Notarising.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Notarising.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Notarising.exe, 00000000.00000002.2332131345.0000000001A43000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll)
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Notarising.exe, 00000000.00000002.2336508256.000000000518C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Notarising.exe, 00000000.00000002.2336508256.0000000005376000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Users\user\Desktop\Notarising.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\Notarising.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\Notarising.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\Notarising.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\Notarising.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\Notarising.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\Notarising.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\Notarising.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\Notarising.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\Notarising.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\Notarising.exe

Code function: 0_2_07836750 LdrInitializeThunk,

0_2_07836750

Source: C:\Users\user\Desktop\Notarising.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Notarising.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Notarising.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Notarising.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Notarising.exe, 00000000.00000002.2345531251.0000000006B6E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Notarising.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\Notarising.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\Notarising.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\Notarising.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\Notarising.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\Notarising.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.Notarising.exe.e10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2330284235.0000000000E12000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2333325033.0000000003E24000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Notarising.exe PID: 4456, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Notarising.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Notarising.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Notarising.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior

Source: Yara match

File source: Process Memory Space: Notarising.exe PID: 4456, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.Notarising.exe.e10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2330284235.0000000000E12000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2333325033.0000000003E24000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Notarising.exe PID: 4456, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	221 Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	1 OS Credential Dumping	751 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	1 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	551 Virtualization/Sandbox Evasion	Security Account Manager	551 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	Protocol Impersonation			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	114 System Information Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Notarising.exe	68%	ReversingLabs	Win32.Trojan.Privateloader
Notarising.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://purl.oen	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
195.20.16.188:20749	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17ResponseD	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
195.20.16.188:20749	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	Notarising.exe, 00000000.00000002.2336508256.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Notarising.exe, 00000000.00000002.2336508256.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id14ResponseD	Notarising.exe, 00000000.00000002.2333325033.0000000004214000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	Notarising.exe, 00000000.00000002.2333325033.0000000004280000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, Notarising.exe, 00000000.00000002.2333325033.0000000004280000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	Notarising.exe, 00000000.00000002.2333325033.0000000004280000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://purl.oen	Notarising.exe, 00000000.00000002.2332679589.000000000355E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13ResponseD	Notarising.exe, 00000000.00000002.2333325033.0000000003E63000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	Notarising.exe, 00000000.00000002.2333325033.0000000003E63000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Notarising.exe, 00000000.00000002.2333325033.0000000003E63000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	Notarising.exe, Notarising.exe, 00000000.00000002.2330284235.0000000000E12000.00000040.00000001.01000000.00000003.sdmp, Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1ResponseD	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Notarising.exe, 00000000.00000002.2336508256.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id20	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	Notarising.exe, 00000000.00000002.2336508256.0000000004DCB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1Response	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21ResponseD	Notarising.exe, 00000000.00000002.2333325033.0000000004214000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	Notarising.exe, 00000000.00000002.2333325033.0000000003E63000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, Notarising.exe, 00000000.00000002.2333325033.0000000004280000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15ResponseD	Notarising.exe, 00000000.00000002.2333325033.0000000003E63000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id11ResponseD	Notarising.exe, 00000000.00000002.2333325033.0000000004214000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	Notarising.exe, 00000000.00000002.2333325033.0000000003D91000.00000004.00000800.00020000.00000000.sdmp, Notarising.exe, 00000000.00000002.2333325033.0000000003E63000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	Notarising.exe, 00000000.00000002.2333325033.0000000003E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	Notarising.exe, 00000000.00000002.2333325033.0000000003E24000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17ResponseD	Notarising.exe, 00000000.00000002.2333325033.0000000004280000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
195.20.16.188	unknown	Finland		42297	EITADAT-ASFI	true

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1366394
Start date and time:	2023-12-22 21:24:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Notarising.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 69% Number of executed functions: 39 Number of non-executed functions: 18
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Notarising.exe

Simulations

Behavior and APIs

Time	Type	Description
21:25:19	API Interceptor	36x Sleep call for process: Notarising.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EITADAT-ASFI	fY2HAd4r9I.exe	Get hash	malicious	Amadey, Easy Stealer, LummaC Stealer, RHADAMANTHYS, RedLine, SmokeLoader, zgRAT	Browse	195.20.16.103
	ABHRDIL8cm.exe	Get hash	malicious	Amadey, LummaC Stealer, RedLine, SmokeLoader, zgRAT	Browse	195.20.16.103
	qmJ59GSETt.exe	Get hash	malicious	Amadey, LummaC Stealer, RedLine, SmokeLoader, zgRAT	Browse	195.20.16.103
	Xu9HaBSiIJ.exe	Get hash	malicious	Amadey, LummaC Stealer, RedLine, SmokeLoader, zgRAT	Browse	195.20.16.103
	QGShkK4MMl.exe	Get hash	malicious	Amadey, LummaC Stealer, RedLine, RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	195.20.16.103
	sEWX47oH4X.exe	Get hash	malicious	Amadey, LummaC Stealer, RedLine, SmokeLoader, zgRAT	Browse	195.20.16.103
	zXGs3AGQSn.exe	Get hash	malicious	Amadey, LummaC Stealer, RedLine, SmokeLoader, zgRAT	Browse	195.20.16.103
	0dzdkSIbp0.exe	Get hash	malicious	Amadey, LummaC Stealer, RedLine, SmokeLoader, zgRAT	Browse	195.20.16.103
	NFcNdFBTH9.exe	Get hash	malicious	Amadey, LummaC Stealer, RedLine, SmokeLoader, zgRAT	Browse	195.20.16.103
	1vZX9U5Diw.exe	Get hash	malicious	Amadey, LummaC Stealer, RedLine, RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	195.20.16.103
	QrHAH5Dt6l.exe	Get hash	malicious	Amadey, LummaC Stealer, RedLine, SmokeLoader, zgRAT	Browse	195.20.16.103
	zFZmNLWVfM.exe	Get hash	malicious	Amadey, LummaC Stealer, RedLine, SmokeLoader, zgRAT	Browse	195.20.16.103
	zB6UeFurbf.exe	Get hash	malicious	Amadey, LummaC Stealer, RHADAMANTHYS, RedLine, SmokeLoader, zgRAT	Browse	195.20.16.103
	7ykYy4WbzK.exe	Get hash	malicious	Amadey, LummaC Stealer, RHADAMANTHYS, RedLine, SmokeLoader, zgRAT	Browse	195.20.16.103
	U1MiP25NrU.exe	Get hash	malicious	Amadey, Glupteba, LummaC Stealer, RedLine, SmokeLoader, Stealc, Vidar	Browse	195.20.16.103
	G9rPCOOUlU.exe	Get hash	malicious	Amadey, LummaC Stealer, RedLine, SmokeLoader, zgRAT	Browse	195.20.16.103
	OYSVIdqcxa.exe	Get hash	malicious	Glupteba, LummaC Stealer, RedLine, SmokeLoader, zgRAT	Browse	195.20.16.103
	2OcriJkWk6.exe	Get hash	malicious	Glupteba, LummaC Stealer, RedLine, SmokeLoader, zgRAT	Browse	195.20.16.103
	lPUOqVqw1D.exe	Get hash	malicious	Glupteba, LummaC Stealer, RedLine, SmokeLoader, zgRAT	Browse	195.20.16.103
	OE9ZntaKqM.exe	Get hash	malicious	Glupteba, LummaC Stealer, RedLine, SmokeLoader, zgRAT	Browse	195.20.16.103

