Edit tour

Windows Analysis Report
CswRsjV3kH.exe

Overview

General Information

Sample name:	CswRsjV3kH.exe renamed because original name is a hash value
Original sample name:	3E6CD9723E292652064FC1A06D75CBE4.exe
Analysis ID:	1429015
MD5:	3e6cd9723e292652064fc1a06d75cbe4
SHA1:	f1f8ab71fa3dd76b0491c4b5133fdeb2f9fae162
SHA256:	9172b16ccd9506d70f0ef99e07853e683f700a0b79f83dfa6a121abf97ec48cd
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

.NET source code contains very large array initializations

Hides threads from debuggers

Installs new ROOT certificates

Machine Learning detection for sample

PE file has nameless sections

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Enables security privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

CswRsjV3kH.exe (PID: 7536 cmdline: "C:\Users\user\Desktop\CswRsjV3kH.exe" MD5: 3E6CD9723E292652064FC1A06D75CBE4)

conhost.exe (PID: 7544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1680722858.00000000030C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1685662213.00000000055F0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1685108688.00000000043B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000003.1639408489.000000000555F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1685108688.0000000004423000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1685894112.0000000005DA0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: CswRsjV3kH.exe PID: 7536	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.CswRsjV3kH.exe.43b6458.5.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.3.CswRsjV3kH.exe.555ff08.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.CswRsjV3kH.exe.55f0ee8.8.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.CswRsjV3kH.exe.55f0000.7.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.CswRsjV3kH.exe.30c9f16.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.CswRsjV3kH.exe.443f790.6.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.CswRsjV3kH.exe.5da0000.9.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.CswRsjV3kH.exe.30c9f16.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.CswRsjV3kH.exe.5da0000.9.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.3.CswRsjV3kH.exe.555ff08.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.CswRsjV3kH.exe.43b6458.5.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.CswRsjV3kH.exe.55f0ee8.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.CswRsjV3kH.exe.55f0000.7.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.CswRsjV3kH.exe.443f790.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.CswRsjV3kH.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 10 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: CswRsjV3kH.exe	ReversingLabs: Detection: 50%
Source: CswRsjV3kH.exe	Virustotal: Detection: 36%			Perma Link

Machine Learning detection for sample

Source: CswRsjV3kH.exe

Joe Sandbox ML: detected

Source: CswRsjV3kH.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:

Binary string: _.pdb source: CswRsjV3kH.exe, 00000000.00000002.1685662213.000000000565E000.00000004.08000000.00040000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000002.1680722858.0000000003137000.00000004.00000800.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1639408489.00000000055CD000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000002.1685108688.0000000004423000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]		0_2_05698254
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]		0_2_05699ED9

Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.0000000003451000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $tq3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\tq equals www.youtube.com (Youtube)
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $tq3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\|- equals www.youtube.com (Youtube)
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.0000000003451000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.0000000003451000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\tq equals www.youtube.com (Youtube)
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.0000000003451000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb`,tq equals www.youtube.com (Youtube)
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.0000000003451000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `,tq#www.youtube.com_0.indexeddb.le equals www.youtube.com (Youtube)

Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: CswRsjV3kH.exe, 00000000.00000003.1664654420.0000000006225000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664764436.0000000006225000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664462458.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664434642.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: CswRsjV3kH.exe, 00000000.00000003.1654236666.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654472364.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654764234.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657195062.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1658370268.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655846532.00000000061F5000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1658538269.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654699594.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655527565.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1658182658.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657286178.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657632244.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656940174.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654887659.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654011505.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657918553.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1653941163.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654388886.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657376337.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654625721.0000000006202000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: CswRsjV3kH.exe, 00000000.00000003.1654159342.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654236666.0000000006202000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comTC
Source: CswRsjV3kH.exe, 00000000.00000003.1653867572.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1653674845.0000000006201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comfac
Source: CswRsjV3kH.exe, 00000000.00000003.1653867572.0000000006202000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comint
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: CswRsjV3kH.exe, 00000000.00000003.1654998784.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654832344.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654472364.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654764234.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654699594.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654309116.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654887659.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654388886.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654625721.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655063802.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654550278.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654944132.0000000006202000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comn-u
Source: CswRsjV3kH.exe, 00000000.00000003.1653867572.0000000006202000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comncy
Source: CswRsjV3kH.exe, 00000000.00000003.1654998784.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654832344.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654764234.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654887659.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655063802.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654944132.0000000006202000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comoldbsKCt
Source: CswRsjV3kH.exe, 00000000.00000003.1654998784.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654832344.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654764234.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654699594.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654887659.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654625721.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655063802.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654550278.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654944132.0000000006202000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comubh
Source: CswRsjV3kH.exe, 00000000.00000002.1679039317.000000000050B000.00000040.00000001.01000000.00000003.sdmp, CswRsjV3kH.exe, 00000000.00000002.1679039317.000000000066C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/
Source: CswRsjV3kH.exe, 00000000.00000002.1679039317.000000000050B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/openU
Source: CswRsjV3kH.exe, 00000000.00000003.1659824764.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664081319.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: CswRsjV3kH.exe, 00000000.00000003.1659428876.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: CswRsjV3kH.exe, 00000000.00000003.1659325114.0000000006227000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: CswRsjV3kH.exe, 00000000.00000003.1659356967.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659428876.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/.
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: CswRsjV3kH.exe, 00000000.00000003.1664791143.00000000061F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: CswRsjV3kH.exe, 00000000.00000003.1663935993.0000000006225000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html.
Source: CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers0
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: CswRsjV3kH.exe, 00000000.00000003.1657068872.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656940174.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/jp/
Source: CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/jp/ExKC
Source: CswRsjV3kH.exe, 00000000.00000003.1657068872.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657452652.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657195062.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657286178.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657632244.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656940174.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657376337.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657543806.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/oy
Source: CswRsjV3kH.exe, 00000000.00000003.1657068872.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656940174.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com0X
Source: CswRsjV3kH.exe, 00000000.00000003.1659428876.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comF5y
Source: CswRsjV3kH.exe, 00000000.00000003.1659356967.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comaExKC
Source: CswRsjV3kH.exe, 00000000.00000003.1659356967.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comalic
Source: CswRsjV3kH.exe, 00000000.00000003.1660548876.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660233223.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659750310.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660459235.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660372621.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659824764.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comas
Source: CswRsjV3kH.exe, 00000000.00000003.1660645580.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660548876.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660233223.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659575709.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659750310.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660459235.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659499318.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660372621.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659642404.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659824764.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comgritoty
Source: CswRsjV3kH.exe, 00000000.00000003.1660645580.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660548876.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660233223.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659750310.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660459235.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660372621.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659824764.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comivta
Source: CswRsjV3kH.exe, 00000000.00000003.1664306645.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1663965051.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664081319.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comoldooy
Source: CswRsjV3kH.exe, 00000000.00000003.1664306645.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1663965051.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664434642.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664081319.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comu
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: CswRsjV3kH.exe, 00000000.00000003.1664791143.00000000061F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: CswRsjV3kH.exe, 00000000.00000003.1664791143.00000000061F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/oy
Source: CswRsjV3kH.exe, 00000000.00000003.1664791143.00000000061F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/qmwB-
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664791143.00000000061F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: CswRsjV3kH.exe, 00000000.00000003.1664791143.00000000061F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm)u
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: CswRsjV3kH.exe, 00000000.00000003.1656940174.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657918553.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657376337.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1658010386.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657543806.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: CswRsjV3kH.exe, 00000000.00000003.1657068872.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656151119.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655846532.00000000061F5000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655527565.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656940174.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp//rdNxPCa
Source: CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/1
Source: CswRsjV3kH.exe, 00000000.00000003.1656151119.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655846532.00000000061F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/5y
Source: CswRsjV3kH.exe, 00000000.00000003.1656151119.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655527565.00000000061F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/ExKC
Source: CswRsjV3kH.exe, 00000000.00000003.1656151119.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Kurs
Source: CswRsjV3kH.exe, 00000000.00000003.1656940174.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657918553.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657376337.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1658010386.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657543806.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/ExKC
Source: CswRsjV3kH.exe, 00000000.00000003.1655846532.00000000061F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/oy
Source: CswRsjV3kH.exe, 00000000.00000003.1656151119.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655527565.00000000061F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/oy
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1653760373.0000000006208000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: CswRsjV3kH.exe, 00000000.00000003.1653507227.0000000006208000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnS
Source: CswRsjV3kH.exe, 00000000.00000003.1653507227.0000000006208000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cns
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.000000000341C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.s
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.000000000341C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000034AE000.00000004.00000800.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/

Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000035E3000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_dc51b542-f

Source: Yara match

File source: Process Memory Space: CswRsjV3kH.exe PID: 7536, type: MEMORYSTR

Source: C:\Users\user\Desktop\CswRsjV3kH.exe	File created: C:\Users\user\AppData\Local\Temp\TmpDBE7.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	File created: C:\Users\user\AppData\Local\Temp\TmpDBC7.tmp			Jump to dropped file

System Summary

.NET source code contains very large array initializations

Source: 0.2.CswRsjV3kH.exe.30c9f16.3.raw.unpack, Strings.cs	Large array initialization: Strings: array initializer size 6160
Source: 0.2.CswRsjV3kH.exe.5da0000.9.raw.unpack, Strings.cs	Large array initialization: Strings: array initializer size 6160
Source: 0.2.CswRsjV3kH.exe.443f790.6.raw.unpack, Strings.cs	Large array initialization: Strings: array initializer size 6160
Source: 0.2.CswRsjV3kH.exe.43b6458.5.raw.unpack, Strings.cs	Large array initialization: Strings: array initializer size 6160
Source: 0.2.CswRsjV3kH.exe.55f0ee8.8.raw.unpack, Strings.cs	Large array initialization: Strings: array initializer size 6160
Source: 0.3.CswRsjV3kH.exe.555ff08.0.raw.unpack, Strings.cs	Large array initialization: Strings: array initializer size 6160

PE file has nameless sections

Source: CswRsjV3kH.exe	Static PE information: section name:
Source: CswRsjV3kH.exe	Static PE information: section name:
Source: CswRsjV3kH.exe	Static PE information: section name:
Source: CswRsjV3kH.exe	Static PE information: section name:
Source: CswRsjV3kH.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_0320B040	0_2_0320B040
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_056970A8	0_2_056970A8
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_05697098	0_2_05697098
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_0569509C	0_2_0569509C
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_072EA29C	0_2_072EA29C
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_072E8028	0_2_072E8028
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_072E3AFC	0_2_072E3AFC
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_072E44B9	0_2_072E44B9
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_09348198	0_2_09348198
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_093489B8	0_2_093489B8

Source: C:\Users\user\Desktop\CswRsjV3kH.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\Desktop\CswRsjV3kH.exe

Code function: String function: 0050F264 appears 47 times

Source: CswRsjV3kH.exe, 00000000.00000002.1685894112.0000000005E0D000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000003.1673844031.0000000004783000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000003.1673844031.0000000004551000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000003.1638897189.0000000000B78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000002.1685662213.000000000565E000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000002.1685662213.000000000565E000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000002.1680722858.0000000003137000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000002.1680722858.0000000003137000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000003.1639408489.00000000055CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000003.1639408489.00000000055CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000002.1685108688.00000000044AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000000.1634992563.00000000004EF000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000002.1685108688.0000000004423000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000002.1685108688.0000000004423000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000002.1678970760.00000000004EF000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe	Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe

Source: CswRsjV3kH.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: CswRsjV3kH.exe	Static PE information: Section: ZLIB complexity 0.9938467920353983
Source: CswRsjV3kH.exe	Static PE information: Section: ZLIB complexity 0.9993669519472361
Source: CswRsjV3kH.exe	Static PE information: Section: .data ZLIB complexity 0.9971359185710352