Process:	C:\Users\user\Desktop\Notarising.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	2A56468A7C0F324A42EA599BF0511FAF
SHA1:	404B343A86EDEDF5B908D7359EB8AA957D1D4333
SHA-256:	6398E0BD46082BBC30008BC72A2BA092E0A1269052153D343AA40F935C59957C
SHA-512:	19B79181C40AA51C7ECEFCD4C9ED42D5BA19EA493AE99654D3A763EA9B21B1ABE5B5739AAC425E461609E1165BCEA749CFB997DE0D35303B4CF2A29BDEF30B17
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.898682470370749
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Notarising.exe
File size:	4'310'025 bytes
MD5:	300a85702dfee48866e544b5177704a0
SHA1:	c7056786da7a23171255d0f006a6b3e86bede0d2
SHA256:	f199aff3254f8943d2f616782a1fb4c5f69f0a6faa0325a10781be8a2fdb77ff
SHA512:	d97cb38af00e018849fdba3f414a4778ebe053ea15bbff80da5c935c09b524009a451ace6299bace4884560893c1158c66bda54f9c2d53ab14334ea5430f7438
SSDEEP:	98304:yEyHI/4IRUMVp3W8T72Ic/PvCqvTIOKTQqLCbLDeNV:y1Hu4VxjCqvEPLuaNV
TLSH:	93163310F9E81866D01493B8977BCB32BD700E540974D28277E83FB33D3A6EA1B9557A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6B...............0.............X.a.. ... ....@.. ...............................zB...@................................

File Icon


Icon Hash:	4d8ea38d85a38e6d

Static PE Info

General

Entrypoint:	0xa1c058
Entrypoint Section:	.boot
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x9B423614 [Wed Jul 17 05:41:40 2052 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	4328f7206db519cd4e82283211d98e83

Entrypoint Preview

Instruction
call 00007F973CB92430h
push ebx
mov ebx, esp
push ebx
mov esi, dword ptr [ebx+08h]
mov edi, dword ptr [ebx+10h]
cld
mov dl, 80h
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007F973CB922E7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F973CB922CCh
add dl, dl
jne 00007F973CB922E7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F973CB92333h
xor eax, eax
add dl, dl
jne 00007F973CB922E7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F973CB923C7h
add dl, dl
jne 00007F973CB922E7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F973CB922E7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F973CB922E7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F973CB922E7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
je 00007F973CB922EAh
push edi
mov eax, eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
jmp 00007F973CB9227Bh
mov eax, 00000001h
add dl, dl
jne 00007F973CB922E7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F973CB922E7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007F973CB922CCh
sub eax, ebx
mov ebx, 00000001h
jne 00007F973CB9230Ah
mov ecx, 00000001h
add dl, dl
jne 00007F973CB922E7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 00007F973CB922E7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007F973CB922CCh
push esi
mov esi, edi
sub esi, ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5203a	0x50	.imports
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x54000	0x1c9d0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x30000	0x14822	False	0.9982143282302802	data	7.962888780247569	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x32000	0x1c9d0	0x6ed5	False	0.9980615373770838	data	7.948171750237992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x50000	0xc	0x10	False	1.5	data	3.875	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.imports	0x52000	0x2000	0x200	False	0.16796875	data	1.1405531534676816	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x54000	0x1ca00	0x1ca00	False	0.23824713427947597	data	2.6159893076126157	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.themida	0x72000	0x5aa000	0x0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0x61c000	0x3e3a00	0x3e3809	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x541a0	0x3d04	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9934058898847631
RT_ICON	0x57eb4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m			0.09013072282030049
RT_ICON	0x686ec	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m			0.13905290505432216
RT_ICON	0x6c924	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m			0.17033195020746889
RT_ICON	0x6eedc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m			0.2045028142589118
RT_ICON	0x6ff94	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m			0.24645390070921985
RT_GROUP_ICON	0x7040c	0x5a	data			0.7666666666666667
RT_VERSION	0x70478	0x35a	data			0.4428904428904429
RT_MANIFEST	0x707e4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	English	United States	0.5489795918367347