Source: 0.2.CswRsjV3kH.exe.30c9f16.3.raw.unpack, PBE.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.CswRsjV3kH.exe.30c9f16.3.raw.unpack, Strings.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.CswRsjV3kH.exe.5da0000.9.raw.unpack, PBE.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.CswRsjV3kH.exe.5da0000.9.raw.unpack, Strings.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.CswRsjV3kH.exe.443f790.6.raw.unpack, PBE.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.CswRsjV3kH.exe.443f790.6.raw.unpack, Strings.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.CswRsjV3kH.exe.43b6458.5.raw.unpack, PBE.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.CswRsjV3kH.exe.43b6458.5.raw.unpack, Strings.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.CswRsjV3kH.exe.55f0ee8.8.raw.unpack, PBE.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.CswRsjV3kH.exe.55f0ee8.8.raw.unpack, Strings.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.CswRsjV3kH.exe.555ff08.0.raw.unpack, PBE.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.CswRsjV3kH.exe.30c9f16.3.raw.unpack, Strings.cs	Base64 encoded string: 'JjgkEDEHHhMUBAJXMC4rVyBfOFYoWyA1Gl8jUgcxIC0XXRoQNFkWFgwrAisxWRYiEF44DytbDVUhFV5a'
Source: 0.2.CswRsjV3kH.exe.5da0000.9.raw.unpack, Strings.cs	Base64 encoded string: 'JjgkEDEHHhMUBAJXMC4rVyBfOFYoWyA1Gl8jUgcxIC0XXRoQNFkWFgwrAisxWRYiEF44DytbDVUhFV5a'
Source: 0.2.CswRsjV3kH.exe.443f790.6.raw.unpack, Strings.cs	Base64 encoded string: 'JjgkEDEHHhMUBAJXMC4rVyBfOFYoWyA1Gl8jUgcxIC0XXRoQNFkWFgwrAisxWRYiEF44DytbDVUhFV5a'
Source: 0.2.CswRsjV3kH.exe.43b6458.5.raw.unpack, Strings.cs	Base64 encoded string: 'JjgkEDEHHhMUBAJXMC4rVyBfOFYoWyA1Gl8jUgcxIC0XXRoQNFkWFgwrAisxWRYiEF44DytbDVUhFV5a'
Source: 0.2.CswRsjV3kH.exe.55f0ee8.8.raw.unpack, Strings.cs	Base64 encoded string: 'JjgkEDEHHhMUBAJXMC4rVyBfOFYoWyA1Gl8jUgcxIC0XXRoQNFkWFgwrAisxWRYiEF44DytbDVUhFV5a'
Source: 0.3.CswRsjV3kH.exe.555ff08.0.raw.unpack, Strings.cs	Base64 encoded string: 'JjgkEDEHHhMUBAJXMC4rVyBfOFYoWyA1Gl8jUgcxIC0XXRoQNFkWFgwrAisxWRYiEF44DytbDVUhFV5a'

Source: classification engine

Classification label: mal88.troj.evad.winEXE@2/5@0/0

Source: C:\Users\user\Desktop\CswRsjV3kH.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7544:120:WilError_03

Source: C:\Users\user\Desktop\CswRsjV3kH.exe

File created: C:\Users\user\AppData\Local\Temp\TmpDBC7.tmp

Jump to behavior

Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\CswRsjV3kH.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\CswRsjV3kH.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: CswRsjV3kH.exe	ReversingLabs: Detection: 50%
Source: CswRsjV3kH.exe	Virustotal: Detection: 36%

Source: C:\Users\user\Desktop\CswRsjV3kH.exe

File read: C:\Users\user\Desktop\CswRsjV3kH.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\CswRsjV3kH.exe "C:\Users\user\Desktop\CswRsjV3kH.exe"
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Section loaded: linkinfo.dll	Jump to behavior

Source: C:\Users\user\Desktop\CswRsjV3kH.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Google Chrome.lnk.0.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Users\user\Desktop\CswRsjV3kH.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: CswRsjV3kH.exe

Static file information: File size 1762816 > 1048576

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\CswRsjV3kH.exe

Unpacked PE file: 0.2.CswRsjV3kH.exe.400000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;.rsrc:EW;Unknown_Section5:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;.rsrc:EW;Unknown_Section5:EW;.data:EW;

Source: CswRsjV3kH.exe

Static PE information: real checksum: 0x23bfb should be: 0x1b5ee8

Source: CswRsjV3kH.exe	Static PE information: section name:
Source: CswRsjV3kH.exe	Static PE information: section name:
Source: CswRsjV3kH.exe	Static PE information: section name:
Source: CswRsjV3kH.exe	Static PE information: section name:
Source: CswRsjV3kH.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_005133EA push 00513418h; ret	0_2_00513410
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_005243A0 push 00524400h; ret	0_2_005243F8
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_00524456 push 005245A4h; ret	0_2_0052459C
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_00525454 push 005254A1h; ret	0_2_00525499
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_0051345C push 00513488h; ret	0_2_00513480
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_00513424 push 00513450h; ret	0_2_00513448
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_005134F8 push 0051352Ch; ret	0_2_00513524
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_00513494 push 005134C0h; ret	0_2_005134B8
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_00523536 push 005235B5h; ret	0_2_005235AD
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_005115F0 push 00511641h; ret	0_2_00511639
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_0052262C push 005226A2h; ret	0_2_0052269A
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_0051B6DA push 0051B74Bh; ret	0_2_0051B743
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_00524684 push ecx; mov dword ptr [esp], ecx	0_2_00524687
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_005226A4 push 0052274Ch; ret	0_2_00522744
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_0052274E push 0052279Ch; ret	0_2_00522794
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_0051B85E push 0051B88Ch; ret	0_2_0051B884
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_00523804 push 00523830h; ret	0_2_00523828
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_005248F4 push ecx; mov dword ptr [esp], ecx	0_2_005248F6
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_005118AA push 005118D8h; ret	0_2_005118D0
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_00511968 push 00511994h; ret	0_2_0051198C
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_00512A48 push ecx; mov dword ptr [esp], eax	0_2_00512A49
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_00512CF2 push 00512D20h; ret	0_2_00512D18
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_0051AD60 push ecx; mov dword ptr [esp], edx	0_2_0051AD65
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_00512D2C push 00512D58h; ret	0_2_00512D50
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_0050DF90 push eax; ret	0_2_0050DFCC
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_05698F21 push 0C418B05h; ret	0_2_05698F33
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_05698E81 push 1C418B05h; ret	0_2_05698E93
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_0934550F push dword ptr [esp+ecx*2-75h]; ret	0_2_09345513

Source: CswRsjV3kH.exe	Static PE information: section name: entropy: 7.990134528702455
Source: CswRsjV3kH.exe	Static PE information: section name: entropy: 7.94187495363733
Source: CswRsjV3kH.exe	Static PE information: section name: entropy: 7.276454522865523
Source: CswRsjV3kH.exe	Static PE information: section name: entropy: 7.9988804946234415
Source: CswRsjV3kH.exe	Static PE information: section name: .data entropy: 7.982788491977175

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\Desktop\CswRsjV3kH.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000034AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE`,TQ
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000034AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE@\TQ
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE@\|-
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000034AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE

Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Memory allocated: 31C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Memory allocated: 33B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Memory allocated: 53B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\CswRsjV3kH.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\CswRsjV3kH.exe TID: 7600

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\CswRsjV3kH.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000034AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe@\tq
Source: CswRsjV3kH.exe, 00000000.00000002.1679039317.000000000050B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VBoxService.exe
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000034AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe`,tq
Source: CswRsjV3kH.exe, 00000000.00000002.1686161317.0000000005F71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\M
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000034AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe
Source: CswRsjV3kH.exe, CswRsjV3kH.exe, 00000000.00000002.1679039317.0000000000651000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: CswRsjV3kH.exe, CswRsjV3kH.exe, 00000000.00000002.1679039317.0000000000651000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: CswRsjV3kH.exe, 00000000.00000002.1679039317.000000000050B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMWare
Source: CswRsjV3kH.exe, 00000000.00000003.1677397008.0000000005F70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: CswRsjV3kH.exe, 00000000.00000002.1679039317.0000000000651000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: CswRsjV3kH.exe, 00000000.00000002.1679039317.000000000050B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: &VBoxService.exe
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe@\|-

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\CswRsjV3kH.exe

Thread information set: HideFromDebugger

Jump to behavior

Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_02774448 mov eax, dword ptr fs:[00000030h]		0_2_02774448
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Code function: 0_2_02774448 mov eax, dword ptr fs:[00000030h]		0_2_02774448

Source: C:\Users\user\Desktop\CswRsjV3kH.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\CswRsjV3kH.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000035E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000035E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow

Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\CswRsjV3kH.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 0.2.CswRsjV3kH.exe.43b6458.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.CswRsjV3kH.exe.555ff08.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.55f0ee8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.55f0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.30c9f16.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.443f790.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.5da0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.30c9f16.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.5da0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.CswRsjV3kH.exe.555ff08.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.43b6458.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.55f0ee8.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.55f0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.443f790.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1680722858.00000000030C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1685662213.00000000055F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1685108688.00000000043B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1639408489.000000000555F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1685108688.0000000004423000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1685894112.0000000005DA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 0.2.CswRsjV3kH.exe.43b6458.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.CswRsjV3kH.exe.555ff08.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.55f0ee8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.55f0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.30c9f16.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.443f790.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.5da0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.30c9f16.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.5da0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.CswRsjV3kH.exe.555ff08.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.43b6458.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.55f0ee8.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.55f0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.443f790.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CswRsjV3kH.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1680722858.00000000030C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1685662213.00000000055F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1685108688.00000000043B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1639408489.000000000555F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1685108688.0000000004423000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1685894112.0000000005DA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	1 Masquerading	11 Input Capture	21 Security Software Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	41 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Install Root Certificate	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
CswRsjV3kH.exe	50%	ReversingLabs	Win32.Trojan.RedLine
CswRsjV3kH.exe	37%	Virustotal		Browse
CswRsjV3kH.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	Virustotal		Browse
http://www.enigmaprotector.com/openU	1%	Virustotal		Browse
http://www.founder.com.cn/cn/cThe	0%	Virustotal		Browse
http://www.jiyu-kobo.co.jp/jp/oy	0%	Virustotal		Browse
http://www.carterandcone.com	0%	Virustotal		Browse
http://www.jiyu-kobo.co.jp/oy	0%	Virustotal		Browse
https://discord.com/api/v9/users/	0%	Virustotal		Browse
http://www.jiyu-kobo.co.jp/1	0%	Virustotal		Browse
http://www.jiyu-kobo.co.jp/Kurs	0%	Virustotal		Browse
http://www.zhongyicts.com.cn	1%	Virustotal		Browse
http://www.galapagosdesign.com/	0%	Virustotal		Browse
http://www.galapagosdesign.com/oy	0%	Virustotal		Browse
http://www.jiyu-kobo.co.jp/jp/	0%	Virustotal		Browse
http://www.founder.com.cn/cn	0%	Virustotal		Browse
http://www.jiyu-kobo.co.jp/5y	0%	Virustotal		Browse
http://www.galapagosdesign.com/staff/dennis.htm)u	0%	Virustotal		Browse
http://www.enigmaprotector.com/	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/oy	CswRsjV3kH.exe, 00000000.00000003.1657068872.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657452652.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657195062.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657286178.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657632244.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656940174.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657376337.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657543806.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/qmwB-	CswRsjV3kH.exe, 00000000.00000003.1664791143.00000000061F5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.carterandcone.comn-u	CswRsjV3kH.exe, 00000000.00000003.1654998784.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654832344.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654472364.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654764234.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654699594.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654309116.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654887659.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654388886.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654625721.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655063802.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654550278.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654944132.0000000006202000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers/?	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.fontbureau.com/designers?	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html.	CswRsjV3kH.exe, 00000000.00000003.1663935993.0000000006225000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.enigmaprotector.com/openU	CswRsjV3kH.exe, 00000000.00000002.1679039317.000000000050B000.00000040.00000001.01000000.00000003.sdmp	false	1%, Virustotal, Browse	unknown
http://www.tiro.com	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.s	CswRsjV3kH.exe, 00000000.00000002.1681073229.000000000341C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers	CswRsjV3kH.exe, 00000000.00000003.1659428876.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.comgritoty	CswRsjV3kH.exe, 00000000.00000003.1660645580.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660548876.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660233223.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659575709.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659750310.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660459235.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659499318.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660372621.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659642404.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659824764.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.goodfont.co.kr	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	CswRsjV3kH.exe, 00000000.00000003.1654236666.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654472364.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654764234.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657195062.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1658370268.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655846532.00000000061F5000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1658538269.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654699594.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655527565.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1658182658.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657286178.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657632244.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656940174.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654887659.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654011505.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657918553.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1653941163.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654388886.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657376337.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654625721.0000000006202000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.fontbureau.comivta	CswRsjV3kH.exe, 00000000.00000003.1660645580.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660548876.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660233223.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659750310.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660459235.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660372621.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659824764.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.sajatypeworks.com	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comas	CswRsjV3kH.exe, 00000000.00000003.1660548876.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660233223.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659750310.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660459235.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660372621.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659824764.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.founder.com.cn/cn/cThe	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.galapagosdesign.com/staff/dennis.htm	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664791143.00000000061F5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/oy	CswRsjV3kH.exe, 00000000.00000003.1655846532.00000000061F5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.jiyu-kobo.co.jp/Kurs	CswRsjV3kH.exe, 00000000.00000003.1656151119.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.jiyu-kobo.co.jp/oy	CswRsjV3kH.exe, 00000000.00000003.1656151119.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655527565.00000000061F3000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.jiyu-kobo.co.jp/1	CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://discord.com/api/v9/users/	CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000034AE000.00000004.00000800.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.galapagosdesign.com/DPlease	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ascendercorp.com/typedesigners.html	CswRsjV3kH.exe, 00000000.00000003.1664654420.0000000006225000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664764436.0000000006225000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664462458.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664434642.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/.	CswRsjV3kH.exe, 00000000.00000003.1659356967.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659428876.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1653760373.0000000006208000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://www.jiyu-kobo.co.jp/ExKC	CswRsjV3kH.exe, 00000000.00000003.1656151119.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655527565.00000000061F3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.sakkal.com	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com0X	CswRsjV3kH.exe, 00000000.00000003.1657068872.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656940174.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.comaExKC	CswRsjV3kH.exe, 00000000.00000003.1659356967.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	CswRsjV3kH.exe, 00000000.00000003.1659824764.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664081319.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/	CswRsjV3kH.exe, 00000000.00000003.1664791143.00000000061F5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.galapagosdesign.com/oy	CswRsjV3kH.exe, 00000000.00000003.1664791143.00000000061F5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://api.ip.sb/ip	CswRsjV3kH.exe, 00000000.00000002.1681073229.000000000341C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comTC	CswRsjV3kH.exe, 00000000.00000003.1654159342.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654236666.0000000006202000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.carterandcone.comfac	CswRsjV3kH.exe, 00000000.00000003.1653867572.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1653674845.0000000006201000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.zhongyicts.com.cns	CswRsjV3kH.exe, 00000000.00000003.1653507227.0000000006208000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.jiyu-kobo.co.jp/jp/	CswRsjV3kH.exe, 00000000.00000003.1656940174.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657918553.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657376337.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1658010386.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657543806.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.jiyu-kobo.co.jp/5y	CswRsjV3kH.exe, 00000000.00000003.1656151119.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655846532.00000000061F5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.carterandcone.coml	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comubh	CswRsjV3kH.exe, 00000000.00000003.1654998784.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654832344.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654764234.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654699594.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654887659.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654625721.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655063802.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654550278.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654944132.0000000006202000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers/cabarga.htmlN	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.comint	CswRsjV3kH.exe, 00000000.00000003.1653867572.0000000006202000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.founder.com.cn/cn	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.fontbureau.com/designers/frere-user.html	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comoldooy	CswRsjV3kH.exe, 00000000.00000003.1664306645.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1663965051.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664081319.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers/cabarga.html	CswRsjV3kH.exe, 00000000.00000003.1664791143.00000000061F5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm)u	CswRsjV3kH.exe, 00000000.00000003.1664791143.00000000061F5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.carterandcone.comoldbsKCt	CswRsjV3kH.exe, 00000000.00000003.1654998784.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654832344.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654764234.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654887659.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655063802.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654944132.0000000006202000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.jiyu-kobo.co.jp/	CswRsjV3kH.exe, 00000000.00000003.1656940174.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657918553.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657376337.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1658010386.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657543806.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comF5y	CswRsjV3kH.exe, 00000000.00000003.1659428876.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.jiyu-kobo.co.jp/jp/ExKC	CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/jp/ExKC	CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.comalic	CswRsjV3kH.exe, 00000000.00000003.1659356967.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.comu	CswRsjV3kH.exe, 00000000.00000003.1664306645.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1663965051.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664434642.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664081319.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.carterandcone.comncy	CswRsjV3kH.exe, 00000000.00000003.1653867572.0000000006202000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/jp/	CswRsjV3kH.exe, 00000000.00000003.1657068872.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656940174.00000000061FC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cnS	CswRsjV3kH.exe, 00000000.00000003.1653507227.0000000006208000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.enigmaprotector.com/	CswRsjV3kH.exe, 00000000.00000002.1679039317.000000000050B000.00000040.00000001.01000000.00000003.sdmp, CswRsjV3kH.exe, 00000000.00000002.1679039317.000000000066C000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse	unknown
http://www.fontbureau.com/designers0	CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/	CswRsjV3kH.exe, 00000000.00000003.1659325114.0000000006227000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429015
Start date and time:	2024-04-20 02:26:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	CswRsjV3kH.exe renamed because original name is a hash value
Original Sample Name:	3E6CD9723E292652064FC1A06D75CBE4.exe
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@2/5@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 76% Number of executed functions: 72 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Process:	C:\Users\user\Desktop\CswRsjV3kH.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:30 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2106
Entropy (8bit):	3.4534941717524874
Encrypted:	false
SSDEEP:	48:8SadATkoGRYrnvPdAKRkdAs6IdAKRFdAKR/U:8SBt
MD5:	9875E104CB324E01FAFCC8FFE1FE03B2
SHA1:	5C33977193136157B9380CEC5B6C2AD95898EEC1
SHA-256:	A9D4490252C80800C3E2643047905F5E47331BA0C00BB738A6B28C5611330A51
SHA-512:	A06C04C9B2E034AC2AAF345306ED428080C81A29117FD0C7DB19652B044016D1A3E5F96DBAB41CA6F103FB004C63100A33E86EA538E76F5F58D820843FEB2A74
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,......d........q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW5`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWP`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWP`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWP`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDWI`..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.".-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CswRsjV3kH.exe.log

Download File

Process:	C:\Users\user\Desktop\CswRsjV3kH.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1299
Entropy (8bit):	5.342376182732888
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4xLE4qE4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0H6
MD5:	D62639C5676A8FA1A0C2215824B6553A
SHA1:	544B2C6E7A43CE06B68DF441CC237AB7A742B5CD
SHA-256:	761379FF547D28D053F7683499D25F7F1B5523CC7262A2DA64AF26448F7E2D76
SHA-512:	5B46D1BDB899D8FA5C7431CA7061CDD1F00BE14CD53B630FAB52E52DA20F4B2BED405F932D7C0E9D74D84129D5BB5DE9B32CC709DA3D6995423E2ED91E92ACD3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\TmpDBC7.tmp

Download File

Process:	C:\Users\user\Desktop\CswRsjV3kH.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpDBE7.tmp

Download File

Process:	C:\Users\user\Desktop\CswRsjV3kH.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\Desktop\CswRsjV3kH.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.515757857185975
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	CswRsjV3kH.exe
File size:	1'762'816 bytes
MD5:	3e6cd9723e292652064fc1a06d75cbe4
SHA1:	f1f8ab71fa3dd76b0491c4b5133fdeb2f9fae162
SHA256:	9172b16ccd9506d70f0ef99e07853e683f700a0b79f83dfa6a121abf97ec48cd
SHA512:	ebbac6b06912168ac1b3c43d2f550b195c4cd4049b89d21d5cc35500426dd8abf9438aa38ec6ae03d7af0f758276cc274bf3cda7fe216b68e1a5ec6ddf3d464e
SSDEEP:	49152:ZBaDiV56zgxirjfacAwpccp9Fq/uNhgr+fjS:ZL6Exnxxcp9IbyO
TLSH:	5A85129FB1180E5BC82F7872248A87761E359EAD4DCE0662E3E3FF3B76763500A55106
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h..-,q.~,q.~,q.~2#.~?q.~...~+q.~,q.~\q.~2#n~.q.~2#i~.q.~2#{~-q.~Rich,q.~.................u......PE..L...t..P..........#........

File Icon


Icon Hash:	074d0d1d181b482b

Static PE Info

General

Entrypoint:	0x40112c
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5000A574 [Fri Jul 13 22:47:16 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	9dc580b98fdc55e0bc3b6c6f01e8c0c2

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00401000h
call 00007FB170F3E716h
call far 5DE5h : 8B10C483h
jmp 00007FB1713A9099h
mov bl, C2h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[ C ] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x38a000	0x210	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xaf000	0x5b700	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x1a000	0xe200	2c03bffb494624a78d4220728e7d938c	False	0.9938467920353983	DOS executable (COM, 0x8C-variant)	7.990134528702455	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x1b000	0x7000	0x3a00	5c9968f95ae221e2dd26049db7df0654	False	0.9791217672413793	data	7.94187495363733	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x22000	0x4000	0x800	53e381e4c9002e0f1309f61d47f6712e	False	0.87646484375	data	7.276454522865523	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x26000	0x89000	0x31c00	d7901c256cd56bd67a7b57386378e383	False	0.9993669519472361	data	7.9988804946234415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xaf000	0x5c000	0x5b800	32cda2f85a9cfb79cfacfe0b93421938	False	0.23622673326502733	data	4.07890570382605	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x10b000	0x27f000	0x2ba00	e06f66a95f64988599cb748281f683f0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x38a000	0xe3000	0xe3000	d0beac6c43077501afb25d778f17b321	False	0.9971359185710352	data	7.982788491977175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xaf2d4	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	0.18654392401692457
RT_ICON	0xf12fc	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.3163965456051106
RT_ICON	0x101b24	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.4146197449220595
RT_ICON	0x105d4c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.47883817427385894
RT_ICON	0x1082f4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.5189962476547842
RT_ICON	0x10939c	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.5881147540983607
RT_ICON	0x109d24	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.6152482269503546
RT_RCDATA	0x8118c	0x2d063	empty	0
RT_RCDATA	0xae1f0	0x20	empty	0
RT_GROUP_ICON	0x10a18c	0x68	data	0.7403846153846154
RT_VERSION	0x10a1f4	0x31e	data	0.449874686716792
RT_MANIFEST	0x10a514	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
kernel32.dll	GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
user32.dll	MessageBoxA
advapi32.dll	RegCloseKey
oleaut32.dll	SysFreeString
gdi32.dll	CreateFontA
shell32.dll	ShellExecuteA
version.dll	GetFileVersionInfoA
ole32.dll	OleInitialize

Target ID:	0
Start time:	02:26:54
Start date:	20/04/2024
Path:	C:\Users\user\Desktop\CswRsjV3kH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\CswRsjV3kH.exe"
Imagebase:	0x400000
File size:	1'762'816 bytes
MD5 hash:	3E6CD9723E292652064FC1A06D75CBE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1680722858.00000000030C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1685662213.00000000055F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1685108688.00000000043B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000003.1639408489.000000000555F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1685108688.0000000004423000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1685894112.0000000005DA0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:26:54
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.9%
Dynamic/Decrypted Code Coverage:	99.3%
Signature Coverage:	0.5%
Total number of Nodes:	582
Total number of Limit Nodes:	46

Executed Functions

Function 09348198 Relevance: 7.9, Strings: 6, Instructions: 424
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

.R, xrefs: 09348594
.R, xrefs: 093483F5
.R, xrefs: 0934845D
2-R, xrefs: 093481EA
l62, xrefs: 093483BF
.R, xrefs: 09348560

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID: 2-R$l62$.R$.R$.R$.R
API String ID: 0-232466788
Opcode ID: a74c90ca946073b4103cc0ac1c42c82f04ea6b2b20df6975d2375b28ba0d2776
Instruction ID: ce76b7909df1e588263735ef9b32d6572dc7c702de2554dc147c2ac6be45b616
Opcode Fuzzy Hash: a74c90ca946073b4103cc0ac1c42c82f04ea6b2b20df6975d2375b28ba0d2776
Instruction Fuzzy Hash: 9BF1AF70A002499FDB15DF69D850BAEBBF6EF88300F1585A9E505EB2A1DB34EC45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 072E3AFC Relevance: 6.9, Strings: 5, Instructions: 682
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hxq, xrefs: 072E4C2D
Hxq, xrefs: 072E4B1C
Hxq, xrefs: 072E4CEB
Hxq, xrefs: 072E4A89
Hxq, xrefs: 072E4BA3

Memory Dump Source

Source File: 00000000.00000002.1686496708.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID: Hxq$Hxq$Hxq$Hxq$Hxq
API String ID: 0-615405233
Opcode ID: 79971fd3312927b4b973fc60a7457e4fa9ecc08451e5b95ddeec1099439b3801
Instruction ID: 5ed79e9dbc0a7d5eeb58b5daaafa0f27630cb9d58b6dc195fc27ba0b8c7adad0
Opcode Fuzzy Hash: 79971fd3312927b4b973fc60a7457e4fa9ecc08451e5b95ddeec1099439b3801
Instruction Fuzzy Hash: 9C427CB0E102988FDF58EFA9C85079EBBF6BF88300F548169E409AB355DB349945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0320B040 Relevance: 1.7, Strings: 1, Instructions: 495COMMON

Download Yara Rule

Strings

4|yq, xrefs: 0320B778

Memory Dump Source

Source File: 00000000.00000002.1680876653.0000000003200000.00000040.00000800.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3200000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID: 4|yq
API String ID: 0-3659113163
Opcode ID: d08bfdf1bb6ba4ea3901735008fb93a7a05814093b58e28c198eadae0213ffe6
Instruction ID: 2c6f5b891b61876705e718185d93897d9012e01969ba2eb06c3e5cf199ab8dff
Opcode Fuzzy Hash: d08bfdf1bb6ba4ea3901735008fb93a7a05814093b58e28c198eadae0213ffe6
Instruction Fuzzy Hash: 0722BBB5E002298FDB68DFA9CC90BEDB7B1AF88300F5481A9D909E7355DA745E84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 072EA29C Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686496708.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a78807b44efbb67606beff9d1ae934831f3db46b79bda623462805625e29b68
Instruction ID: 700267ef198ea2105867986b44bb7cb09ff0aed55ad21819d4d9126ffea0908c
Opcode Fuzzy Hash: 6a78807b44efbb67606beff9d1ae934831f3db46b79bda623462805625e29b68
Instruction Fuzzy Hash: 09E1B3B4E10219CFDB64DFA5C980BADBBB6BF89300F10D1AAD409AB255DB705E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 072E44B9 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686496708.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1678d884c503a9afec1fd162ddf713c2b072be03a7ad51b72c63636e9b290d7
Instruction ID: 9357309da558b358327b7db3cca477cdcf9e92036f2e68f26e8b9e6eb65b59ec
Opcode Fuzzy Hash: c1678d884c503a9afec1fd162ddf713c2b072be03a7ad51b72c63636e9b290d7
Instruction Fuzzy Hash: 70C18AB0E20299DFDF14DFA5C880799BBF6BF89300F54C1AAE449AB255DB309984CF50

Uniqueness

Uniqueness Score: -1.00%

Function 072E8028 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686496708.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57bbd37e3d892c69f0a4e48fcf0fbcc385f1da4145b337cb00ccb21519937a69
Instruction ID: 48efda8231c9e457cad9926cf3d69d1e98a51bf8ab94a2fd6e9a40063b62cbdf
Opcode Fuzzy Hash: 57bbd37e3d892c69f0a4e48fcf0fbcc385f1da4145b337cb00ccb21519937a69
Instruction Fuzzy Hash: A2B111B4D10319CFDB14DFA9C5887ADBBF6BF49300F10A0AAD449AB291DB784A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 09341868 Relevance: 213.2, Strings: 168, Instructions: 3210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Y2, xrefs: 09341EBC
Y2, xrefs: 0934425B
Y2, xrefs: 0934494E
Y2, xrefs: 09341B5B
Y2, xrefs: 09342D4B
Y2, xrefs: 09343E1D
Y2, xrefs: 09342FA4
Y2, xrefs: 09343592
Y2, xrefs: 093443EA
Y2, xrefs: 09341BB1
Y2, xrefs: 09342972
Y2, xrefs: 093433FE
Y2, xrefs: 09344CBB
l62, xrefs: 093419A1
Y2, xrefs: 09342844
Y2, xrefs: 0934271D
,xq, xrefs: 09344A00
Y2, xrefs: 09341FDB
Y2, xrefs: 093445CF
x yq, xrefs: 09344E2F
Y2, xrefs: 0934456E
p tq, xrefs: 09343835
ctq, xrefs: 09341C50
Y2, xrefs: 09343202
Y2, xrefs: 09343AF7
Y2, xrefs: 09341C6A
Y2, xrefs: 09342F3F
Y2, xrefs: 09344881
Y2, xrefs: 093422E3
Y2, xrefs: 0934377B
Y2, xrefs: 09343F3C
Y2, xrefs: 0934431D
Pptq, xrefs: 093436A5
Y2, xrefs: 0934444B
Y2, xrefs: 093440DF
Y2, xrefs: 093435F3
0"tq, xrefs: 09343BB4
Y2, xrefs: 09343FA1
Hbuq, xrefs: 09342895
Y2, xrefs: 09343845
Y2, xrefs: 09344C5A
Y2, xrefs: 093423A9
pByq, xrefs: 09344B23
Y2, xrefs: 09341E10
Y2, xrefs: 0934475E
Y2, xrefs: 0934306E
Y2, xrefs: 09342344
Y2, xrefs: 093441FA
Y2, xrefs: 09343329
Y2, xrefs: 09341A5F
Y2, xrefs: 09343912
Y2, xrefs: 09344AD2
Y2, xrefs: 09344002
4ctq, xrefs: 09342334
Y2, xrefs: 093437E0
Y2, xrefs: 0934450D
Y2, xrefs: 0934215F
Y2, xrefs: 09341E66
Y2, xrefs: 09343BC4
$#tq, xrefs: 09343B48
Y2, xrefs: 09342A34
Y2, xrefs: 09343716
Y2, xrefs: 09341D64
,xq, xrefs: 093437D0
Y2, xrefs: 09344A71
Y2, xrefs: 093442BC
Y2, xrefs: 09341D0E
Y2, xrefs: 09343A96
Y2, xrefs: 093433A1
PHtq, xrefs: 093433EE
Y2, xrefs: 09343E76
Y2, xrefs: 09343A35
Y2, xrefs: 09344067
Y2, xrefs: 09343C86
Y2, xrefs: 09344EA4
Y2, xrefs: 09341F7A
|buq, xrefs: 09342D3B
LRtq, xrefs: 09343F91
Y2, xrefs: 0934469C
Y2, xrefs: 093439D4
Y2, xrefs: 09344643
Y2, xrefs: 0934258E
Y2, xrefs: 093448F5
Y2, xrefs: 09344E3F
Y2, xrefs: 09341AAF
Y2, xrefs: 093421C0
Y2, xrefs: 09344138
Y2, xrefs: 09344D7D
Y2, xrefs: 09343009
|yq, xrefs: 09343644
Y2, xrefs: 093428A5
Y2, xrefs: 093446FD
Y2, xrefs: 09342EDA
Y2, xrefs: 093420FE
Y2, xrefs: 09342A95
Y2, xrefs: 0934209D
p`tq, xrefs: 0934270D
Y2, xrefs: 09343263
Y2, xrefs: 09344B33
Y2, xrefs: 09343B6B
Y2, xrefs: 09344199
Y2, xrefs: 093438B9
$tq, xrefs: 09341FCB
Y2, xrefs: 09344DDE
Y2, xrefs: 09341B05
, tq, xrefs: 093440BC
Y2, xrefs: 09344391
Y2, xrefs: 093429D3
Y2, xrefs: 0934246B
l62, xrefs: 0934197C
Y2, xrefs: 09342282
Y2, xrefs: 09342663
X#tq, xrefs: 09343963
Y2, xrefs: 09344A10
;tq, xrefs: 09342272
(otq, xrefs: 09344A61
Y2, xrefs: 09341DBA
\;tq, xrefs: 09344AC2
p<tq, xrefs: 0934202C
Y2, xrefs: 093436B5
Y2, xrefs: 09344BF5
Y2, xrefs: 093430D3
Y2, xrefs: 0934277E
Y2, xrefs: 093427DF
Y2, xrefs: 0934352D
Y2, xrefs: 09343C25
Y2, xrefs: 09343D48
Y2, xrefs: 0934240A
Y2, xrefs: 0934203C
Y2, xrefs: 09342919
Y2, xrefs: 09344B94
Y2, xrefs: 09343ED7
Y2, xrefs: 09342E81
Y2, xrefs: 0934319D
Y2, xrefs: 09342BCB
Y2, xrefs: 0934252D
(Ayq, xrefs: 09343CD7
Y2, xrefs: 093447BF
Y2, xrefs: 09342AF6
Y2, xrefs: 09342CEA
Y2, xrefs: 093444AC
Y2, xrefs: 09342221
Y2, xrefs: 09342E0D
Y2, xrefs: 093426BC
Y2, xrefs: 09343CE7
Y2, xrefs: 093425EF
Y2, xrefs: 09343973
Y2, xrefs: 09343463
\stq, xrefs: 09343128
xxq, xrefs: 09343319
Y2, xrefs: 09341CB8
Y2, xrefs: 09344D1C
Y2, xrefs: 09343138
Y2, xrefs: 09342DAC
Y2, xrefs: 09341C07
Y2, xrefs: 09342B57
yq, xrefs: 0934208D
Y2, xrefs: 093424CC
Y2, xrefs: 09343654
Y2, xrefs: 093432C4
Y2, xrefs: 093434C8
Y2, xrefs: 09342C28
Y2, xrefs: 09343DA9
Y2, xrefs: 093449AF
Y2, xrefs: 09344820
Y2, xrefs: 09341F15
Y2, xrefs: 09342C89
4'tq, xrefs: 09341F6A

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID: Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$ Y2$$#tq$(Ayq$(otq$, tq$,xq$,xq$0"tq$4'tq$4ctq$Hbuq$LRtq$PHtq$Pptq$X#tq$\;tq$\stq$l62$l62$p tq$p<tq$pByq$p`tq$x yq$xxq$|buq$|yq$yq$$tq$;tq$ctq
API String ID: 0-2771046172
Opcode ID: 1f15ca649106d69e7b12bae107eb43781c57336387247903aa2a68f9eef01275
Instruction ID: 6c200289b5dd7768a69f9498fdfae177fdb687a146058b6c4fd93c64b8f79f8c
Opcode Fuzzy Hash: 1f15ca649106d69e7b12bae107eb43781c57336387247903aa2a68f9eef01275
Instruction Fuzzy Hash: B6633E71A40218AFDB659BA4DC51BEE7BBAFF88340F1040D9E609AB290DF715E80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 05FD3920 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 379
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hxq, xrefs: 05FD39F0
Hxq, xrefs: 05FD3A7A
Hxq, xrefs: 05FD3D74
Hxq, xrefs: 05FD3D41
Hxq, xrefs: 05FD3A35

Memory Dump Source

Source File: 00000000.00000002.1686210627.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID: Hxq$Hxq$Hxq$Hxq$Hxq
API String ID: 0-615405233
Opcode ID: 8aa6d2163a49d8e487f3c7e7b803298050dd3707754345b8e883d631b19aecff
Instruction ID: 4513be2f7a038005f05780b6528d3a5b524143f4cfb0c3d61b9142234c37b7fd
Opcode Fuzzy Hash: 8aa6d2163a49d8e487f3c7e7b803298050dd3707754345b8e883d631b19aecff
Instruction Fuzzy Hash: EDE15C30B042448FCB19EBB8C5559AEBBF7FF89310B644869D506AB391DF399C42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 09340828 Relevance: 4.0, Strings: 3, Instructions: 262
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pD2, xrefs: 09340B75
(2, xrefs: 093408C0
,xq, xrefs: 09340943