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.5195.20.16.18849704207492046045 12/22/23-21:25:08.288793	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	49704	20749	192.168.2.5	195.20.16.188
192.168.2.5195.20.16.18849704207492043231 12/22/23-21:25:24.427320	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49704	20749	192.168.2.5	195.20.16.188
195.20.16.188192.168.2.520749497042046056 12/22/23-21:25:14.003688	TCP	2046056	ET TROJAN Redline Stealer Family Activity (Response)	20749	49704	195.20.16.188	192.168.2.5
195.20.16.188192.168.2.520749497042043234 12/22/23-21:25:08.615062	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	20749	49704	195.20.16.188	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2023 21:25:07.573659897 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:07.897528887 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:07.897830963 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:07.920516968 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:08.245109081 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:08.288793087 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:08.615061998 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:08.829756021 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:13.677577019 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:14.003688097 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:14.003741026 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:14.003813982 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:14.003873110 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:14.048388004 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:14.175782919 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:14.500022888 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:14.548433065 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:14.610325098 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:14.933931112 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:14.933948994 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:14.934087992 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:14.934400082 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:14.934458971 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:14.934468985 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:15.257713079 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:15.257781029 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:15.260581970 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:15.314019918 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:15.361864090 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:15.685625076 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:15.685667038 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:15.685777903 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:15.685978889 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:15.686007977 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:15.686058998 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:15.686130047 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:15.686199903 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:15.686285019 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:15.686350107 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:15.686410904 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:15.686487913 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:15.687088966 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:15.687154055 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:15.687211037 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:15.687247992 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:15.687289000 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:15.687289953 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:15.687330008 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:15.687375069 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:15.687843084 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:15.687918901 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:15.727366924 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:15.727443933 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.009742975 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.009825945 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.009872913 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.010003090 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.010447979 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.010509968 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.011409998 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.011437893 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.011466980 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.011475086 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.011498928 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.011503935 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.011514902 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.011529922 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.011559963 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.011583090 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.011598110 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.011630058 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.011641026 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.011686087 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.011743069 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.011766911 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.011811018 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.011869907 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.011917114 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.011989117 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.012001991 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.012047052 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.012069941 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.012115955 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.012264967 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.012310982 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.012494087 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.012598038 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.051304102 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.334284067 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.334309101 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.334322929 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.334408045 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.334419966 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.334685087 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.335005999 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.335206032 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.335304022 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.335586071 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.335655928 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.335920095 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.336167097 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.336430073 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.336585999 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.336625099 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.336760044 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.336900949 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.336914062 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.337213039 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.337321997 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.337467909 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.337939024 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.338253975 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.338310003 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.338515997 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.338746071 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.338850021 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.338983059 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.339081049 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.339215994 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.339313984 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.340044975 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.340065956 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.340559959 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.346357107 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.346496105 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.660353899 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.660393953 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.660505056 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.660693884 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.660832882 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.660991907 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.661324024 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.661334991 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.661498070 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.661735058 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.662127972 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.662400007 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.662647009 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.662831068 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.663013935 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.663022995 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.663256884 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.663522959 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.663718939 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.663834095 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.670263052 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.670367002 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.670603037 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.670681000 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.670747042 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.670757055 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.671122074 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.671397924 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.671662092 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.671699047 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.671708107 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.671974897 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.672101021 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.672277927 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.672400951 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.672609091 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.672822952 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.673084021 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.673135042 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.673358917 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.673501968 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.673597097 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.674715042 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.674737930 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.674750090 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.674803972 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.674818993 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.674828053 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.675052881 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.675122976 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.994453907 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.994494915 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.994618893 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.994630098 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.994688034 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.994699001 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.994956970 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.994967937 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.995177031 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.995462894 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.995490074 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.995533943 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.995839119 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.995850086 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.995862007 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.995872974 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.996093035 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.996104002 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.996186018 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.996690989 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.996889114 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:16.998686075 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.998697042 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.999011040 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.999083996 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.999253035 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.999511957 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.999522924 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.999532938 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.999543905 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.999670029 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.999701023 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.999862909 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.999970913 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:16.999982119 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.000134945 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.000230074 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.000432968 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.000442982 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.000710011 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:17.000842094 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:17.320559978 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.320580959 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.320590973 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.320602894 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.320615053 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.320626020 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.320636034 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.320739031 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.320861101 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.320981979 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.320991993 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.321254015 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.321264029 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.321317911 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.321608067 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.321624041 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.321633101 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.321744919 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.321757078 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.321784019 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.324213982 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.324246883 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.324285984 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.324371099 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.324382067 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.324533939 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.324599981 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.324610949 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.324621916 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.324686050 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:17.324794054 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:17.324796915 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.324810028 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.324928999 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.324968100 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.324976921 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.325094938 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.325210094 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.325231075 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.325243950 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.325623989 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.325633049 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.325663090 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.325673103 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.325726986 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.325737000 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.325937986 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:17.649024963 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.649066925 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.649080038 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.649085045 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.649260998 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.649272919 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.649430990 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.651612043 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.651652098 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.652040958 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.652095079 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.652108908 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.652993917 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.653065920 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.653131008 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.653179884 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.653250933 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.653295994 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.653362989 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.653439999 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.653459072 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.653517962 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.653561115 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.653634071 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.653722048 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.653757095 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.653820038 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.654114962 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.655105114 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.655143023 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.655205965 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.657242060 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:17.704658985 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:17.773237944 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:18.098278999 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:18.101466894 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:18.425831079 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:18.455738068 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:18.780354023 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:18.793529987 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:19.119817972 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:19.173377037 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:19.262480974 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:19.586657047 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:19.642175913 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:20.143096924 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:20.468810081 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:20.474112988 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:20.798297882 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:20.802078009 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:21.126342058 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:21.137904882 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:21.461714029 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:21.461735964 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:21.462385893 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:21.517139912 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:21.538460970 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:21.862862110 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:21.865159035 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:22.195867062 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:22.203830004 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:22.528939962 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:22.583772898 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:22.635178089 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:22.964411974 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:22.966109037 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:23.290375948 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:23.345283031 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:23.513709068 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:23.839382887 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:23.839931965 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:24.164602995 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:24.220299959 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:24.427320004 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:24.754410982 CET	20749	49704	195.20.16.188	192.168.2.5
Dec 22, 2023 21:25:24.798388958 CET	49704	20749	192.168.2.5	195.20.16.188
Dec 22, 2023 21:25:24.819478989 CET	49704	20749	192.168.2.5	195.20.16.188

Target ID:	0
Start time:	21:24:49
Start date:	22/12/2023
Path:	C:\Users\user\Desktop\Notarising.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Notarising.exe
Imagebase:	0xe10000
File size:	4'310'025 bytes
MD5 hash:	300A85702DFEE48866E544B5177704A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2330284235.0000000000E12000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2333325033.0000000003E24000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	14.2%
Dynamic/Decrypted Code Coverage:	87.2%
Signature Coverage:	8.5%
Total number of Nodes:	47
Total number of Limit Nodes:	6

Executed Functions

Function 07839E20 Relevance: 6.6, Strings: 5, Instructions: 301
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 0783A180
Haq, xrefs: 0783A0F2
Haq, xrefs: 0783A090
Haq, xrefs: 0783A139
Haq, xrefs: 0783A0C1

Memory Dump Source

Source File: 00000000.00000002.2346110119.0000000007830000.00000040.00000800.00020000.00000000.sdmp, Offset: 07830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7830000_Notarising.jbxd

Similarity

API ID:
String ID: Haq$Haq$Haq$Haq$Haq
API String ID: 0-1792267638
Opcode ID: 20a32d78ccb08e81d93529a5ad5a47f6df56f8037c932628416d5bbb267a1c89
Instruction ID: 42038e76c55da335bd98d1a87e421b7d0493aebe65747c4ac5eb74991f68469a
Opcode Fuzzy Hash: 20a32d78ccb08e81d93529a5ad5a47f6df56f8037c932628416d5bbb267a1c89
Instruction Fuzzy Hash: C2C1C175A00356CBCB15DF78C0502ADFBB2FF95305F24866AD446EF241DBB8AA85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07B65218 Relevance: 5.5, Strings: 4, Instructions: 496
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 07B659B1
$]q, xrefs: 07B65601
$]q, xrefs: 07B6553D
$]q, xrefs: 07B65A7E

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 5380842c269341884637352924731ba888af8ddca70564374cf5f62515dabd7d
Instruction ID: e1c68e8e5b0814d1e9d20828a8b7ec739670cefb29fca50ca766255a35568a5b
Opcode Fuzzy Hash: 5380842c269341884637352924731ba888af8ddca70564374cf5f62515dabd7d
Instruction Fuzzy Hash: D332B274A01229CFDB69DF64C994BDEB7B2BF49300F5085E9C10AAB250DB359E85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 07B67768 Relevance: 5.3, Strings: 4, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 07B67903
$]q, xrefs: 07B679B3
$]q, xrefs: 07B67919
$]q, xrefs: 07B679C9

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 41ac134fc1fa4943f98d69bb8fbb02ab67b09b7c0f7347206138d45da4a720b6
Instruction ID: e555e84032ce71dcf5a1482de641796d57e468b0288108c4817a9edb84be7738
Opcode Fuzzy Hash: 41ac134fc1fa4943f98d69bb8fbb02ab67b09b7c0f7347206138d45da4a720b6
Instruction Fuzzy Hash: 74C1E5B4E00218CFDB68DFA5C99479DBBB2FF89304F6084A9D509AB254DB345D86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 07837EE0 Relevance: 2.9, Strings: 2, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1, xrefs: 078381DD
., xrefs: 07838158

Memory Dump Source

Source File: 00000000.00000002.2346110119.0000000007830000.00000040.00000800.00020000.00000000.sdmp, Offset: 07830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7830000_Notarising.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: f5dcce1c39061d2f240e880e2c339479f7e830981635d4bfe4ebeb7534aefdb8
Instruction ID: 006e23151394305cc0656b0e4838bbcef86a3146d6045cba5ba10485e4d7793f
Opcode Fuzzy Hash: f5dcce1c39061d2f240e880e2c339479f7e830981635d4bfe4ebeb7534aefdb8
Instruction Fuzzy Hash: 7AF1F074E01328CFDB69DF64C884B9DBBB2BF89305F1081A9D50AAB250DB755E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07B620C9 Relevance: 2.8, Strings: 2, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 07B623CC
1, xrefs: 07B62447

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: 1c81b53c330805397fbf6390d9dcc9a05b76752ac71dfe21a76546e7c69bccf6
Instruction ID: d6fb28af54f5a3cf20739fcdb3298f711549c6929dcdba05a27a4dc81967d8b9
Opcode Fuzzy Hash: 1c81b53c330805397fbf6390d9dcc9a05b76752ac71dfe21a76546e7c69bccf6
Instruction Fuzzy Hash: DBD1C0B4E01218CFDB68DFA4C950B9EB7B2BF49304F2085A9C509AB354DB359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07B63188 Relevance: 2.7, Strings: 2, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR]q, xrefs: 07B63232
PH]q, xrefs: 07B6346A

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID:
String ID: LR]q$PH]q
API String ID: 0-3791814328
Opcode ID: d6248f7f26ac4473dea6107e889a36a8116ca9e164b8213c6bf91d5bc7044de2
Instruction ID: d6d5fd3831fd41cdc6ed4a8a12cd10cb291789a234d5e9271f61f63cd3ae371f
Opcode Fuzzy Hash: d6248f7f26ac4473dea6107e889a36a8116ca9e164b8213c6bf91d5bc7044de2
Instruction Fuzzy Hash: B3A1E3B4E00219CFDB28DFA5C954B9EBBB2FF89304F1085A9D509AB364DB345986CF41

Uniqueness

Uniqueness Score: -1.00%

Function 07833430 Relevance: 2.7, Strings: 2, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 07833592
$]q, xrefs: 07833582

Memory Dump Source

Source File: 00000000.00000002.2346110119.0000000007830000.00000040.00000800.00020000.00000000.sdmp, Offset: 07830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7830000_Notarising.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 0f999610c25446fe16c2d54fe6e7f59480fdee5c515e9d88e0c0c58b87ec9ce8
Instruction ID: d89bab27dd01946a01bb68d51b1d36ceaa463a61aba8212f84160694b099a96f
Opcode Fuzzy Hash: 0f999610c25446fe16c2d54fe6e7f59480fdee5c515e9d88e0c0c58b87ec9ce8
Instruction Fuzzy Hash: 7291BE74E01218CFDB18DFA9D594A9DBBB2FF89305F60846AE419EB350DB359982CF40

Uniqueness

Uniqueness Score: -1.00%

Function 07836750 Relevance: 2.6, APIs: 1, Instructions: 1131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346110119.0000000007830000.00000040.00000800.00020000.00000000.sdmp, Offset: 07830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7830000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2cf29535d2115ba650775f50dda1c99b868019b6114c2203e52bc7c609e4b44
Instruction ID: 2267ac3118c32d12316894d77ba091377e9a8c8da41110a266e4ace5134d020d
Opcode Fuzzy Hash: f2cf29535d2115ba650775f50dda1c99b868019b6114c2203e52bc7c609e4b44
Instruction Fuzzy Hash: B2C2B0B4E012299FCB65DF28D998B9DBBB1EF49300F1041EAD809A7350DB74AE85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 07B63C68 Relevance: 2.0, Strings: 1, Instructions: 752COMMON

Download Yara Rule

Strings

@B/, xrefs: 07B63F7F

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID:
String ID: @B/
API String ID: 0-3863299084
Opcode ID: 9b63085380813fbc548cc1882c45030093ec9ffda2acc4da010c1b9d27d77dfa
Instruction ID: 75be6d7f4ab29cabdc1e3a2bd4259944d7debfe4617e450973cf622c6b98b031
Opcode Fuzzy Hash: 9b63085380813fbc548cc1882c45030093ec9ffda2acc4da010c1b9d27d77dfa
Instruction Fuzzy Hash: E382ADB4A01269CFDB64DF69C988BDDBBB2FB49300F1081EAD509A7250DB359E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07B649C8 Relevance: 1.6, Strings: 1, Instructions: 323COMMON

Download Yara Rule

Strings

l8=p, xrefs: 07B64CD9

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID:
String ID: l8=p
API String ID: 0-1075911181
Opcode ID: 948780333514182948d0fe280d65af8f20d6490c9c45b1c0a18d80c9b606dd30
Instruction ID: 9cdda20f1d8f3f7eab384f9378ea94f4fbdfb2b1b819adde6834143ec603b42a
Opcode Fuzzy Hash: 948780333514182948d0fe280d65af8f20d6490c9c45b1c0a18d80c9b606dd30
Instruction Fuzzy Hash: 21E1D2B4E01229CFDB68DFA5C954B9EBBB2BF89300F1081EAD509A7250DB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07832B50 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

$]q, xrefs: 07832D04

Memory Dump Source

Source File: 00000000.00000002.2346110119.0000000007830000.00000040.00000800.00020000.00000000.sdmp, Offset: 07830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7830000_Notarising.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: e920c7c014b12dc8fcc33ae91ce91290c304c3813dd336a9fc40d868b7e580e9
Instruction ID: 9a41da64120ced89bdab82f3d556cf8c45264c02ac0eed24273ff0bce7ccfe86
Opcode Fuzzy Hash: e920c7c014b12dc8fcc33ae91ce91290c304c3813dd336a9fc40d868b7e580e9
Instruction Fuzzy Hash: 1571D574E01219CFDB58DFA9D494A9DBBB2FF89304F208529D415BB354DB349846CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0783AE28 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346110119.0000000007830000.00000040.00000800.00020000.00000000.sdmp, Offset: 07830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7830000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320c27a2470737c935d1e7f05d21299226cbcb65ebc21ce3cb8a82197bb274d5
Instruction ID: d5806bd884451d7ad1c94d0de53d5c081da2f05111b817d0380a98c42ce3b255
Opcode Fuzzy Hash: 320c27a2470737c935d1e7f05d21299226cbcb65ebc21ce3cb8a82197bb274d5
Instruction Fuzzy Hash: E08268F4B04716CFDB24CF28D958B697BF1AB48318F1081E9D9099B7A2EB349C45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07834DF0 Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346110119.0000000007830000.00000040.00000800.00020000.00000000.sdmp, Offset: 07830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7830000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58f933c4a42043b10b2435c336dcd08dd126d753c9970181ea9775181c31318e
Instruction ID: 2df062c3865b283d8034c4649e1f412f7aa705e29bd95373f5a9e28e89a161da
Opcode Fuzzy Hash: 58f933c4a42043b10b2435c336dcd08dd126d753c9970181ea9775181c31318e
Instruction Fuzzy Hash: 5042BF74A01229CFDB65DF68C954BEEBBB2BB49300F5085E9C40AAB350DB355E85CF81

Uniqueness

Uniqueness Score: -1.00%

Function 07B69A58 Relevance: .5, Instructions: 467COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84817d0d3addfc2e635f39e63cd533f0d1f2510b2c1755eee0863a77214f9b37
Instruction ID: f42cf728ead48aaef344afecb56ee377fd11f270a5275ebaca62d1469cf0454f
Opcode Fuzzy Hash: 84817d0d3addfc2e635f39e63cd533f0d1f2510b2c1755eee0863a77214f9b37
Instruction Fuzzy Hash: 2CE1CCF5B017018FEB29DB65C4587AE77EAEF8A700F1444ADD246DB290DB39E801CB61