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID: ,xq$pD2$(2
API String ID: 0-2758534523
Opcode ID: 5b5079fd92681ca57c24943a496a2af54e70e1bfa1eb2811efea78044cf1fb3c
Instruction ID: 863a1bd94679c5c6edd675f8f9c71a1a9dab1e0992fa06df313560911853b1c4
Opcode Fuzzy Hash: 5b5079fd92681ca57c24943a496a2af54e70e1bfa1eb2811efea78044cf1fb3c
Instruction Fuzzy Hash: 5081E23070411A8FCF5C9A79845552A76DBAFC5390B2640A9EB0ACF365EE20EC41CF67

Uniqueness

Uniqueness Score: -1.00%

Function 09345877 Relevance: 3.8, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o2, xrefs: 093458BC
4'tq, xrefs: 093458E5
Dm2, xrefs: 093458B0

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID: 4'tq$Dm2$o2
API String ID: 0-2122891565
Opcode ID: 8c271a6b27c57491643f5b41eeffd8e0cd96ec4194ad6f0d4e14a1096cc68c21
Instruction ID: 944d11b77862a7920f03c53b8ab4a88ff4c1e4afe99039e8d1d9769b874cd37b
Opcode Fuzzy Hash: 8c271a6b27c57491643f5b41eeffd8e0cd96ec4194ad6f0d4e14a1096cc68c21
Instruction Fuzzy Hash: 240186303042015FC61AEB79D85156E7BABEFCA344744499AE1468F352EF30AC468BE1

Uniqueness

Uniqueness Score: -1.00%

Function 09345888 Relevance: 3.8, Strings: 3, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o2, xrefs: 093458BC
4'tq, xrefs: 093458E5
Dm2, xrefs: 093458B0

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID: 4'tq$Dm2$o2
API String ID: 0-2122891565
Opcode ID: 68478d7f10248186302e88abdfb45aba4b6068b445197482da786981ba05f330
Instruction ID: e613d9d59c9ae742e3c656bdcfe7631bd53b156890c6183b91fe971d1f80b12f
Opcode Fuzzy Hash: 68478d7f10248186302e88abdfb45aba4b6068b445197482da786981ba05f330
Instruction Fuzzy Hash: 93F090303002059BCA19EB7AE461A6F7BDBEFCD3447104929E14A8B351EF30BC468BE1

Uniqueness

Uniqueness Score: -1.00%

Function 072E9435 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?,?,?,?,?), ref: 072E95AC

Strings

4Ltq, xrefs: 072E954E

Memory Dump Source

Source File: 00000000.00000002.1686496708.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_CswRsjV3kH.jbxd

Similarity

API ID: CreateFile
String ID: 4Ltq
API String ID: 823142352-1272723734
Opcode ID: 04b684d66f4c6a30d96efb7c4b232bacd17a01423ba3238a459e0eb7f517e445
Instruction ID: 0865563331c6ef21371669df5d8204462c14a7915fc232ea9fd0544a9d86207d
Opcode Fuzzy Hash: 04b684d66f4c6a30d96efb7c4b232bacd17a01423ba3238a459e0eb7f517e445
Instruction Fuzzy Hash: 9551EBB4D10319DFDF14CFA9C881A9EFBF5BB49310F60902AE858AB240DB74A985CF45

Uniqueness

Uniqueness Score: -1.00%

Function 072E9440 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 161
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?,?,?,?,?), ref: 072E95AC

Strings

4Ltq, xrefs: 072E954E

Memory Dump Source

Source File: 00000000.00000002.1686496708.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_CswRsjV3kH.jbxd

Similarity

API ID: CreateFile
String ID: 4Ltq
API String ID: 823142352-1272723734
Opcode ID: 86f0c5064560d59956d7767ce112fb8e636e2da5bcb9fdcc6ea2291c71af1c3f
Instruction ID: ac0c240a63a9c535cc49565882d288078095c959432faad6df9679d363f89ad0
Opcode Fuzzy Hash: 86f0c5064560d59956d7767ce112fb8e636e2da5bcb9fdcc6ea2291c71af1c3f
Instruction Fuzzy Hash: 1951ECB4D10219DFDF10CFA9C881A9EFBF5BF49310F20902AE858AB240DB74A985CF45

Uniqueness

Uniqueness Score: -1.00%

Function 056944C8 Relevance: 3.1, APIs: 2, Instructions: 136
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 05694593
GetCurrentThreadId.KERNEL32 ref: 05694629

Memory Dump Source

Source File: 00000000.00000002.1685763138.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5690000_CswRsjV3kH.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 83b0b01eedac7d788cb90d149e19d8efb4637649be8ac3be61d03aa615177521
Instruction ID: 1d2406706d5516274c67de6ac8ad1e6f5a5e358b10145fc8090c47a50a9aae9c
Opcode Fuzzy Hash: 83b0b01eedac7d788cb90d149e19d8efb4637649be8ac3be61d03aa615177521
Instruction Fuzzy Hash: 495184B0910648CFCB18CFAAD548BAEBFF5FF88314F248459E01AA7350DB749985CB65

Uniqueness

Uniqueness Score: -1.00%

Function 056944D8 Relevance: 3.1, APIs: 2, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 05694593
GetCurrentThreadId.KERNEL32 ref: 05694629

Memory Dump Source

Source File: 00000000.00000002.1685763138.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5690000_CswRsjV3kH.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 70963bf63c929c92a77af4bae24263d5716585a70639db9cedadd86c2aed80ce
Instruction ID: 410c5733b41f5c097d57c27bca3c21edc6c5b23a5a76e157f4e14160470304a8
Opcode Fuzzy Hash: 70963bf63c929c92a77af4bae24263d5716585a70639db9cedadd86c2aed80ce
Instruction Fuzzy Hash: A35163B0900649CFCB18CFAAD548BAEBFF5FF88310F208459E01AA7350DB749985CB65

Uniqueness

Uniqueness Score: -1.00%

Function 09345910 Relevance: 2.9, Strings: 2, Instructions: 398COMMON

Download Yara Rule

Strings

$tq, xrefs: 09345BA4
0r2, xrefs: 09345BF9

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID: 0r2$$tq
API String ID: 0-1554248212
Opcode ID: 0d05a1b92d41a22529637a4dc7e36fb4690f6027c7f51ae8321d5da61eb32c71
Instruction ID: fda35abeaeae424eba26fa084c031a0d46f0429fedc7bc1f77023b52753b5101
Opcode Fuzzy Hash: 0d05a1b92d41a22529637a4dc7e36fb4690f6027c7f51ae8321d5da61eb32c71
Instruction Fuzzy Hash: E9E12974F002159FCB14DF69C894AAEBBF6AF88700B158569E906EB365DB30EC41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 09340040 Relevance: 2.8, Strings: 2, Instructions: 253COMMON

Download Yara Rule

Strings

d?2, xrefs: 09340355
,xq, xrefs: 09340123

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID: ,xq$d?2
API String ID: 0-3751924218
Opcode ID: 524417383f726d44592973934f4cd22be9c77d226cf187afd45ba09ebc1c1b74
Instruction ID: f7b11b39f36b55c9fe114ca96a4a598fb411546d58c51acc1da512173ff506c7
Opcode Fuzzy Hash: 524417383f726d44592973934f4cd22be9c77d226cf187afd45ba09ebc1c1b74
Instruction Fuzzy Hash: 4F81C9B47041099FDF9D5A7A841563E6ADBBFC5340B1640A5EA0ACF3A5EE30EC41CF62

Uniqueness

Uniqueness Score: -1.00%

Function 09346C6A Relevance: 2.6, Strings: 2, Instructions: 98COMMON

Download Yara Rule

Strings

@t2, xrefs: 09346D29
@t2, xrefs: 09346D39

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID: @t2$@t2
API String ID: 0-1618186448
Opcode ID: dd59c442619ba3e3b474cadc01e74d4c5ea2b7f5d8be6a8515fe58e931d00b92
Instruction ID: f3f500637c659264591ceb8a5f1b2593af7e5c5a7ce9b645dbf2ee7220a81404
Opcode Fuzzy Hash: dd59c442619ba3e3b474cadc01e74d4c5ea2b7f5d8be6a8515fe58e931d00b92
Instruction Fuzzy Hash: B831D47610E3D04FE7078B3598755AA7FF5EF87218B0A00EBD085CF1A3E6259809C765

Uniqueness

Uniqueness Score: -1.00%

Function 05698F8C Relevance: 1.7, APIs: 1, Instructions: 187COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 05699159

Memory Dump Source

Source File: 00000000.00000002.1685763138.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5690000_CswRsjV3kH.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: d2b2c40ae506a6faa75b5a403af9b1ca4f9dc2ada238e55a113615226e0a3b2c
Instruction ID: df06db327954cf2b2ee3d8324ec720381c26743c37ac195acef702d8aeb31e1c
Opcode Fuzzy Hash: d2b2c40ae506a6faa75b5a403af9b1ca4f9dc2ada238e55a113615226e0a3b2c
Instruction Fuzzy Hash: 75719AB4D00258DFDF20CFA9D884ADEBBF5BB09310F1491AAE818A7211D731AA85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 05698F98 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 05699159

Memory Dump Source

Source File: 00000000.00000002.1685763138.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5690000_CswRsjV3kH.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8cd96e4640a32c5874a95300a34f2c1f242bd022d3accf2b0ae5a22b81190a4e
Instruction ID: c823d0c8f29e325f99fc79b7bb0d4d25ae55b517e03c4ea71148940658ddc652
Opcode Fuzzy Hash: 8cd96e4640a32c5874a95300a34f2c1f242bd022d3accf2b0ae5a22b81190a4e
Instruction Fuzzy Hash: 0B7199B4D00218DFDF24CFA9C984ADEBBB5BF09300F1491AAE818A7211D731AA85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0320CDD4 Relevance: 1.6, APIs: 1, Instructions: 127COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 0320CED1

Memory Dump Source

Source File: 00000000.00000002.1680876653.0000000003200000.00000040.00000800.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3200000_CswRsjV3kH.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7a39fdf1c67ca6609ce2d88e9cdaf46ef876402fd89fc429c80f7c1dd1a28ed2
Instruction ID: ab7700af77fbab010b0d421823bf9a88af7b2e91b3b1e6d7fc4c95fa7f736351
Opcode Fuzzy Hash: 7a39fdf1c67ca6609ce2d88e9cdaf46ef876402fd89fc429c80f7c1dd1a28ed2
Instruction Fuzzy Hash: F351E8B1D00219CFDB24DFA9C880BDEBBF5BF49300F1085AAD508BB251DA756A89CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0320AE48 Relevance: 1.6, APIs: 1, Instructions: 126COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 0320CED1

Memory Dump Source

Source File: 00000000.00000002.1680876653.0000000003200000.00000040.00000800.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3200000_CswRsjV3kH.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 70ef1e31e98ebc9613547f8e8c013f96595bfd0a945494df2d9a07ba5e2c3b94
Instruction ID: c65668bc575716c6072546b8f3bb494cb2adb2d36ed7745b2f2b23fde7d32dc5
Opcode Fuzzy Hash: 70ef1e31e98ebc9613547f8e8c013f96595bfd0a945494df2d9a07ba5e2c3b94
Instruction Fuzzy Hash: 8251D9B1D0021DCFDB24DFA9C840B9EBBF5BF49300F1085AAD509BB251DA756A89CF91

Uniqueness

Uniqueness Score: -1.00%

Function 072E9A34 Relevance: 1.6, APIs: 1, Instructions: 126fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,?), ref: 072E9B2D

Memory Dump Source

Source File: 00000000.00000002.1686496708.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_CswRsjV3kH.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: ea6a523b5c0dc0970a1756e61a1f57ecaf56e95654cba9158b75b30ad8b566ff
Instruction ID: 1e39ee70c35e82a9f32b5f771a948c901793685bc9968099b351f39f68488fec
Opcode Fuzzy Hash: ea6a523b5c0dc0970a1756e61a1f57ecaf56e95654cba9158b75b30ad8b566ff
Instruction Fuzzy Hash: A341DDB0D102199FDB10CFA9C984ADEFBF5BF49300F24902AE858BB250DB74A985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 072E9A40 Relevance: 1.6, APIs: 1, Instructions: 122fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,?), ref: 072E9B2D