Uniqueness

Uniqueness Score: -1.00%

Function 07831278 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346110119.0000000007830000.00000040.00000800.00020000.00000000.sdmp, Offset: 07830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7830000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429f878f1a4443a4ed51582c94a678eedbde2b67939858148fc0098cc02980d1
Instruction ID: 42ff0e5f1e37ff4c86a0b1681af1dd16933c4b8ce9ec9cb74a40b98309f675b0
Opcode Fuzzy Hash: 429f878f1a4443a4ed51582c94a678eedbde2b67939858148fc0098cc02980d1
Instruction Fuzzy Hash: 8E329E74E01629CFDBA5DF69C954BD9B7B2BF49300F1081EAD549A7250EB30AE85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 078308A0 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346110119.0000000007830000.00000040.00000800.00020000.00000000.sdmp, Offset: 07830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7830000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 077185912c22d12267adb3ad877b1085e5d9ff06d297eaf82b85e3efaee4c645
Instruction ID: 3ba6fbe64d6b7bdd13f67cbf116cb6297dffce41d47459fd67b2c010b1d47d6e
Opcode Fuzzy Hash: 077185912c22d12267adb3ad877b1085e5d9ff06d297eaf82b85e3efaee4c645
Instruction Fuzzy Hash: C402B074A01229CFDBA9DF68C954B9EB7B2BF89300F1085E9C409AB350DB359E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07834048 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346110119.0000000007830000.00000040.00000800.00020000.00000000.sdmp, Offset: 07830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7830000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5cc45c6c8ab43b96ca1a5af8006d52b053357f6d74b845a91f85b8b37f76f97
Instruction ID: f67a8b47af162e2053b42619297cf5c101978e0c05a993410eb650aeb407c716
Opcode Fuzzy Hash: c5cc45c6c8ab43b96ca1a5af8006d52b053357f6d74b845a91f85b8b37f76f97
Instruction Fuzzy Hash: AAF1C374A01229CFDB69DF64C950B9EBBB2FF89300F1085A9C509AB350DB355E86CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07835C81 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346110119.0000000007830000.00000040.00000800.00020000.00000000.sdmp, Offset: 07830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7830000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d33d2e633b2765fc5acc33690a8c6307254680b931cb578b176154bb2c99c10
Instruction ID: 505fe682fcc5444d426205e52e68d1ddc8865ab67fc43b5bd1ba2efd59f882e6
Opcode Fuzzy Hash: 6d33d2e633b2765fc5acc33690a8c6307254680b931cb578b176154bb2c99c10
Instruction Fuzzy Hash: F5D1C3B4E01218CFDB68DFA9C954B9DBBB2FF49304F1081A9D409AB350DB359986CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07830438 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346110119.0000000007830000.00000040.00000800.00020000.00000000.sdmp, Offset: 07830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7830000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a8390a25dd770a5459f294a98d87eda5c75c47103ec5ecc7aa379931bc8774f
Instruction ID: a74bec2a7eee5b4fb492c126625c5a3133f770c19294399df3471f60701be28a
Opcode Fuzzy Hash: 3a8390a25dd770a5459f294a98d87eda5c75c47103ec5ecc7aa379931bc8774f
Instruction Fuzzy Hash: 4AD19FB4E01218CFDB64DFA9C984B9DBBB2FF89301F1091A9D409AB355DB359A81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07834688 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346110119.0000000007830000.00000040.00000800.00020000.00000000.sdmp, Offset: 07830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7830000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1953e059e0f69cfd420902b1d1a4b80612c5a0be732a662fa831d784308713b3
Instruction ID: b22b9b3d3e0c566ce38173f95f00d51a503c5bd4efb1b5e9d19e1cfdd881bc8d
Opcode Fuzzy Hash: 1953e059e0f69cfd420902b1d1a4b80612c5a0be732a662fa831d784308713b3
Instruction Fuzzy Hash: C3C1D8B0D012298FDB68DF69C950BDEBBB2BF89304F1085A9C44DAB250DB755E85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0783403E Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346110119.0000000007830000.00000040.00000800.00020000.00000000.sdmp, Offset: 07830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7830000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d01c95052f927e3178679a1e1e5b9383c3ddcc92131863b0817e93a572ff4548
Instruction ID: bf21b027221b792c31176cac1f98aeac997aa65cc4f3844c71360edbd648f87b
Opcode Fuzzy Hash: d01c95052f927e3178679a1e1e5b9383c3ddcc92131863b0817e93a572ff4548
Instruction Fuzzy Hash: 97A1D474E01218DFDB68DFA5C850B9EBBB2FF85300F2081A9C409AB355DB355E868F51

Uniqueness

Uniqueness Score: -1.00%

Function 07B67759 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8fe5456ed91a44910996ce76f6865cde942d3dbeef7f594fe2c7a30ac6cfce4
Instruction ID: a0c3a9caa7ff7e3a7038dadac21ab760d69b2f11876d3b9768854cc094b7fca2
Opcode Fuzzy Hash: a8fe5456ed91a44910996ce76f6865cde942d3dbeef7f594fe2c7a30ac6cfce4
Instruction Fuzzy Hash: 8041C1B0E002098BEB58DFAAC95469EFBF2EF89300F24C16AC519AB254DB345946CF40

Uniqueness

Uniqueness Score: -1.00%

Function 03C3D108 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 03C3D196
GetCurrentThread.KERNEL32 ref: 03C3D1D3
GetCurrentProcess.KERNEL32 ref: 03C3D210
GetCurrentThreadId.KERNEL32 ref: 03C3D269

Memory Dump Source

Source File: 00000000.00000002.2333108953.0000000003C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 03C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c30000_Notarising.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 0d7fd39827bc626f829dc34c8941cc99e317eaff22c314d65e3925f63e6136b5
Instruction ID: 362e6d31cf83892d49c74bcc0ca7af8a91ab1eb36203e5909aab6b917461302d
Opcode Fuzzy Hash: 0d7fd39827bc626f829dc34c8941cc99e317eaff22c314d65e3925f63e6136b5
Instruction Fuzzy Hash: E35189B09003498FCB45CFAAD548B9EBFF1EF49314F248459E049EB390DB359944CB65

Uniqueness

Uniqueness Score: -1.00%

Function 03C3D118 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 03C3D196
GetCurrentThread.KERNEL32 ref: 03C3D1D3
GetCurrentProcess.KERNEL32 ref: 03C3D210
GetCurrentThreadId.KERNEL32 ref: 03C3D269

Memory Dump Source

Source File: 00000000.00000002.2333108953.0000000003C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 03C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c30000_Notarising.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 345938dee4edf00a4bd25d9af4b9d32a32e4efe3c2b8a09ead3a84d8b24ba534
Instruction ID: 1acb244d76a403311bdefdaa9946314fa4a6fa386db715414c431f5388ca8e82
Opcode Fuzzy Hash: 345938dee4edf00a4bd25d9af4b9d32a32e4efe3c2b8a09ead3a84d8b24ba534
Instruction Fuzzy Hash: 8E5188B09003098FCB54DFAAD548B9EBFF1EF49314F248459E049EB3A0DB35A944CB65

Uniqueness

Uniqueness Score: -1.00%

Function 07B68E30 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07B68E95

Strings

W, xrefs: 07B68E34

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID: MessagePost
String ID: W
API String ID: 410705778-655174618
Opcode ID: f2bb99f2082a9bc7f3c3c3a72823d4af01aed67b1c0186e90b79e5afa349b5ef
Instruction ID: aeb854223e57d9bcb1cfc8ccc8e2e5bf86c41f992af165552ce0e4595e459635
Opcode Fuzzy Hash: f2bb99f2082a9bc7f3c3c3a72823d4af01aed67b1c0186e90b79e5afa349b5ef
Instruction Fuzzy Hash: 3E1106B5900249CFDB20CF99C588BDEFFF4EB48724F148459D658A7650C379A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07B68280 Relevance: 1.6, APIs: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07B68E95

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: aef2035932106ddef7d72b25ea56dd32644264f26909912dd4878e44aaaf801f
Instruction ID: a2bac64a2c9cd3f77c239f2c54592bcc080f729d26dd84052c8e2a2a7dcde1ac
Opcode Fuzzy Hash: aef2035932106ddef7d72b25ea56dd32644264f26909912dd4878e44aaaf801f
Instruction Fuzzy Hash: 323180728093E59FD711DF7CD968ADABFF4EF46214F04409BD0849B162C2789548CBEA

Uniqueness

Uniqueness Score: -1.00%

Function 03C344F0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 03C35A49

Memory Dump Source

Source File: 00000000.00000002.2333108953.0000000003C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 03C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c30000_Notarising.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 1778207a78ec5d68fc244d62ace284546f7b509b991f060766e7b097f1fe3cbf
Instruction ID: 6cfcdba2e722042fd7a5ea2fc79efdea2dbc3e59bd5456f345a96078cecec201
Opcode Fuzzy Hash: 1778207a78ec5d68fc244d62ace284546f7b509b991f060766e7b097f1fe3cbf
Instruction Fuzzy Hash: 4B41EEB0C00719CBDB24DFA9C884B9EBBB5FF4A304F24806AD408AB255DB756946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 03C3598D Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 03C35A49

Memory Dump Source

Source File: 00000000.00000002.2333108953.0000000003C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 03C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c30000_Notarising.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 504a75d0c9cb8debe81d75618308ecc51ff9076cf5db3c406c690d1e0c0fc27d
Instruction ID: ee7a917b51aba4d663fedd988637d9a71a02ca3cb1585381d1c6572fefb75a1e
Opcode Fuzzy Hash: 504a75d0c9cb8debe81d75618308ecc51ff9076cf5db3c406c690d1e0c0fc27d
Instruction Fuzzy Hash: 0341EEB0C00619CBDB24DFA9C984B9EBBB5BF4A304F24806AD418BB255DB756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07B68318 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07B68E95

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6f3725ccd8cd1f97ce13e7204b9027b40294cb313ed0bad906c982937bcbc39f
Instruction ID: 77c39b08fa4abaa86db66a4ebf1fcf6eb144dd362401ece2f2f3e312b628511c
Opcode Fuzzy Hash: 6f3725ccd8cd1f97ce13e7204b9027b40294cb313ed0bad906c982937bcbc39f
Instruction Fuzzy Hash: 2611F5B58003499FDB20DF99C889BDEBBF8EB58710F108459E618A7600C378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 011DD2B6 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE ref: 011DD302

Memory Dump Source

Source File: 00000000.00000002.2330383938.0000000001130000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2330272588.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330284235.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330321368.0000000000E42000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330333138.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330333138.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330333138.0000000000E56000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000F1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000F20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000F24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000F28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000001103000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Notarising.jbxd

Yara matches

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: c7c9411096a7d08f17a55cb52f768575e1f7bd2ac2a7f5d258fcfdf90d378bdc
Instruction ID: 06c0fe0b6a5869518a6efca3f4a803a292bfdc8639b0990156daaf376112db45
Opcode Fuzzy Hash: c7c9411096a7d08f17a55cb52f768575e1f7bd2ac2a7f5d258fcfdf90d378bdc
Instruction Fuzzy Hash: 7AE09AB110C30CEBCA2D3985EC45B7AF3A8AB40211F0A002D879203240FB31A8548AEF

Uniqueness

Uniqueness Score: -1.00%

Function 01204345 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?), ref: 0120481E

Memory Dump Source

Source File: 00000000.00000002.2330383938.0000000001130000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.2330272588.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330284235.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330321368.0000000000E42000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330333138.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330333138.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330333138.0000000000E56000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000F1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000F20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000F24000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000F26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000F28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000001103000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2330383938.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Notarising.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 51e19f277f37ffa1fd443258036b5762b7f318e2df9a9c551d57869dbde5921e
Instruction ID: 2ae6cd07dcb02f7657387a5999859b290433c5dbfd1f888fca99e2f0d9da75e9
Opcode Fuzzy Hash: 51e19f277f37ffa1fd443258036b5762b7f318e2df9a9c551d57869dbde5921e
Instruction Fuzzy Hash: E7D0C77013C7C8E7D72F7B948C06738B6B89F00301F05C615DB5616192EBB46A64C6DB

Uniqueness

Uniqueness Score: -1.00%

Function 03AAD774 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2332783507.0000000003AAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 03AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3aad000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8549b0e0ac294cec74296a367325e90b3f5dbc8c648c82a83d1f85410ae1039
Instruction ID: 7b5167fea62db109cb59aabad2f68a69a7f6f09d633cfdb0d80bee45317bb1ed
Opcode Fuzzy Hash: c8549b0e0ac294cec74296a367325e90b3f5dbc8c648c82a83d1f85410ae1039
Instruction Fuzzy Hash: 2B210672500640EFCB05CF58D9D0F26BFA5FB8C314F2485AEE9890B666C33AD416CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03AAD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2332783507.0000000003AAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 03AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3aad000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bda4803cc84e282457f035ca4c1017b8baedab8879909a3a916faaef74e3bc70
Instruction ID: 16feba0261eb550f5161ae6b4923ce2d875e2d0520bc8e0d5f4c02f686783e71
Opcode Fuzzy Hash: bda4803cc84e282457f035ca4c1017b8baedab8879909a3a916faaef74e3bc70
Instruction Fuzzy Hash: C8213672100604DFDB05DF18C9C0B26FF69FBA8314F24C1AED9490B616C33AE446C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 03ABD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2332821494.0000000003ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 03ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3abd000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69c7013ce81a6dca0dcde4f934c63d2331e84af4ce40e537b1481203c84d6f0a
Instruction ID: d9daff043790277803d3eb49fd5054cb1e1d5782fda1fa9cb1cf751f3057a9a3
Opcode Fuzzy Hash: 69c7013ce81a6dca0dcde4f934c63d2331e84af4ce40e537b1481203c84d6f0a
Instruction Fuzzy Hash: C921F275604244DFCB14DF24D984B66BF79FB88314F24C5AED90A4B257C33AD847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 03ABD007 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2332821494.0000000003ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 03ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3abd000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d46303e87ae45c7ef986687b676c1b3203a30a770528e84706373b3919e70a65
Instruction ID: e9a46e17b23f8658fb62ba99061af83555801ba5664a771d41c878981f018db4
Opcode Fuzzy Hash: d46303e87ae45c7ef986687b676c1b3203a30a770528e84706373b3919e70a65
Instruction Fuzzy Hash: 2F219D755093808FCB02CF24D994B15BF71EB46214F28C5EFD8498F6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 03AAD76F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2332783507.0000000003AAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 03AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3aad000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e04b644a7838c5ce6bce34d941609046b64e90dbb87fcee773936ede6a2c397
Instruction ID: bd8733e99dd01acbe914a23a7bc384b7b72710ee86444978708e2764fcad1e06
Opcode Fuzzy Hash: 2e04b644a7838c5ce6bce34d941609046b64e90dbb87fcee773936ede6a2c397
Instruction Fuzzy Hash: AC21A276504680DFCB16CF14D9C4B16BF72FB88314F28C6AED9480B626C33AD456DB91