Memory Dump Source

Source File: 00000000.00000002.1686496708.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_CswRsjV3kH.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0cc8e0dc673af706458ac2d4461ad74cf9a864d433de68cf154512dd59c397be
Instruction ID: 8d28e0a2e28f93c87775d10b021a49f0555ceba84d6fce1c39d8a66fbb4ec879
Opcode Fuzzy Hash: 0cc8e0dc673af706458ac2d4461ad74cf9a864d433de68cf154512dd59c397be
Instruction Fuzzy Hash: 0841CBB0D102189FDB10CFAAC984ADEFBF5BF49300F64902AE458BB250DB74A985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05694718 Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 056947EB

Memory Dump Source

Source File: 00000000.00000002.1685763138.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5690000_CswRsjV3kH.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3062679e31adeda18151fd5dacd91516a1f4e854282ddca50e800056850f031b
Instruction ID: cf0086d4c19c2941caeb7ce1335c8502aa790f35e7f84978132407f380e20f80
Opcode Fuzzy Hash: 3062679e31adeda18151fd5dacd91516a1f4e854282ddca50e800056850f031b
Instruction Fuzzy Hash: DC4157B9D002589FCF10CFA9D984ADEBBF5FB09310F14902AE918AB310D735A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05694720 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 056947EB

Memory Dump Source

Source File: 00000000.00000002.1685763138.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5690000_CswRsjV3kH.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7ffea38e290d48e6b372034956b63b7c337fb14960db6c12ecb67693b093819a
Instruction ID: f5f0177aaba79285a3f91876836cf44094f8239d01f88109203b329cc2734528
Opcode Fuzzy Hash: 7ffea38e290d48e6b372034956b63b7c337fb14960db6c12ecb67693b093819a
Instruction Fuzzy Hash: 3E4156B9D002989FCF10CFA9D984ADEBBF5BB09320F14906AE918BB310D735A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 072E6998 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(?,?,?), ref: 072E6A78

Memory Dump Source

Source File: 00000000.00000002.1686496708.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_CswRsjV3kH.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: 83ba6628ab1c679511735fa3d0afd7042b18dcbb0e4662124cf7fd0a402fc41f
Instruction ID: 4ecce065959b7e0841934f38f29327aeec25578d8741767764b3fdba1012234d
Opcode Fuzzy Hash: 83ba6628ab1c679511735fa3d0afd7042b18dcbb0e4662124cf7fd0a402fc41f
Instruction Fuzzy Hash: C74177B4D10259DFCB10CFA9D984ADEFBF5BB59314F24806AE818AB310D374AA85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 072E69A0 Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(?,?,?), ref: 072E6A78

Memory Dump Source

Source File: 00000000.00000002.1686496708.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_CswRsjV3kH.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: cfd796e9b2232cbe735d6b1fdda8103f5a0be75eb4c1fe6f13a11cea6471a22c
Instruction ID: 99fb0c0f9a5025cdfaff36a611bec4373b4a01551b8eb8b46d48ddf3503c7c6d
Opcode Fuzzy Hash: cfd796e9b2232cbe735d6b1fdda8103f5a0be75eb4c1fe6f13a11cea6471a22c
Instruction Fuzzy Hash: 484165B4D10259DFCB10CFA9D984ADEFBF5BB59314F24802AE818AB310D374AA85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 072E7808 Relevance: 1.6, APIs: 1, Instructions: 100windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,00000000,?), ref: 072E78F3

Memory Dump Source

Source File: 00000000.00000002.1686496708.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_CswRsjV3kH.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: d586932da68a25f907d59f16b644cd589925f4c8055784e6a3e2c61667e11daa
Instruction ID: b9ab6f42a807c86320ad7f1002b6c4a92806801b2e368b0b4bdad9c85ce5ca90
Opcode Fuzzy Hash: d586932da68a25f907d59f16b644cd589925f4c8055784e6a3e2c61667e11daa
Instruction Fuzzy Hash: 4A31BCB9E00208DFCB04DFA9D480ADEFBF5EF59310F24906AE859AB310D735A945CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0569830C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0569B7D1

Memory Dump Source

Source File: 00000000.00000002.1685763138.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5690000_CswRsjV3kH.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 798a692afa759874a8b8c10bb25fbd294d939519d271dbc1db91795ecb0d0e6d
Instruction ID: 6a35e5b2a42774fd947401d698add1b182770eb1dc484f02ec29effbb3b28e5a
Opcode Fuzzy Hash: 798a692afa759874a8b8c10bb25fbd294d939519d271dbc1db91795ecb0d0e6d
Instruction Fuzzy Hash: 994138B8904349CFCB14CF99C488AAABBF9FF88314F24C559D519AB321D775A941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 072E5318 Relevance: 1.6, APIs: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 072E53BB

Memory Dump Source

Source File: 00000000.00000002.1686496708.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_CswRsjV3kH.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0b2a712fc6ed5a44384db628d61596e5bf8858d1b8d8ec0d8c862fde54b320bd
Instruction ID: f9522e7ec8e47baf7affdcfcd0ba870d47efb0abf3098a818e9793707173034f
Opcode Fuzzy Hash: 0b2a712fc6ed5a44384db628d61596e5bf8858d1b8d8ec0d8c862fde54b320bd
Instruction Fuzzy Hash: E6319BB4D152589FCB10CFA9D980ADEFBF4EB49310F14901AE814BB310D375A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 072E0364 Relevance: 1.6, APIs: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,00000000,?), ref: 072E78F3

Memory Dump Source

Source File: 00000000.00000002.1686496708.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_CswRsjV3kH.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 672ede00b6415166dd600d233b16074682dc067b1c32de7be6577c8596cec494
Instruction ID: cfaa22438ccd7eee5166a5b2f8a1b435903887558f18a518846fc5de18176a99
Opcode Fuzzy Hash: 672ede00b6415166dd600d233b16074682dc067b1c32de7be6577c8596cec494
Instruction Fuzzy Hash: 4B3188B8D10258EFCB10CFA9E584A9EFBF4EB19310F14902AE818B7310D375A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 072E3B98 Relevance: 1.6, APIs: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 072E53BB

Memory Dump Source

Source File: 00000000.00000002.1686496708.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_CswRsjV3kH.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5d1b523afc562bf36a22c0ad6ca7906efb0ca422c340b3fb373521755aef85b3
Instruction ID: 3c7918c2084ed3ab70cb50a7e6d74831600d7c08946408169f5cc4bfba438038
Opcode Fuzzy Hash: 5d1b523afc562bf36a22c0ad6ca7906efb0ca422c340b3fb373521755aef85b3
Instruction Fuzzy Hash: D23199B8D102589FCB10CF99D880A9EFBF4EB09310F14902AE818B7310D375A9448F54

Uniqueness

Uniqueness Score: -1.00%

Function 072E7850 Relevance: 1.6, APIs: 1, Instructions: 86windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,00000000,?), ref: 072E78F3

Memory Dump Source

Source File: 00000000.00000002.1686496708.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_CswRsjV3kH.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 37e640c3c6df9d2b0dc25fd7860f1c3abda98a55eb8afdef5eb4c432c42af7ec
Instruction ID: 0c21111d96cb36caba8f67b8d94a357a46718707d9b66874c771d3839f07c4d7
Opcode Fuzzy Hash: 37e640c3c6df9d2b0dc25fd7860f1c3abda98a55eb8afdef5eb4c432c42af7ec
Instruction Fuzzy Hash: 1D3175B8D00258AFCB14CFA9E580A9EFBF4AB59310F24902AE818BB310D735A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 072E26B8 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,?), ref: 072E2756

Memory Dump Source

Source File: 00000000.00000002.1686496708.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_CswRsjV3kH.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 1e7b32b2669425cba16d17585087b057371b5adca1aad75084045bcee44e8e71
Instruction ID: ed4268a12787a849d0ea821c2c14c96318016fd3ae987f54fc2acbdc518ba22a
Opcode Fuzzy Hash: 1e7b32b2669425cba16d17585087b057371b5adca1aad75084045bcee44e8e71
Instruction Fuzzy Hash: 2A31B9B8C11259DFCB10CFA9D984ADEFBF9BB49310F14806AE858B7210D334AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 072E26B2 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,?), ref: 072E2756

Memory Dump Source

Source File: 00000000.00000002.1686496708.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_CswRsjV3kH.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 72132c23ca04935d1d6779dffe9005558d819f61f0375cc16c50210833e13be9
Instruction ID: d2cc10f01c0e8baac630bf64a7e391f59bac0b292e1d9231b13bd86975cef6f9
Opcode Fuzzy Hash: 72132c23ca04935d1d6779dffe9005558d819f61f0375cc16c50210833e13be9
Instruction Fuzzy Hash: 1F31B9B8C11259DFCB10CFA9D984ADEFBF9BB49310F14906AE858B7210D334AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 02773DE0 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

Module32FirstW.KERNEL32(?,?), ref: 02773E27

Memory Dump Source

Source File: 00000000.00000002.1680116502.0000000002770000.00000040.00001000.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2770000_CswRsjV3kH.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: d3b68ba15dcfa2cb558ce617b0698366f245182e25f9c9078ca8d88e7a99ad56
Instruction ID: 67e3779c1b272c217963003b33d87b7d3952fd967838696097f793cc32a08453
Opcode Fuzzy Hash: d3b68ba15dcfa2cb558ce617b0698366f245182e25f9c9078ca8d88e7a99ad56
Instruction Fuzzy Hash: D3212FB5614605AFD314DF29C845AAAF7F8FB88324F10471EB569C3280E770EA14CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0320B8D1 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 0320B948

Memory Dump Source

Source File: 00000000.00000002.1680876653.0000000003200000.00000040.00000800.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3200000_CswRsjV3kH.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 3bf598fe652cd07329343cf33879134e022aef8497ec236a86e16072c2a4c6d3
Instruction ID: fcc03f87dbd7bb41754fe4f742433e8f1457e581e629f8f34044f161e33018c6
Opcode Fuzzy Hash: 3bf598fe652cd07329343cf33879134e022aef8497ec236a86e16072c2a4c6d3
Instruction Fuzzy Hash: 1321DAB4D102488FCB20CFA9D985ADEFBF4EB48320F24942AE418B7340C735A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0320B8D8 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 0320B948

Memory Dump Source

Source File: 00000000.00000002.1680876653.0000000003200000.00000040.00000800.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3200000_CswRsjV3kH.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: a3ebe4a9605ff7bf2da99411c811ecf548ebdf199f2cbce6970d688fd09c1938
Instruction ID: b3b6aeef8d129a6eeae5e7220f2a35ee402825daaab81bc3e554d2a62f99a229
Opcode Fuzzy Hash: a3ebe4a9605ff7bf2da99411c811ecf548ebdf199f2cbce6970d688fd09c1938
Instruction Fuzzy Hash: BA21B8B4D102588FCB24CFA9D584ADEFBF4EB48320F24942AE419B7240C779A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 093403F8 Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

d, xrefs: 09340544

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: ce474a72c24840ea1c32e3b7e72b610442b033408a6a1f69d1b8738717d39460
Instruction ID: 2eed107a260212d5830e91b0546d1726db47cf6dd53184a7be6f2ae713ee4d0c
Opcode Fuzzy Hash: ce474a72c24840ea1c32e3b7e72b610442b033408a6a1f69d1b8738717d39460
Instruction Fuzzy Hash: 49614875A0060A9FCB14CF59C4C09AAF7F6FF88310B51C569DA1A97616EB34F861CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00678598 Relevance: 1.3, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 006785C3

Memory Dump Source

Source File: 00000000.00000002.1679039317.000000000066C000.00000040.00000001.01000000.00000003.sdmp, Offset: 0050B000, based on PE: true