Uniqueness

Uniqueness Score: -1.00%

Function 03AAD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2332783507.0000000003AAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 03AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3aad000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b54bb84eaa7aa8c3f09590ffd1acec677623e6eec99b9d5111f11c645d4517b
Instruction ID: 7dd046b82cd6fee9d78a5baa6eda4c6a08718609f55f9884fdd6d595e6b73c5b
Opcode Fuzzy Hash: 7b54bb84eaa7aa8c3f09590ffd1acec677623e6eec99b9d5111f11c645d4517b
Instruction Fuzzy Hash: C011DF76404640CFDB02CF04D5C4B16FF61FB94324F28C6AED9490B616C33AE45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 03AAD9C5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2332783507.0000000003AAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 03AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3aad000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a691c3a52023892b622175a17e3f8f18bd14ce7d5c3725ab8c559a654bf8ee
Instruction ID: 2c2f635185d300f028d9cc14d885a832c6976d59e2de8f025a34fba9bab0eec2
Opcode Fuzzy Hash: a2a691c3a52023892b622175a17e3f8f18bd14ce7d5c3725ab8c559a654bf8ee
Instruction Fuzzy Hash: 64018432008B449AD720CB1EC994B66FFACEF45324F18C46FED484BA56C7799841C671

Uniqueness

Uniqueness Score: -1.00%

Function 03AAD9C4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2332783507.0000000003AAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 03AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3aad000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19d6323bdcfdb4cce32bc04e2e9e254fb7c6a6aefea99a12945b21010a95b3cc
Instruction ID: fe462213ea8b2a41d4f818ba341f7ccd7b5ccd55aef4a9d4d5ed17afd9698f27
Opcode Fuzzy Hash: 19d6323bdcfdb4cce32bc04e2e9e254fb7c6a6aefea99a12945b21010a95b3cc
Instruction Fuzzy Hash: 77F06272408744AEE7208F1ED988B66FF98EF45724F18C45EED484B696C3799844CA71

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07B61518 Relevance: 1.6, Strings: 1, Instructions: 379COMMON

Download Yara Rule

Strings

Haq, xrefs: 07B6190B

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 3740e74885d730ceb7a30d45bb5d1c1c3e6f84a68d3f137bce3b325ec3929938
Instruction ID: f8668cefe966a73988b530bc8d7bb9247f69d5330b28dc4521db4dded6d18795
Opcode Fuzzy Hash: 3740e74885d730ceb7a30d45bb5d1c1c3e6f84a68d3f137bce3b325ec3929938
Instruction Fuzzy Hash: B0E1B2B0A0426E8BDB15CF79C4441ADFBF1AF86301F14C6A6D546EB240E778DA85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07B67118 Relevance: 1.6, Strings: 1, Instructions: 313COMMON

Download Yara Rule

Strings

$]q, xrefs: 07B67259

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 0611d26e2547292e0d49e3a2745c22515f299020393d609269ce6764723b68eb
Instruction ID: 8038b6155ca5296af459c094daf0665e359202c26db95fb677d6558676c6a44e
Opcode Fuzzy Hash: 0611d26e2547292e0d49e3a2745c22515f299020393d609269ce6764723b68eb
Instruction Fuzzy Hash: 74E1A474E012188FDB58DFA8C950B9DBBB2FF49300F6085AAC51AAB354DB359D86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07B65DE8 Relevance: .5, Instructions: 528COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c222687b94fde82859fa799c5159a16cd5495d2079cd9b31773ca6b71f840499
Instruction ID: 085a4fc4ddccdb6468eca42d0e1a585e31b859ec35a5897011b820a10c508fe4
Opcode Fuzzy Hash: c222687b94fde82859fa799c5159a16cd5495d2079cd9b31773ca6b71f840499
Instruction Fuzzy Hash: 65429EB4A012288FDB68DF64C994BDDBBB2FF49304F1085E9D549AB260DB349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07B60808 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8602f7745136bccc53317a3bb3cea6dc8f4f2eae94c635eafc8ea19f80bb1c29
Instruction ID: bc3b6638611d088f95bd593c4c12b4f0ff14beca8ff07b78c221ce87189a8cc2
Opcode Fuzzy Hash: 8602f7745136bccc53317a3bb3cea6dc8f4f2eae94c635eafc8ea19f80bb1c29
Instruction Fuzzy Hash: A8E191B4E01228CFDB65DFA5C950B9DBBB2FF49300F5081AAC50AAB251DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07B60040 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab60a530cd57bab319d27aaf4a33ce3f778746cd33d1aa0bffee9d72bed0cfb8
Instruction ID: 229aded5ba3a3e0c1c84b09c480c5b63364459fd64f7f45ce81610460f11843c
Opcode Fuzzy Hash: ab60a530cd57bab319d27aaf4a33ce3f778746cd33d1aa0bffee9d72bed0cfb8
Instruction Fuzzy Hash: 4CF1A1B4E01228CFDB68DF65C984B9DBBB2FB49300F1085AAD519AB350DB759E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07B61980 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c459015480fe8a422c611d647bf35d742d3d207f68dca014dafe1f194ceba7c
Instruction ID: 6a97917bdf5570eccf702f17cb1f0899ef971419964ef877ca3bfcd875c9b721
Opcode Fuzzy Hash: 6c459015480fe8a422c611d647bf35d742d3d207f68dca014dafe1f194ceba7c
Instruction Fuzzy Hash: 2FE1C1B4E01229CFDB64DF65C994B9EBBB2BF89300F1085AAC509A7350DB345E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07831F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346110119.0000000007830000.00000040.00000800.00020000.00000000.sdmp, Offset: 07830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7830000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c46f94d6b608140f32ad22974e78c9d278aa26951bc106ad39892eda7079018f
Instruction ID: d332131fe2721e2914eacc659e081fff2ed49e754e8a2a916cac088c3e79b8ab
Opcode Fuzzy Hash: c46f94d6b608140f32ad22974e78c9d278aa26951bc106ad39892eda7079018f
Instruction Fuzzy Hash: A1C1B074E01218CFDB58DFA9C890A9DBBB2FF89300F2085AAD409AB355DB355D86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 03C3DCD4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2333108953.0000000003C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 03C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c30000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3937a677c8cff8f90f1653d718801774fd7c1cf285d8601cbb8f3f8b26178fbe
Instruction ID: 748de340ee571f3e9f05b537829a9abaeb4a6e9e731754bfedc2c33c6d0227c5
Opcode Fuzzy Hash: 3937a677c8cff8f90f1653d718801774fd7c1cf285d8601cbb8f3f8b26178fbe
Instruction Fuzzy Hash: 05A14B36E00209CFCF05DFB5D8445AEB7B2BF85300B1945AAE806EF265DB31E955CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07831F20 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346110119.0000000007830000.00000040.00000800.00020000.00000000.sdmp, Offset: 07830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7830000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0963ccd66ae7ce5abf98a738b12a11e2271e63113acb2ce081e967dc14329772
Instruction ID: ee5f4d95473a80ad9222712ac9e4742076686b20f89a5cd6dfd2a67370147382
Opcode Fuzzy Hash: 0963ccd66ae7ce5abf98a738b12a11e2271e63113acb2ce081e967dc14329772
Instruction Fuzzy Hash: 21C19F74E01218CFDB58DFA9C990A9DBBB2FF89300F2085AAD419AB354DB345D86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07B60E6A Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b1ff6e7ce1e20ac14d3f9db6275b145d3c2cf373b635ba54e4ccc717bc492d
Instruction ID: f8133eaecb583712d53514720bb1f00e71485865d42315d704473d637e6f7efe
Opcode Fuzzy Hash: 32b1ff6e7ce1e20ac14d3f9db6275b145d3c2cf373b635ba54e4ccc717bc492d
Instruction Fuzzy Hash: 14B1B1B4E01218CFDB68DFA5C954A9DBBB2FF89300F2080A9D509AB354DB359D86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 07834678 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346110119.0000000007830000.00000040.00000800.00020000.00000000.sdmp, Offset: 07830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7830000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac92ecdedba645105ed4ad2a225dca64b57757d72750ef315db4032680b1191d
Instruction ID: 56edf4c6c367448f95ddcf1e173a2ae98cc84f02c37bf611c2e5b8c871994c0a
Opcode Fuzzy Hash: ac92ecdedba645105ed4ad2a225dca64b57757d72750ef315db4032680b1191d
Instruction Fuzzy Hash: 3F91EA70D012298FDB69DF69C9507DEBBB2BF89300F1085EAC549AB250DB315E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07B649B8 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93a8281a4d37bdb4e73a2d5f36ab0c29605f7cb385b70f71de82cd416cc3c0be
Instruction ID: ae388adf02b7860c42fcba369d74fe63d146f4f498b9d522696b1221785ed621
Opcode Fuzzy Hash: 93a8281a4d37bdb4e73a2d5f36ab0c29605f7cb385b70f71de82cd416cc3c0be
Instruction Fuzzy Hash: 3891D5B4E012288FDB68DFA5C954B9EBBB2FF89300F5081EAC509A7250DB354E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07B65207 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95657b77d3c147b598e67d216846a7c5c772d6e1c28ec0e6762cd592de8a1124
Instruction ID: b85e3c6c0ef02b924dee5334d1153ed71f773a7c35c0d2a6f7ed0bfa739163ad
Opcode Fuzzy Hash: 95657b77d3c147b598e67d216846a7c5c772d6e1c28ec0e6762cd592de8a1124
Instruction Fuzzy Hash: 5A61E4B4A01218CFDB68DF65C950B9EBBB2FF89300F1481E9D509AB251DB345E96CF81

Uniqueness

Uniqueness Score: -1.00%

Function 07B60006 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: def155b34810619484d13bae8e7f2b658cae789352ebc9df486491635cf1a71d
Instruction ID: 77bd4047fe3f31406b1519bb91997f8d720216f518ac3a24b176b7f43f22ae50
Opcode Fuzzy Hash: def155b34810619484d13bae8e7f2b658cae789352ebc9df486491635cf1a71d
Instruction Fuzzy Hash: A24139B5D053588FDB19DFAAC8407DDBBF2BF89300F1480AAC449AB251DB340949CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07830429 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346110119.0000000007830000.00000040.00000800.00020000.00000000.sdmp, Offset: 07830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7830000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 734f560b54ccae634a16e77ba73664ac40a640a900164888673266599cf7db25
Instruction ID: f303213bbf4075dca57204fb556ad1e066621652834e4ab7ef343f42b1c0e155
Opcode Fuzzy Hash: 734f560b54ccae634a16e77ba73664ac40a640a900164888673266599cf7db25
Instruction Fuzzy Hash: 2831B4B5E046588BEB18CFABD8406DEFBF7AFC9304F14D12AD408AB255DB305946CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07B61970 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2029aaddb4371f33c8892b21597a93325a5f714cf2aed0ffc4ac7b51bc13c1c3
Instruction ID: a37d81ee4af7c1cb5e52184973d8004ebfe77f68e90464a8d8bbd02691ae25cd
Opcode Fuzzy Hash: 2029aaddb4371f33c8892b21597a93325a5f714cf2aed0ffc4ac7b51bc13c1c3
Instruction Fuzzy Hash: 7B3126B5D002188BEB28CF6AD9457DEFBB2AF89300F10C1AAD519A7251DB300985CF40

Uniqueness

Uniqueness Score: -1.00%

Function 07B64914 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2347118557.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b60000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f7a18dbec5443d433f35de43ba860531c727a684bfc2551c737a2f97649fecf
Instruction ID: 2d7980a6c1f7509644d6b8c445a4f08d7387412300970e09639e4870638781da
Opcode Fuzzy Hash: 2f7a18dbec5443d433f35de43ba860531c727a684bfc2551c737a2f97649fecf
Instruction Fuzzy Hash: FAF0C9B0894659CEEB249F51D84CBBEBA70EB07315F101499C21673190DB784785CF84

Uniqueness

Uniqueness Score: -1.00%

Function 078356D9 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346110119.0000000007830000.00000040.00000800.00020000.00000000.sdmp, Offset: 07830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7830000_Notarising.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c92934e8b2c425afda0ed4494eaed414ff59eda70239ed28b8d0dd5ca7e7b7
Instruction ID: e893646c44c16c1c79dedc66d6a5fe5d0d0d119a997ff97fba680f39b424ba03
Opcode Fuzzy Hash: d6c92934e8b2c425afda0ed4494eaed414ff59eda70239ed28b8d0dd5ca7e7b7
Instruction Fuzzy Hash: E3E092B0D6920EDADB148F75C0117BFF7706B52208F2058458805B3244DB744B548FE3

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Notarising.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Notarising.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
Notarising.exe

Function 07839E20 Relevance: 6.6, Strings: 5, Instructions: 301
COMMON

Function 07B65218 Relevance: 5.5, Strings: 4, Instructions: 496
COMMON

Function 07B67768 Relevance: 5.3, Strings: 4, Instructions: 271
COMMON

Function 07837EE0 Relevance: 2.9, Strings: 2, Instructions: 362
COMMON

Function 07B620C9 Relevance: 2.8, Strings: 2, Instructions: 309
COMMON

Function 07B63188 Relevance: 2.7, Strings: 2, Instructions: 219
COMMON

Function 07833430 Relevance: 2.7, Strings: 2, Instructions: 203
COMMON

Function 03C3D108 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Function 03C3D118 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 07B68E30 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44
windowCOMMON