Associated: 00000000.00000002.1679039317.000000000050B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679039317.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679039317.0000000000651000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CswRsjV3kH.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bf32289c335b6b4e0ee618023bb5c01003e5a69e4974d6bf530a2f6d06f2291f
Instruction ID: 6285d155f087e35f7876d35aa4382f2d7829f7f72571ba7396c4db09623af08a
Opcode Fuzzy Hash: bf32289c335b6b4e0ee618023bb5c01003e5a69e4974d6bf530a2f6d06f2291f
Instruction Fuzzy Hash: 0FE0ECB5340108AFEB50CE8CD988B9B37DEA798710F10C011F60DD7340C634EC509765

Uniqueness

Uniqueness Score: -1.00%

Function 09340D60 Relevance: 1.3, Strings: 1, Instructions: 9COMMON

Download Yara Rule

Strings

l62, xrefs: 09340D6F

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID: l62
API String ID: 0-3841909328
Opcode ID: e2cc03d8c351b492d529022ab4180d34654b57a5eb50e4dcd9aeff84370bb31b
Instruction ID: c9df66027dfe078839cdc5dd0124fa33854aede2cdec1f387da10cd0d966d68a
Opcode Fuzzy Hash: e2cc03d8c351b492d529022ab4180d34654b57a5eb50e4dcd9aeff84370bb31b
Instruction Fuzzy Hash: 79C080FC5005004FD3048B2488549277DF7DBF8701F41C414610045268CD38C450CED0

Uniqueness

Uniqueness Score: -1.00%

Function 09346268 Relevance: .5, Instructions: 508COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f13a4350a21ab775c409da5551df3c3b161f01b5402719b695dbc2f520b63cf
Instruction ID: 729ae50dc9de07259dea8240369ab2644e1988080b1d965838c97d9b9699fc5f
Opcode Fuzzy Hash: 9f13a4350a21ab775c409da5551df3c3b161f01b5402719b695dbc2f520b63cf
Instruction Fuzzy Hash: 9F1246747006058FDB14DF29C499A6ABBF6FF8A304B1684A9E506CB362DB34EC45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0934B901 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50fb077088d9a2be23f3f6dd2440b692f63dd943bf1982376ca4db2ec419c325
Instruction ID: 140cee5e36576d2939e024d8a53e1f9f7cf497520417463928332bb0c2638321
Opcode Fuzzy Hash: 50fb077088d9a2be23f3f6dd2440b692f63dd943bf1982376ca4db2ec419c325
Instruction Fuzzy Hash: 79B15B34B012449FCB18DFA8D594BAEBBF6EF89300F2540A9E405AB3A1CB34ED41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0934970C Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9da81cecace52ad1f86636022d41284bcda15b3d867339f1a9e537fed9622c5
Instruction ID: 21605bfdb8a9c0c092bda4011eef39abb76408473e13f5aad45cc6723eb03e06
Opcode Fuzzy Hash: b9da81cecace52ad1f86636022d41284bcda15b3d867339f1a9e537fed9622c5
Instruction Fuzzy Hash: 3F61DDB0D002589FDF24CFA9C885BDEBBF5BF88710F14852AE419AB294DB746885CF41

Uniqueness

Uniqueness Score: -1.00%

Function 09345901 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0257f5d76c7ab13d7ad2911d95a0b111cee19c3f01296264dcca7ee7f586a364
Instruction ID: 0ea2d9a6341d8f4bc9a5b97153808bbacdc06e187abf0b3eb910659e06e1d006
Opcode Fuzzy Hash: 0257f5d76c7ab13d7ad2911d95a0b111cee19c3f01296264dcca7ee7f586a364
Instruction Fuzzy Hash: 4D515975F002058FCB15DF69C4A06AEB7F6BF88700B158569E905EB355EB30EC418F91

Uniqueness

Uniqueness Score: -1.00%

Function 09349718 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac455cea30d292699f1032452a8b22dcda4c332bc021936c4ffc7159308cbf41
Instruction ID: 7d784be88fa57ae727f98b72fdb5081e7db51255c9839d1bba72859bb9c488fc
Opcode Fuzzy Hash: ac455cea30d292699f1032452a8b22dcda4c332bc021936c4ffc7159308cbf41
Instruction Fuzzy Hash: A761CEB0D00258DFDF24CFAAC885B9EBBF5BF88710F14852AE419AB254DB746985CF41

Uniqueness

Uniqueness Score: -1.00%

Function 09347DC8 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9067734527edaddba0731bf34f0c1c454f7ccb9c75f0215d23631dab850ce6
Instruction ID: dbf86034796c3de2166ee05f58926bc9612862e8e5239d5fb1636463015d79ce
Opcode Fuzzy Hash: bc9067734527edaddba0731bf34f0c1c454f7ccb9c75f0215d23631dab850ce6
Instruction Fuzzy Hash: A6515E75B002058FCB54DF79D88499ABBF6EF88310B1585AAE506DB362DB30EC45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0934AA68 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6f9bc2be9053ffc664c8be939074ab2f4effe012a71e71f699cf297b63f1730
Instruction ID: add48d2da35392febd953eca7539d5cb9ad4acacc5aa072ebef667bf992b62be
Opcode Fuzzy Hash: e6f9bc2be9053ffc664c8be939074ab2f4effe012a71e71f699cf297b63f1730
Instruction Fuzzy Hash: 35519171E402189FDB14DFA9D880AADBBFAEF88310F568069E505EB250DB70BD45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0934AA57 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbf5e9924e72cab4848900872ada291509bacd3839e89923a05067bf5e649bd5
Instruction ID: 49a5717cabdfa6abc56f75549da01712fcfd538d6ba40c24d6aaaa10ea94f291
Opcode Fuzzy Hash: cbf5e9924e72cab4848900872ada291509bacd3839e89923a05067bf5e649bd5
Instruction Fuzzy Hash: 5C51BF71E402148FDB14DFA9D980AADBBF6EF88300F568169E404EB2A1EB70AD45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 09340390 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2210c862a7dec94f36eb545217f2734cf8f766413f5feed31e0efd5ef989bdca
Instruction ID: 0289fa74026c252bc83972bde5cf62f1756d99e6819918e2d44270144192a9eb
Opcode Fuzzy Hash: 2210c862a7dec94f36eb545217f2734cf8f766413f5feed31e0efd5ef989bdca
Instruction Fuzzy Hash: 4C318D317092468FCB16DF69C8C08AABFB5EF8532071685A6DA45CB263D734B915CFE0

Uniqueness

Uniqueness Score: -1.00%

Function 0934A93D Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8e55a9ac7a89afe14d106acd4fe3dd0f0e3e90770e9bb15979d40919fccad28
Instruction ID: 40f399f00c1e3474e78209390c2ad0c2d9f09ae8252ef07d931a49d2e42c3801
Opcode Fuzzy Hash: c8e55a9ac7a89afe14d106acd4fe3dd0f0e3e90770e9bb15979d40919fccad28
Instruction Fuzzy Hash: 3031E1B1D002889FCF14CFAAC984ADEFFF6AF48310F24802AE415AB251DB756945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02AAD1FC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680308856.0000000002AAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aad000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cd3ce022d29eb5154f029e283ef5452719be1bd7624d634b5ad57d211b5ca32
Instruction ID: a99730108fbae48936e702f0baf053adc77fc0b928a3dd034ab6f76991ff2fcd
Opcode Fuzzy Hash: 9cd3ce022d29eb5154f029e283ef5452719be1bd7624d634b5ad57d211b5ca32
Instruction Fuzzy Hash: 772142B1500600DFDB01DF14D9C0B2AFFA6FF98324F24C669E9890B606C736D40ACAA2

Uniqueness

Uniqueness Score: -1.00%

Function 02ABD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680379694.0000000002ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2abd000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c202096c69dbfd8279d8a8ceaac78d8a4ae4a31442bf1b79e96365fd18318658
Instruction ID: 2235b38d7455b0043d0a43b25926fd204dfab3e02d8d3a2151d664600fc3c9b0
Opcode Fuzzy Hash: c202096c69dbfd8279d8a8ceaac78d8a4ae4a31442bf1b79e96365fd18318658
Instruction Fuzzy Hash: 9B21F275604640DFDB16DF14D9C0B66BFA9FF88314F24C96DE90A4B246CB3AD807CA61

Uniqueness

Uniqueness Score: -1.00%

Function 02ABD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680379694.0000000002ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2abd000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a623a71f574350b480101b391cbf93acb9603b7c6946b17dc32c9a8d49d7e93
Instruction ID: 6856525bdf8bd8c8bd3a31a8a5204373e6b130eadfebf22231760ecae9649d64
Opcode Fuzzy Hash: 8a623a71f574350b480101b391cbf93acb9603b7c6946b17dc32c9a8d49d7e93
Instruction Fuzzy Hash: E221F5B1904680EFDB06DF14D5C0B66FBA9FF88314F24C96DE9094B242CB36D406CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0934A948 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cad6fbff9da2ff803890a675250f86157173c95d93fdd916a1274bf53777390d
Instruction ID: e669993707982c95e8d00c41c11fa5336ef0d1e233d5950c28f43d3de519e2ed
Opcode Fuzzy Hash: cad6fbff9da2ff803890a675250f86157173c95d93fdd916a1274bf53777390d
Instruction Fuzzy Hash: 8931EFB1D41288DFDF14CFAAC984ADEFBFAAF48310F24802AE415A7250DB746945CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02ABD007 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680379694.0000000002ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2abd000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b91ccdd0e0bc47dcfe87eba1e95a1928d581741a7efa0af9a7888cbed0366f4
Instruction ID: 62efdfef6736b13e163787e44a3653f9fa611e206c297c71aae1f17282790c2f
Opcode Fuzzy Hash: 3b91ccdd0e0bc47dcfe87eba1e95a1928d581741a7efa0af9a7888cbed0366f4
Instruction Fuzzy Hash: FB217C755097808FDB13CF24D9D0B15BF71EF46214F28C5DAD8498B6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 02AAD1F7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680308856.0000000002AAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aad000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c054a2c647f04c6f55952d2c20fdcf02f11ae86ff72cdce1308d3a67a120fe
Instruction ID: ed125a4d5d992ac60e2fc4197d0bc69e6a8d057c769a20d3cf14d2e4ae3e5622
Opcode Fuzzy Hash: d5c054a2c647f04c6f55952d2c20fdcf02f11ae86ff72cdce1308d3a67a120fe
Instruction Fuzzy Hash: A111DC76504680CFDB02CF00D9C0B16FF62FF84324F2486A9D8490B616C33AD45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0934AF20 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41094eb8f90a8060b5fc2b5b47cbad9eebf98f41d82369b6cfc708cb27e2ce6a
Instruction ID: bb33c9002c036a015f091fffcdf4fe706374bd6106e8648a4429b981673648cc
Opcode Fuzzy Hash: 41094eb8f90a8060b5fc2b5b47cbad9eebf98f41d82369b6cfc708cb27e2ce6a
Instruction Fuzzy Hash: CE118F712153418FC712DF39D81651ABFF6BF8521030A899EE556CF621EF64EC098B91

Uniqueness

Uniqueness Score: -1.00%

Function 02ABD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680379694.0000000002ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2abd000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66acd227d781d23631b327d54d2df17259f70c74367a6e8810765f60c0a1360c
Instruction ID: b318fc78232d227148b3471197cdddf54e833b9549f588fc9a7251d83095dc73
Opcode Fuzzy Hash: 66acd227d781d23631b327d54d2df17259f70c74367a6e8810765f60c0a1360c
Instruction Fuzzy Hash: DE11B875904680DFDB12CF10C5C0B15FFA2FF84218F28C6AAD8494B696C33AD80ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 09349D80 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f72c69c77a14d6ebcfc9b8f116204d6b420f5a3f190bce2a41aeecdd0ec58f1
Instruction ID: 19228229b68222b3679c1c0e44f996231334b632b636d854969cb3d2765344d4
Opcode Fuzzy Hash: 9f72c69c77a14d6ebcfc9b8f116204d6b420f5a3f190bce2a41aeecdd0ec58f1
Instruction Fuzzy Hash: 44017C71B002199BCF10DAA9EC44BAFB7AAEBC4711F14803AE615D3240DB71A9158BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0934B878 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df3b4c0404ded6ff6b13652faad60e32c1da2faa60a4af096ae15dd49c95268e
Instruction ID: 6e7ae22549c8b537b840161d46677df5a027e20d1ccf62454165ddddff6bba87
Opcode Fuzzy Hash: df3b4c0404ded6ff6b13652faad60e32c1da2faa60a4af096ae15dd49c95268e
Instruction Fuzzy Hash: B501AD31700A518FC715DF3AD954A2ABBF6AF8961070980A9E10ACB672DA34EC05CB11

Uniqueness

Uniqueness Score: -1.00%

Function 02AAD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680308856.0000000002AAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aad000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5512268c424965d7d71dce51580d3478cf7481fd3237173913521a500228b942
Instruction ID: 417a1eff993df23d6e215af28c29c89c316aaf5c0714ef1ec3425081a982a690
Opcode Fuzzy Hash: 5512268c424965d7d71dce51580d3478cf7481fd3237173913521a500228b942
Instruction Fuzzy Hash: DD01DB71404B409EE7208B26CCD5B77FFA8EF41724F18C529ED8A5F542C7799941C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 02AAD007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680308856.0000000002AAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2aad000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae1def2e221223925b9cfda4acd184dfa590fbc29caa6ed82fe0e4703b30990
Instruction ID: 721c90f6d0d218eecce787e2f4b132fc0c3e44a9910379315bcdb8f19d4a2e10
Opcode Fuzzy Hash: cae1def2e221223925b9cfda4acd184dfa590fbc29caa6ed82fe0e4703b30990
Instruction Fuzzy Hash: 8F015E6100E7C09ED7128B258894B66BFB4EF53224F1981DBE9C98F5A3C3695849C772

Uniqueness

Uniqueness Score: -1.00%

Function 0934B888 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33fb227ac7468fd9f5d8a27546b073138c520938131bac253c51c124e8a4f1af
Instruction ID: ad292c2a2cc376addbf7625129df5b4291a4229fbb77db62f745a92fb1c4558d
Opcode Fuzzy Hash: 33fb227ac7468fd9f5d8a27546b073138c520938131bac253c51c124e8a4f1af
Instruction Fuzzy Hash: CD017C31700A408FC718DF3AD944A2ABBE6EFC8610B198479E11ACB761CA34EC05CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0934AF48 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a12bd85ef300a9a2f56f9eeff700773aaa67d7cfdae44262058e07ed6ae0276f
Instruction ID: 0bdd5e89e0cd185a5e279872cac1a5c046e1eb7b93be7d27b9598e9daaad6aa9
Opcode Fuzzy Hash: a12bd85ef300a9a2f56f9eeff700773aaa67d7cfdae44262058e07ed6ae0276f
Instruction Fuzzy Hash: ED0116713506008F8721EF3AD84596ABBEAFF8861031589AAE556CB720EF61EC058B90

Uniqueness

Uniqueness Score: -1.00%

Function 09346E51 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff34d0839bc133016991ee9d51fa5f2c2d8213baeabc017c215c66d82c124617
Instruction ID: aeda72cef1a94ed94225430c297bf20e4566ae1d126b12a9f75b76b398a203aa
Opcode Fuzzy Hash: ff34d0839bc133016991ee9d51fa5f2c2d8213baeabc017c215c66d82c124617
Instruction Fuzzy Hash: A6016D75304240AFD7158B29D895C6BBBFAEFC9760705C459F9498B312CA30DC0187A0

Uniqueness

Uniqueness Score: -1.00%

Function 0934BC40 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f62355504c13fc959c8071a61ceede9d2e7c772c8e92f6be2d8fa7c618620bb
Instruction ID: cae8589cac14d1b62b133bdac466401784a62fd222a7edd1a6dfb9d9d8037332
Opcode Fuzzy Hash: 2f62355504c13fc959c8071a61ceede9d2e7c772c8e92f6be2d8fa7c618620bb
Instruction Fuzzy Hash: 81010474D452189FCB04DFAAC4497BEFBF4EB4A302F0484AAE459A3291DB789A44DF14

Uniqueness

Uniqueness Score: -1.00%

Function 09346E60 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 340f5078382b8349bd9d64665288ecf09504685cf74c12fb5936ab7dbcb3591d
Instruction ID: 18ab74cd3afab5a214602727880d513140c0f179804156153811b8e50aa80605
Opcode Fuzzy Hash: 340f5078382b8349bd9d64665288ecf09504685cf74c12fb5936ab7dbcb3591d
Instruction Fuzzy Hash: 4EF0FEB5300114ABDB14DB5AD994D6BBBEAEFC8760B14C429F94D8B345CA30EC0196E0

Uniqueness

Uniqueness Score: -1.00%

Function 093407FF Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dad9890b242de6911aa77f4d0e782b1e3987182808a7bc5eeda5c7bdbd2ded5
Instruction ID: 659756b69e7d7792d3171d7e45cd2a84866409b8baf3f78a7905476163fc0712
Opcode Fuzzy Hash: 2dad9890b242de6911aa77f4d0e782b1e3987182808a7bc5eeda5c7bdbd2ded5
Instruction Fuzzy Hash: 71D0125924D1E00FDA03927450326D23FA0CB8721072955C7E0848F193C0188E4E8FD6

Uniqueness

Uniqueness Score: -1.00%

Function 093450E0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f9d0bc6554108ae75dbaf9bdd27bac1b07154cab328f8febafdd680a68ef4ad
Instruction ID: 1f2589036e07b15c68d5d0735e5698290f862a162cd9472e5a5ecf004083a783
Opcode Fuzzy Hash: 4f9d0bc6554108ae75dbaf9bdd27bac1b07154cab328f8febafdd680a68ef4ad
Instruction Fuzzy Hash: 03C0127154C3C07FC7028B714C16D16BF716B52700F06C0DFB2968D0A3D2A14010DB12

Uniqueness

Uniqueness Score: -1.00%

Function 09340838 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d60ebe8250d36da0724b575b1541e5a5e2af5b564167e027180e948783118b4
Instruction ID: 995c6ea1f865f1b8222c24883c6c74e303a139667d72a81ee8e084a35e73624c
Opcode Fuzzy Hash: 1d60ebe8250d36da0724b575b1541e5a5e2af5b564167e027180e948783118b4
Instruction Fuzzy Hash: D6B0123000124F4FC54067B7F40D705371CD640704B808931B00D0901279682C824A97

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 093489B8 Relevance: 2.0, Strings: 1, Instructions: 780COMMON

Download Yara Rule

Strings

":R, xrefs: 09348A33

Memory Dump Source

Source File: 00000000.00000002.1686959407.0000000009340000.00000040.00000800.00020000.00000000.sdmp, Offset: 09340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9340000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID: ":R
API String ID: 0-4090650525
Opcode ID: 57a1341a352a48c2105f5f8ec40ca779708e226f90031697083735852a09feab
Instruction ID: eb0f0f33ec0f6a4023c6913794a285d9a57c51cceb327c10c4a30bee0a69cab1
Opcode Fuzzy Hash: 57a1341a352a48c2105f5f8ec40ca779708e226f90031697083735852a09feab
Instruction Fuzzy Hash: 07623FB06002009BDB88DF69D55475A7AD6EF88308F24C99CD1098F396DFBAD94B8FD1

Uniqueness

Uniqueness Score: -1.00%

Function 056970A8 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685763138.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5690000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e9f7bdcbd4e892a94c363296e9d8dbda7e82ce342bf3a76f5e8cc71c18c4f2
Instruction ID: 057e44842e7be32ec1c081d6c46342a33e0a0d78c062b321159ffd169b61c87b
Opcode Fuzzy Hash: 49e9f7bdcbd4e892a94c363296e9d8dbda7e82ce342bf3a76f5e8cc71c18c4f2
Instruction Fuzzy Hash: 9D12AAF04227458AD712CF25E94E1893F71BF85314B92421AE2612F2D1EFBC166EEF84

Uniqueness

Uniqueness Score: -1.00%

Function 0569509C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685763138.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5690000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4961c4906bfb4972d73773ed51422b553178cc9f0d63eeb533669685bad00f93
Instruction ID: d8c7f5a8b5bdc0ab30562c13d5d121cb6a17db2afe8cfb33a3d8dac129fb9e85
Opcode Fuzzy Hash: 4961c4906bfb4972d73773ed51422b553178cc9f0d63eeb533669685bad00f93
Instruction Fuzzy Hash: 01A17236E103058FCF09DFB5C84459EBBB6FF85300B15856AE806AF211DB75E956CB40

Uniqueness

Uniqueness Score: -1.00%

Function 05697098 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685763138.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5690000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d05095d1ef21c3d72b22c7b6ebb9994773d7c24d1807b22c61adbe9dd30554
Instruction ID: 6623bc283434ba970bd00166cb5d03ba2a507591fe79733eec21b44fdfb38a58
Opcode Fuzzy Hash: 76d05095d1ef21c3d72b22c7b6ebb9994773d7c24d1807b22c61adbe9dd30554
Instruction Fuzzy Hash: 74C118B08217458AD716CF25E84A1897FB1FF85314F52421AE2612F2D0EFBC166EEF84

Uniqueness

Uniqueness Score: -1.00%

Function 02774448 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680116502.0000000002770000.00000040.00001000.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2770000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597c0d950d7a1baf72706a893799aa2982191e77cec4ca749b12db36279116a7
Instruction ID: a28f87f4b21d27a98a56b4b2432d1efcf76b9282c5408ef3a89a565e4a3e0a38
Opcode Fuzzy Hash: 597c0d950d7a1baf72706a893799aa2982191e77cec4ca749b12db36279116a7
Instruction Fuzzy Hash: 27518779A00701CFC765CF69C580A86BBF4FF08720711566AE99AD7755E730E941CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05698254 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685763138.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5690000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7a26ba40f5f908f84332f2c276783a83b06fb2b91bbbdbba896646b5b3e763a
Instruction ID: 0ccce73f05e1c03f23d5207546e5e86ed22624f41e3bac5999c5d7f1fe624d8a
Opcode Fuzzy Hash: a7a26ba40f5f908f84332f2c276783a83b06fb2b91bbbdbba896646b5b3e763a
Instruction Fuzzy Hash: 9E3187B4D052589FCF14CFA9D984A9EFBF5AB49320F24906AE819B7310D334A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05699ED9 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685763138.0000000005690000.00000040.00000800.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5690000_CswRsjV3kH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1686bc1ebc06dae2899bd4ca90c0eb44eae2b2403e5cc910ba79db2125fed0c6
Instruction ID: c8fd3505df11014a71df16c77ae534bc3895656b537829c253a6312489bd9e8b
Opcode Fuzzy Hash: 1686bc1ebc06dae2899bd4ca90c0eb44eae2b2403e5cc910ba79db2125fed0c6
Instruction Fuzzy Hash: 1131A8B5D052489FCF14CFA9E984A9EFBF5BB49310F24902AE818B7310D334A945CF94

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CswRsjV3kH.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CswRsjV3kH.exe.log

C:\Users\user\AppData\Local\Temp\TmpDBC7.tmp

C:\Users\user\AppData\Local\Temp\TmpDBE7.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
CswRsjV3kH.exe

Function 09348198 Relevance: 7.9, Strings: 6, Instructions: 424
COMMON

Function 072E3AFC Relevance: 6.9, Strings: 5, Instructions: 682
COMMON

Function 09341868 Relevance: 213.2, Strings: 168, Instructions: 3210
COMMON

Function 05FD3920 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 379
COMMON

Function 09340828 Relevance: 4.0, Strings: 3, Instructions: 262
COMMON

Function 09345877 Relevance: 3.8, Strings: 3, Instructions: 42
COMMON

Function 09345888 Relevance: 3.8, Strings: 3, Instructions: 36
COMMON

Function 072E9435 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165
fileCOMMON

Function 072E9440 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 161
fileCOMMON

Function 056944C8 Relevance: 3.1, APIs: 2, Instructions: 136
threadCOMMON

Function 056944D8 Relevance: 3.1, APIs: 2, Instructions: 128
threadCOMMON